nas-master

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:53 AM UTC
• Version: 1.0.0

Overview

This skill mostly fits a NAS inventory tool, but it asks for broad credentials and persistent indexing while claiming strict read-only safety.

Review before installing. Use only a dedicated low-privilege NAS account, pin SSH host keys, replace blank MySQL root access with a limited database user, define explicit scan roots and exclusions, and avoid generating a web-served dashboard unless you intentionally want the indexed NAS metadata exposed through that local web stack.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

other

Warning

• Location: nas_engine.py:35
• Finding: Unrestricted Collection of Sensitive NAS File Metadata## Vulnerability Details **File Location**: `SKILL.md:20-25`; `nas_engine.py:35-46` **Vulnerability Type**: Excessive Sensitive Information Collection **Risk Level**: Medium The skill explicitly directs the scraper to recursively inspect every accessible directory, including hidden system and application directories: ```markdown ## 2. Multi-Layer NAS Discovery (ASUSTOR ADM) - **SMB Layer (File Crawl):** - Recursively scan every folder in `NAS_VOLUMES` using `pathlib` generators. - Capture: Name, Path, Size, Extension, and Windows ACLs. - Deep Search: Scrape hidden folders like `.@metadata`, `.@encdir`, and `.@plugins`. - **SSH Layer (Deep System):** - Extract RAID levels via `cat /proc/mdstat`. - Extract Btrfs integrity/checksum status via `btrfs scrub status`. - Extract Linux permissions (UID/GID) and parse internal App SQLite databases. ``` The implementation performs the recursive traversal without an allowlist, exclusion rules, scope validation, or a confirmation step: ```python # 2. Crawl Filesystem (including hidden) root = os.getenv("NAS_ROOT_PATH") for dirpath, _, filenames in os.walk(root): for f in filenames: path = os.path.join(dirpath, f) try: stat = os.stat(path) # ACLs and UID/GID logic goes here... query = "INSERT IGNORE INTO file_metadata (filename, filepath, raid_context, btrfs_context) VALUES (%s, %s, %s, %s)" cursor.execute(query, (f, path, raid, btrfs)) db.commit() except: continue time.sleep(0.1) # Throttle for i3 CPU ``` ### Technical Analysis Recursive collection of all reachable file names and paths violates data-minimization and least-privilege principles. File metadata can disclose user identities, confidential project names, backup locations, application internals, encrypted-container locations, and the existence of credential or configuration files even when ...[truncated 1765 chars]
• Remediation: ## Remediation Suggestions - Require an explicit allowlist of approved scan roots rather than accepting an unrestricted root path. - Resolve and canonicalize each configured path, then verify that it remains under an approved volume before traversal. - Exclude credential stores, backups, private user directories, application internals, and hidden system directories by default. - Require an explicit opt-in before scanning hidden or system-managed directories. - Run the scraper under a dedicated read-only NAS account that can access only the directories necessary for the stated task. - Store only metadata required for the application and define a retention and deletion policy. - Restrict access to the metadata database and encrypt sensitive metadata at rest where appropriate. - Add audit logging that records scan initiators, approved roots, exclusions, start and end times, and record counts. - Validate that `NAS_ROOT_PATH` is present and approved before calling `os.walk`.

