ClawHub
Back to skill

Security audit

File Management

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent AgentPMT cloud file-management integration, but it asks agents to rely on mutable live instructions and unpinned setup installs while handling uploads, deletion, and public sharing.

Install only if you are comfortable with AgentPMT-hosted storage and remote setup. Confirm before uploading sensitive files, creating share links, returning signed URLs, extending paid storage, or deleting files, and prefer pinned or reviewed setup versions instead of running the unpinned npx examples in sensitive environments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:255
Finding

Unpinned Remote Skill Installation and Mutable Instruction Authority

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:14, SKILL.md:190, SKILL.md:255-270, and SKILL.md:319-321
Vulnerability Type: Unpinned third-party dependencies and remotely mutable instructions
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:14:

text
If the current date is more than 7 days after the last updated date, reinstall this skill from skills.sh or ClawHub before relying on endpoints, schemas, setup steps, or examples.

SKILL.md:190:

text
- Treat returned live schema and instructions as more specific than this generated summary.

SKILL.md:255-270:

text
- What AgentPMT is: ../what-is-agentpmt
  - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt
  - OpenClaw install: `openclaw skills install what-is-agentpmt`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup
  - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup
  - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`
- No-account AgentAddress/x402 setup: ../agentpmt-no-account-agentaddress-x402
  - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-no-account-agentaddress-x402
  - OpenClaw install: `openclaw skills install agentpmt-no-account-agentaddress-x402`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-no-account-agentaddress-x402`

