MEGAcmd

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 1.0.1

Overview

This MEGA.nz CLI skill is coherent, but it needs review because it handles cloud-account credentials and destructive cloud/file operations while showing unsafe password-in-command examples.

Install only if you are comfortable letting an agent operate MEGAcmd on your cloud account. Do not give passwords, MFA codes, session IDs, recovery keys, proxy passwords, or link passwords in chat or inline shell commands; use interactive login or a protected secret mechanism. Require explicit confirmation for deletes, password/session changes, sync setup, public links, writable shares, WebDAV/FTP public access, and any sudo installation step.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:51

Finding

Passwords and Authentication Codes Are Passed Through Command-Line Arguments

Content

View full analysis

/dev/null 2>&1 && echo "LOGGED IN" || echo "NOT LOGGED IN" ``` ```text If the server is not running: `mega-cmd-server &` If not logged in: `mega-login email password` ``` ```bash ### Scriptable Mode (agent uses this → ALWAYS use `mega-`) mega-login email password mega-put ~/file.pdf /Destination/ mega-get /remote/file.pdf ~/Downloads/ ``` ```bash ### Interactive Mode mega-cmd MEGA CMD> login email password MEGA CMD> put ~/file.pdf /Destination/ ``` The same unsafe pattern also appears in: - `README.md`, lines 173-183 - `README.md`, lines 203-209 - `README.pt-BR.md`, lines 173-183 and 203-209 - `SKILL.pt-BR.md`, lines 66 and 85-101 - `references/complete-commands-reference.md`, lines 44-80 - `references/comandos-completos.pt-BR.md`, lines 44-80 ### Technical Analysis The skill repeatedly presents commands that place account passwords and optional MFA authentication codes directly in the command-line argument vector. Depending on the operating system and execution environment, these values may be exposed through: - Shell history files - Process enumeration utilities such as `ps` - Process accounting and endpoint monitoring - CI/CD logs - Terminal transcripts - Agent tool-call telemetry - Automation audit logs - Error reports that record the complete command Although later sections warn that inline passwords are unsafe, the prerequisite workflow directly instructs the agent to use `mega-login email password`. The unsafe command is therefore likely to be copied or executed before the warning is considered. Placeholder values can also be replaced automatically with real user credentials by an agent. The command reference similarly documents password changes, account ...[truncated 1706 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: README.md:91

Finding

Privileged Installation Is Performed Without Package Integrity or Version Verification

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 90% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · references/complete-commands-reference.md (reported line 588)May include surrounding context.

• sync -p ID|localpath — Pause
• sync -e ID|localpath — Resume

sync-ignore — Ignore Filters

text

sync-ignore [--show|[--add|--add-exclusion|--remove|--remove-exclusion] filter1 filter2 ...] (ID|localpath|DEFAULT)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README says the skill is automatically activated when conversation context matches the description, but it does not define clear boundaries for when that happens or when it should not. Although some example phrases are provided, the activation condition remains broad and lacks exclusion conditions or negative examples, which can lead to accidental triggering.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

A documentação inclui exclusão de arquivos e operações sensíveis de conta, como senha, master key, sessões e compartilhamentos, sem um alerta geral sobre irreversibilidade, bloqueio de conta ou perda permanente de acesso e dados. No contexto de uma skill para automação, a ausência desse aviso aumenta o risco de ações destrutivas executadas por engano pelo agente ou pelo usuário.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

A documentação promove sincronização bidirecional, mas não alerta de forma explícita que exclusões, renomeações e sobrescritas locais ou remotas podem se propagar automaticamente para o outro lado. Em uma skill para agentes, isso é mais perigoso porque um agente pode acionar sync em diretórios errados ou com estado desatualizado, causando perda de dados em escala.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 101)May include surrounding context.

bash

# Adicionar repositório
wget -O /tmp/megacmd.deb https://mega.nz/linux/repo/xUbuntu_24.04/amd64/megacmd_2.5.2-1_amd64.deb
sudo dpkg -i /tmp/megacmd.deb
sudo apt install -f

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 102)May include surrounding context.

bash

# Adicionar repositório
wget -O /tmp/megacmd.deb https://mega.nz/linux/repo/xUbuntu_24.04/amd64/megacmd_2.5.2-1_amd64.deb
sudo dpkg -i /tmp/megacmd.deb
sudo apt install -f

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 128)May include surrounding context.

bash

# Adicionar repositório
wget -O /tmp/megacmd.deb https://mega.nz/linux/repo/xUbuntu_24.04/amd64/megacmd_2.5.2-1_amd64.deb
sudo dpkg -i /tmp/megacmd.deb
sudo apt install -f

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.pt-BR.md (reported line 101)May include surrounding context.

bash

# Adicionar repositório
wget -O /tmp/megacmd.deb https://mega.nz/linux/repo/xUbuntu_24.04/amd64/megacmd_2.5.2-1_amd64.deb
sudo dpkg -i /tmp/megacmd.deb
sudo apt install -f

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.pt-BR.md (reported line 102)May include surrounding context.

bash

# Adicionar repositório
wget -O /tmp/megacmd.deb https://mega.nz/linux/repo/xUbuntu_24.04/amd64/megacmd_2.5.2-1_amd64.deb
sudo dpkg -i /tmp/megacmd.deb
sudo apt install -f

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.pt-BR.md (reported line 128)May include surrounding context.

bash

# Adicionar repositório
wget -O /tmp/megacmd.deb https://mega.nz/linux/repo/xUbuntu_24.04/amd64/megacmd_2.5.2-1_amd64.deb
sudo dpkg -i /tmp/megacmd.deb
sudo apt install -f

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The instruction says agents 'ALWAYS use mega- as prefix' and frames the terminal interaction in English-only command terms, while the document does not offer any language or locale choice. Because SQP-3 covers natural-language policy violations including forced language/locale without user opt-in, this is a policy concern in the skill guidance.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md

> ⚠️ **Security Warning — Recovery Key**
> The master key (recovery key) is essential for data recovery. If lost, you cannot recover your data without the password. If exposed, an attacker gains durable access to your account.
> **Recommendation:** Save the master key to encrypted storage (password manager, encrypted USB). Store it with restricted file permissions (e.g., `chmod 600`). Do NOT sync the plaintext file to cloud storage.

> ⚠️ **Security Warning — Session Token**
> The session ID is a bearer credential. If exposed, anyone can impersonate your session until it expires or is revoked.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The skill includes concrete local deletion commands (find ... -delete) in an 'action plan' immediately after noting they delete without confirmation. In an agent context, this can lead to autonomous destructive actions on the local filesystem if the agent follows the runbook without obtaining explicit per-command user approval or validating paths, especially during troubleshooting when operators are under pressure.

Content

Scanner excerpt · SKILL.md (reported line 372)May include surrounding context.

md

| "quota" in log | Storage quota exceeded | `mega-df -h`, free up space |
| LOG full of "Can't find" | Deleted/moved files | Usually resolves itself after rescan |

> ⚠️ The following commands delete local files without confirmation. Verify paths are correct before running.

### Action plan for stuck sync

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

O skill mostra exemplos e fluxo operacional com mega-login email password, o que normaliza o uso de senha inline mesmo havendo aviso posterior de que isso expõe credenciais ao histórico do shell, lista de processos e logs do agente. Em um contexto de agente automatizado, esse padrão é especialmente arriscado porque a entrada e a telemetria podem ser persistidas e reutilizadas por terceiros.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

A instrução inicial de login recomenda passar a senha diretamente na linha de comando antes de apresentar o alerta de segurança, o que cria uma orientação insegura e fácil de copiar. Como este skill é destinado a agentes e automação, a contradição aumenta a chance de vazamento de credenciais em logs, histórico, monitoramento de processos e transcrições de chat.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.pt-BR.md (reported line 126)May include surrounding context.

md

> ⚠️ **Aviso de Segurança — Chave de Recuperação**
> A chave mestre (chave de recuperação) é essencial para a recuperação de dados. Se perdida, você não pode recuperar seus dados sem a senha. Se exposta, um invasor ganha acesso durável à sua conta.
> **Recomendação:** Salve a chave mestre em armazenamento criptografado (gerenciador de senhas, USB criptografado). Armazene com permissões de arquivo restritas (ex.: `chmod 600`). Não sincronize o arquivo de texto puro para a nuvem.

> ⚠️ **Aviso de Segurança — Token de Sessão**
> O session ID é uma credencial do tipo bearer. Se exposto, qualquer pessoa pode se passar pela sua sessão até que ela expire ou seja revogada.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

A documentação instrui como expor servidores FTP/WebDAV com a flag --public, inclusive em funcionalidades marcadas como beta, mas não traz um aviso claro de que isso publica dados na rede e pode permitir acesso não autorizado se usado em redes não confiáveis. Em um skill de agente, isso é mais perigoso porque o agente pode sugerir ou executar comandos diretamente, levando usuários a exporem conteúdo do MEGA sem compreender o alcance da exposição.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/complete-commands-reference.md (reported line 117)May include surrounding context.

text

passwd [-f] [--auth-code=XXXX] newpassword

• -f — Force (no asking)
• --auth-code=XXXX — Two-factor authentication code
• Changes password and closes all active sessions (except current)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 81% confidence

Finding

Documenting rm -f for recursive remote deletion without an explicit caution can be dangerous in an agent skill because it removes interactive safeguards while operating on cloud data. If an agent mis-parses a path, expands patterns broadly, or acts on ambiguous instructions, users can suffer irreversible or difficult-to-recover remote data loss.

Content

Scanner excerpt · references/complete-commands-reference.md (reported line 309)May include surrounding context.

rm [-r] [-f] [--use-pcre] remotepath

text

- `-r` — Recursive (for folders)
- `-f` — Force (no asking)

### put
Upload files/folders.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 84% confidence

Finding

deleteversions -f --all suppresses prompts for mass removal of historical file versions, which can eliminate recovery options across the account. In an autonomous agent context, that is meaningfully risky because one mistaken command can convert recoverable user mistakes or ransomware rollback opportunities into permanent loss.

Content

Scanner excerpt · references/complete-commands-reference.md (reported line 440)May include surrounding context.

text

deleteversions [-f] (--all | remotepath1 remotepath2 ...) [--use-pcre]

• -f — Force (no asking)
• --all — Delete versions of all nodes
• Current version is preserved

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation exposes an option to bind an FTP service for MEGA content to external interfaces via --public without an adjacent warning about the security implications. In an agent skill context, this can lead users or downstream agents to publish cloud-hosted files onto the network unintentionally, especially if combined with weak defaults, absent TLS, or broad path selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The WebDAV section documents --public external exposure but does not clearly warn that enabling it makes MEGA-backed content reachable over the network. In a CLI agent skill, omission of this warning increases the chance of accidental data exposure because agents may treat --public as a routine convenience flag rather than a sensitive publishing action.

Content

No source excerpt is available for this finding.