T09 · Insecure Skill Coding Practices

Error

• Location: nas_engine.py:7
• Finding: SSH Host-Key Verification Disabled## Vulnerability Details **File Location**: `nas_engine.py:7-11` **Vulnerability Type**: Insecure SSH Trust Configuration **Risk Level**: High The SSH client automatically trusts an unknown host key: ```python def get_asustor_system_info(): """Connects via SSH to pull RAID and Btrfs health.""" ssh = paramiko.SSHClient() ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy()) try: ssh.connect(os.getenv("NAS_SSH_HOST"), username=os.getenv("NAS_SSH_USER"), password=os.getenv("NAS_SSH_PASS")) ``` ### Technical Analysis SSH host-key verification authenticates the remote server and protects clients against machine-in-the-middle attacks. Paramiko's `AutoAddPolicy` accepts and stores previously unknown host keys instead of rejecting them. The code also does not call `load_system_host_keys`, load a dedicated known-hosts file, or compare the server key against a pinned fingerprint. Consequently, a client making its first connection—or a client without an existing trusted key—cannot distinguish the intended NAS from an attacker-controlled SSH server. Because password authentication is used, the credentials are supplied during the connection to whichever endpoint is accepted as the server. ### Attack Path 1. An attacker obtains a position from which NAS traffic can be intercepted or redirected, such as control of a local gateway, poisoned DNS, ARP spoofing capability, or a compromised network segment. 2. The attacker redirects the connection intended for `NAS_SSH_HOST` to an attacker-controlled SSH server. 3. The malicious server presents an arbitrary host key. 4. `AutoAddPolicy` accepts the untrusted host key without operator verification. 5. The client initiates password authentication against the attacker-controlled endpoint. 6. The attacker can capture or misuse the supplied NAS SSH credentials and return fabricated RAID or Btrfs output. ### Impact Assessment Successful exploitation may e ...[truncated 532 chars]
• Remediation: ## Remediation Suggestions - Replace `paramiko.AutoAddPolicy()` with `paramiko.RejectPolicy()`. - Load a controlled known-hosts file using `load_host_keys`, or use `load_system_host_keys` when system trust configuration is appropriate. - Provision and pin the NAS host key or fingerprint through a trusted out-of-band process before the first connection. - Fail closed and display the observed fingerprint when the key is missing or has changed; never silently replace a trusted key. - Prefer SSH public-key authentication with a dedicated, read-only NAS account instead of an administrative password. - Protect the private key with appropriate filesystem permissions and, where operationally possible, a passphrase or secure key agent. - Segment NAS management traffic onto a trusted management network.

T09 · Insecure Skill Coding Practices

Error

• Location: nas_engine.py:26
• Finding: Blank-Password MySQL Root Account Hardcoded in Runtime Connection## Vulnerability Details **File Location**: `nas_engine.py:26-28`; `.env:26-30` **Vulnerability Type**: Insecure Database Credentials and Excessive Privileges **Risk Level**: High The application connects directly as MySQL `root` with an empty password: ```python def run_pro_scraper(): db = mysql.connector.connect(host="localhost", user="root", password="", database="asustor_pro") cursor = db.cursor() ``` The environment configuration repeats the insecure defaults: ```dotenv DB_HOST="localhost" DB_USER="root" DB_PASS="" DB_NAME="asustor_pro" ``` ### Technical Analysis The database connection violates least privilege by using the MySQL administrative account for routine inserts. It also embeds a blank password in executable code. Although `.env` defines database settings, the program ignores them and always uses the hardcoded connection parameters. The `localhost` host limits the configured connection to the local database endpoint, but it does not make blank administrative credentials safe. Other local users, compromised web applications, or services running on the same host may be able to attempt authentication with the same credentials. In addition, compromise of the scraper process immediately provides a database connection with the privileges granted to MySQL root rather than only the privileges needed for `file_metadata`. The repository contains no evidence establishing the MySQL authentication plugin, bind configuration, or whether other connections to root are accepted. Exploitability by an unrelated local process therefore depends on the deployed MySQL configuration. The scraper itself, however, is confirmed to request a blank-password root session. ### Attack Path 1. MySQL is deployed with the blank-password root credentials expected by the scraper. 2. An attacker gains code execution in another local application, access to a local account, or control of the scraper process. 3. The attack ...[truncated 1074 chars]
• Remediation: ## Remediation Suggestions - Create a dedicated MySQL service account for the scraper. - Grant only the minimum required permissions, such as `SELECT` and `INSERT` on the required `asustor_pro` tables. Add `UPDATE` only if move-tracking is implemented. - Set a strong, unique, non-empty password and remove blank-password database accounts. - Read `DB_HOST`, `DB_USER`, `DB_PASS`, and `DB_NAME` from protected configuration rather than hardcoding credentials. - Fail closed if any required credential is absent or if `DB_PASS` is empty. - Do not commit operational `.env` files. Provide a sanitized `.env.example` containing placeholders instead. - Store production credentials in an operating-system credential store or secrets manager and restrict access to the scraper's service identity. - Restrict MySQL network exposure, enforce account host constraints, and use TLS if the database is moved off-host. - Review MySQL grants and authentication plugins to ensure administrative accounts cannot authenticate with blank passwords. - Rotate any credentials that may already have been deployed with this configuration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The manifest advertises a strict read-only NAS metadata scraping skill, but the instructions include database writes and generation of PHP files on disk. This mismatch can mislead users and supervising systems into granting trust or access under false assumptions, enabling unintended writes and broader local resource usage.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill omits a clear user warning that it will access broad NAS content, hidden directories, SSH-derived system details, and database credentials. Without informed consent and disclosure, users may unknowingly expose sensitive metadata, permission structures, and infrastructure details beyond what a simple scraper implies.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The instructions direct broad collection of sensitive information, including hidden folders, Linux permission data, RAID/Btrfs system state, and internal app databases, far beyond a minimal metadata scrape. This creates unnecessary exposure of confidential file structures, security-relevant permission mappings, and potentially application data if the output is stored or surfaced elsewhere.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: Claiming strict read-only safety while instructing the agent to persist data into a database is a direct contradiction. Users may authorize the skill believing it cannot modify state, when in fact it performs durable writes that could alter systems, consume storage, or create privacy and compliance issues.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The safety section promises strict read-only behavior, yet the skill elsewhere directs database writes and dashboard file creation. This internal contradiction undermines safety guarantees and can cause operators or users to approve a skill that modifies local or remote state unexpectedly.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The instruction to generate a PHP/AJAX dashboard under a XAMPP webroot contradicts the claimed read-only model and introduces local file writes in a web-served directory. That can expose scraped NAS metadata through a web application and creates an avenue for accidental publication, insecure PHP code generation, or persistence on the host.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The manifest describes the skill as maintaining strict read-only safety for NAS metadata scraping. While the NAS/file access is read-oriented, the implementation opens a database connection and performs INSERT operations with commits, which is write behavior outside a strict read-only interpretation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares access to sensitive environment variables and implies filesystem/credential use, but does not define any explicit tool scope or permission boundaries. This increases the risk that an agent may invoke broader capabilities than the user expects when handling NAS paths, SSH credentials, and database secrets.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Because the skill is user-invocable but lacks clear trigger phrases or activation boundaries, it may activate in broader contexts than intended. For a skill handling NAS paths, SSH credentials, and database operations, ambiguous invocation increases the chance of accidental execution and over-broad data access.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The manifest description centers on ASUSTOR NAS metadata scraping, albeit with hybrid SMB/SSH access. L18-L20 direct the skill to act as a versatile coder, business analyst, and project manager, which materially exceeds the described scraping-focused purpose.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Instructing the skill to continuously search for free online tools, APIs, and resources expands it beyond local NAS scraping into open-ended external discovery. This can lead to unnecessary network access, unvetted third-party interactions, and possible leakage of project context or metadata during external lookups.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: A NAS scraping suite may reasonably crawl shares and collect system metadata, but providing business analysis and strategic planning is not an obvious implementation requirement of that purpose. These capabilities appear to be unrelated role expansion rather than support for the stated functionality.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill pulls SSH credentials from environment variables and uses them to establish a remote shell session, giving the code command-execution capability on the NAS. In a metadata-scraping context, this expands the trust boundary significantly; if the target host or environment is manipulated, the code can be repurposed to run arbitrary commands with the supplied account's privileges.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The code disables SSH host key verification via AutoAddPolicy(), which makes the connection vulnerable to man-in-the-middle attacks and server impersonation. Because credentials are then sent to the remote endpoint and shell commands are executed, an attacker on the network could intercept access or return falsified system-health data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The function connects to a NAS over SSH, collects RAID and Btrfs health information, and returns that data for later storage, but the file provides no confirmation prompt or explicit user-facing warning about accessing remote system metadata. Although there is a docstring, it describes the behavior only at the function level and does not disclose to a user that remote NAS data will be collected and persisted.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The code reads NAS_SSH_USER and NAS_SSH_PASS from environment variables to authenticate to a remote system, but there is no explicit warning or disclosure that credentials will be accessed and used. Accessing sensitive credentials is safety-relevant and should be clearly communicated unless documented elsewhere.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The scraper walks the configured root path, inspects files, and writes file paths and related metadata into a database, but there is no confirmation prompt, warning comment, or docstring explaining this data collection and persistence behavior to the user. This affects potentially sensitive filesystem metadata and performs persistent writes.

Static analysis

No suspicious patterns detected.