skills.sh install script:

```bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup
npx skills add AgentPMT/agent-skills --skill agentpmt-no-account-agentaddress-x402
text

### Technical Analysis

The Skill directs users to install several exter
...[truncated 3130 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin each external Skill to a reviewed immutable release, exact commit hash, or content-addressed artifact rather than resolving the latest version by name.
  2. Publish and verify cryptographic checksums or signatures for every installed dependency.
  3. Vendor security-critical account and wallet setup instructions into the reviewed package where practical.
  4. Replace automatic age-based reinstallation guidance with an explicit update review process that displays version and integrity information and requires user approval.
  5. Do not automatically treat live instructions as more authoritative than local security constraints. Validate remote responses against a fixed local schema and reject instructions that introduce new tools, destinations, credential requests, or executable steps.
  6. Require explicit confirmation before installing dependencies, changing authentication or payment configuration, creating public shares, or uploading files.
  7. Restrict outbound connections to documented AgentPMT HTTPS endpoints and validate the scheme, hostname, and expected storage-provider destination before using any returned signed upload URL.
  8. Execute package installation and setup with the minimum required privileges in a sandboxed environment without unrelated credentials or filesystem access.
  9. Maintain an auditable dependency manifest recording the exact reviewed versions and hashes of all required Skills.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (24)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill exposes destructive and privacy-sensitive actions such as delete, share, access_history, and content download but does not require explicit user-consent or warning guidance before those operations. In an agent context, this increases the chance of unauthorized deletion, unintended public sharing, or disclosure of file contents/history due to over-eager automation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill advertises broad discovery terms like 'file management', 'limit', and generic upload/download concepts, which can cause agents to invoke it in situations where the user did not intend cloud file operations. Since the tool supports persistent storage, sharing, deletion, and URL generation, accidental activation can lead to privacy-impacting or destructive actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs users to install dependencies via unpinned npx skills commands, which can fetch the latest package version at execution time. This creates a supply-chain risk: if the package is compromised or a breaking/malicious version is published, users may execute unreviewed code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This line promotes an unpinned npx skills install path, allowing whatever version is current at install time to run. That exposes users to dependency confusion or compromised upstream release scenarios typical of npm-based bootstrap tooling.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

An unversioned npx skills example causes remote package resolution and execution without a fixed version boundary. In a security-sensitive agent ecosystem, that increases the chance of unintended code execution from a compromised or changed package.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill includes another floating npx skills invocation, which inherits the same package-supply-chain risk as other unpinned npx commands. Users following documentation may execute updated code that has not been reviewed with this skill version.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This unpinned installation command permits execution of whatever package version npm resolves at the time of use. That can materially affect integrity of the local environment and the skill installation path if the upstream package changes or is hijacked.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

Because npx executes remote package code dynamically, leaving the package version unspecified creates a repeatable supply-chain exposure. The risk is not from the file-management API itself but from how the skill instructs users to obtain supporting components.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

Another unpinned npx skills command appears in the setup block, creating the same opportunity for unintended code execution through package substitution or malicious upstream changes. Repetition increases exposure because users are encouraged to run several such commands.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This referenced npx skills command is also unpinned, so installation behavior depends on mutable upstream state. In production agent environments, that is a meaningful software supply-chain weakness even if the intent is ordinary documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The installation example executes a non-pinned package through npx, which is a known risky pattern for reproducibility and integrity. A compromised or altered package release could affect all users who follow the skill instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This final npx skills reference repeats the same mutable-install problem: users may run code from an arbitrary future package version. Because these are setup instructions, the risk occurs before any normal guardrails of the tool itself apply.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.

md
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- No-account AgentAddress/x402 setup: ../agentpmt-no-account-agentaddress-x402 (ClawHub: `agentpmt-no-account-agentaddress-x402`, page: https://clawhub.ai/agentpmt/agentpmt-no-account-agentaddress-x402; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-no-account-agentaddress-x402`)
- Marketplace product: https://www.agentpmt.com/marketplace/file-management
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 324)May include surrounding context.

md
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- No-account AgentAddress/x402 setup: ../agentpmt-no-account-agentaddress-x402 (ClawHub: `agentpmt-no-account-agentaddress-x402`, page: https://clawhub.ai/agentpmt/agentpmt-no-account-agentaddress-x402; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-no-account-agentaddress-x402`)
- Marketplace product: https://www.agentpmt.com/marketplace/file-management
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown schema describes a permanent file deletion operation, but the entry only states the action and parameters without any warning about irreversible data loss or need for user confirmation. For markdown files, destructive behaviors affecting user data should be accompanied by a clear warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill explicitly supports creation of public share links for existing files but does not warn that this changes the file's exposure boundary from private storage to internet-accessible sharing. In an agent context, that omission increases the chance of accidental disclosure of sensitive files because callers may not realize they are publishing access via a share URL and password.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The upload actions instruct callers to PUT exact file bytes to an external signed URL without clearly warning that file contents are being transmitted to external storage infrastructure. In agent-mediated use, this omission can cause users or orchestrators to upload sensitive material without appreciating the privacy, retention, and destination implications.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · schema.md (reported line 453)May include surrounding context.

md
|---|---|---|---|
| `content_length_bytes` | `integer` | yes | Exact file size in bytes. Must match the Content-Length header on PUT. File size must be over 10MB and up to 100MB. |
| `content_type` | `string` | no | MIME type of the file. Default: application/octet-stream. |
| `expiration_days` | `integer` | no | Days until file expires and is automatically deleted (1-7). Default: 7. |
| `filename` | `string` | no | Original filename including extension. If omitted, a filename is auto-generated. |
| `metadata` | `object` | no | Custom metadata as key-value pairs to attach to the file. |
| `password_max_minutes` | `integer` | no | Minutes until the auto-generated share password expires (1-10). Only relevant when shared is true. |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · schema.md (reported line 493)May include surrounding context.

md
|---|---|---|---|
| `content_length_bytes` | `integer` | yes | Exact file size in bytes. Must match the Content-Length header on PUT. File size must be over 10MB and up to 100MB. |
| `content_type` | `string` | no | MIME type of the file. Default: application/octet-stream. |
| `expiration_days` | `integer` | no | Days until file expires and is automatically deleted (1-7). Default: 7. |
| `filename` | `string` | no | Original filename including extension. If omitted, a filename is auto-generated. |
| `metadata` | `object` | no | Custom metadata as key-value pairs to attach to the file. |
| `password_max_minutes` | `integer` | no | Minutes until the auto-generated share password expires (1-10). Only relevant when shared is true. |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · schema.md (reported line 555)May include surrounding context.

md
|---|---|---|---|
| `content_length_bytes` | `integer` | yes | Exact file size in bytes. Must match the Content-Length header on PUT. File size must be over 10MB and up to 100MB. |
| `content_type` | `string` | no | MIME type of the file. Default: application/octet-stream. |
| `expiration_days` | `integer` | no | Days until file expires and is automatically deleted (1-7). Default: 7. |
| `filename` | `string` | no | Original filename including extension. If omitted, a filename is auto-generated. |
| `metadata` | `object` | no | Custom metadata as key-value pairs to attach to the file. |
| `password_max_minutes` | `integer` | no | Minutes until the auto-generated share password expires (1-10). Only relevant when shared is true. |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · schema.md (reported line 595)May include surrounding context.

md
|---|---|---|---|
| `content_length_bytes` | `integer` | yes | Exact file size in bytes. Must match the Content-Length header on PUT. File size must be over 10MB and up to 100MB. |
| `content_type` | `string` | no | MIME type of the file. Default: application/octet-stream. |
| `expiration_days` | `integer` | no | Days until file expires and is automatically deleted (1-7). Default: 7. |
| `filename` | `string` | no | Original filename including extension. If omitted, a filename is auto-generated. |
| `metadata` | `object` | no | Custom metadata as key-value pairs to attach to the file. |
| `password_max_minutes` | `integer` | no | Minutes until the auto-generated share password expires (1-10). Only relevant when shared is true. |

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The download action can return signed URLs, but the docs do not state that such URLs are bearer secrets that grant file access to anyone who obtains them until expiration. In an agent workflow, this can lead to inadvertent leakage through logs, chat transcripts, or downstream tools that treat URLs as harmless metadata.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The upload_large documentation states that content_type is a MIME type, but the sample value shown is natural-language text ("Draft marketing copy to check for banned phrases.") rather than a MIME type. This is an active contradiction in the documentation example and could mislead integrators about what the field is actually used for.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The upload_standard documentation says content_type should be a MIME type, but the sample value is free-form prose rather than a MIME type. That directly conflicts with the field description and may cause consumers to supply incorrect values.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.