ClawHub
Back to skill

Security audit

perkoon-transfer

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent file-transfer skill, but it needs Review because it tells agents to execute unverified remote code and weakens some receive/send safeguards.

Install only if you are comfortable with an agent transferring explicitly selected files through Perkoon. Prefer the MCP or pinned CLI path over the curl-and-node browser scripts, avoid using command-line passwords for sensitive transfers, receive into a fresh empty directory when possible, and do not let the agent bypass confirmation steps for sensitive files or unknown session codes.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:323
Finding

Mutable Remote Scripts Are Downloaded and Executed Without Integrity Verification

Content
View full analysis
send.mjs && node send.mjs /path/to/file.zip curl https://perkoon.com/perkoon_receive.mjs > receive.mjs && node receive.mjs SESSION_CODE ./output ``` ### Technical Analysis The browser-automation instructions download JavaScript from externally controlled URLs and immediately execute it with Node.js. Although HTTPS protects the connection in transit, the commands do not pin a script version or verify a cryptographic checksum or signature. Consequently, the code ultimately executed can change after the Skill has been reviewed. