ClawHub
Back to skill

Security audit

MEGAcmd for Developer

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only developer guide for building MEGAcmd; it includes normal but host-changing setup and install commands that users should approve before running.

Install only if you want an agent to help with MEGAcmd development. Review before allowing commands that use sudo, install packages, clone repositories, initialize submodules, run Docker builds, or start/debug MEGAcmd with real account data; use a dedicated development directory or isolated environment for builds and tests.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The activation trigger is broad enough that an agent could invoke this development skill whenever a user merely mentions MEGAcmd, build, tests, or contribution topics, even if the user did not intend system-changing developer actions. In this skill, automatic activation can lead to presenting or executing package installation, cloning, build, or test commands that modify the local machine, so ambiguous routing increases the chance of unintended privileged or disruptive actions.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
# Install system dependencies
sudo apt update
sudo apt install -y git cmake g++ pkg-config curl zip unzip tar

# Clone the repository
Confidence
90% confidence
Finding
This line instructs use of sudo to update package metadata, which requires elevated privileges and changes system package state. In an agent-execution context, privileged commands are risky because they can be run without sufficient user awareness and are often chained with later installations or script execution.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
# Install system dependencies
sudo apt update
sudo apt install -y git cmake g++ pkg-config curl zip unzip tar

# Clone the repository
git clone https://github.com/meganz/MEGAcmd.git
Confidence
94% confidence
Finding
This command installs multiple packages as root, directly modifying the operating system. Although normal for developer setup, in an agent skill it is dangerous because it authorizes broad privileged changes and may be executed automatically if the skill is mis-invoked.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
# Use ccache for faster recompilation
sudo apt install ccache

cmake -B build/build-cmake-Debug \
  -DCMAKE_BUILD_TYPE=Debug \
Confidence
86% confidence
Finding
Installing ccache with sudo is another privileged system modification. The command is less risky than arbitrary script execution, but still expands the attack surface and can surprise users when executed by an autonomous agent rather than a human following documentation.

Vague Triggers

Medium
Confidence
90% confidence
Finding
O texto diz que a skill é ativada automaticamente quando o contexto 'envolver desenvolvimento do MEGAcmd', mas não define fronteiras claras sobre o que conta ou não como esse contexto. Embora haja exemplos de frases para forçar ativação, faltam exemplos negativos ou exclusões para evitar invocações não intencionais.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
A documentação inclui comandos privilegiados como 'sudo apt update' e 'sudo apt install' sem um aviso explícito de que eles modificam o sistema hospedeiro e exigem revisão do usuário. Em um contexto de skill para agentes, isso é perigoso porque um agente pode reproduzir esses comandos automaticamente, causando alterações persistentes no ambiente sem consentimento suficientemente informado.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
# Instalar dependências de sistema
sudo apt update
sudo apt install -y git cmake g++ pkg-config curl zip unzip tar

# Clonar o repositório
Confidence
94% confidence
Finding
O uso de 'sudo apt update' executa uma operação privilegiada no sistema hospedeiro. Em isolamento isso é um comando comum de administração, mas em uma skill para agentes ele eleva o risco de modificações automáticas do sistema e amplia o impacto de qualquer erro, instrução incorreta ou cadeia de comando subsequente.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
# Instalar dependências de sistema
sudo apt update
sudo apt install -y git cmake g++ pkg-config curl zip unzip tar

# Clonar o repositório
git clone https://github.com/meganz/MEGAcmd.git
Confidence
95% confidence
Finding
O comando 'sudo apt install -y ...' instala e modifica pacotes do sistema com privilégios elevados, além de usar '-y', reduzindo a oportunidade de revisão interativa. Em um contexto de skill acionável por agentes, isso aumenta o risco de mudanças persistentes não intencionais no host e de ampliar danos se dependências incorretas forem instaladas.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
# Usar ccache para acelerar recompilações
sudo apt install ccache

cmake -B build/build-cmake-Debug \
  -DCMAKE_BUILD_TYPE=Debug \
Confidence
91% confidence
Finding
Ainda que 'sudo apt install ccache' seja menos sensível do que instalar uma pilha completa, continua sendo uma operação privilegiada que altera o sistema hospedeiro. Em uma skill de desenvolvimento, isso é contextual e esperado, mas permanece perigoso se executado automaticamente sem aprovação do usuário.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The file title and body content are presented entirely in pt-BR, and the skill does not indicate that the user can choose another language or that the locale restriction is required for a Brazil/Portuguese-specific use case. This can violate a language/locale policy when skills force a specific language without user opt-in.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
### Instalar (Linux/macOS)

```bash
sudo cmake --install build/build-cmake-Release
```

### Opções de build importantes
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
### Instalar (Linux/macOS)

```bash
sudo cmake --install build/build-cmake-Release
```

### Opções de build importantes
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium
Category
Rogue Agent
Content
### macOS (DMG)
- `build/installer_mac.sh` — Script de instalação
- `build/installer/Info.plist.in` — Template Info.plist

### Synology NAS
- `build/SynologyNAS/generate_pkg.sh` — Gerar pacote SPK
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
### macOS (DMG)
- `build/installer_mac.sh` — Script de instalação
- `build/installer/Info.plist.in` — Template Info.plist

### Synology NAS
- `build/SynologyNAS/generate_pkg.sh` — Gerar pacote SPK
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The setup instructions include commands that install packages, clone repositories, fetch submodules, and build software, but the README does not warn that these actions modify the host system and may download untrusted third-party content. In an agent setting, omission of such warnings increases the risk that users or automated agents run invasive commands without informed consent.

Missing User Warnings

Low
Confidence
73% confidence
Finding
Os comandos de 'git clone' e 'git submodule update --init --recursive' baixam código externo para o ambiente do usuário, mas a skill não destaca isso como comportamento com impacto no sistema. Em documentação operacional, uma nota de transparência ajuda o usuário a entender que haverá obtenção de código e dependências de fontes remotas.

Static analysis

No suspicious patterns detected.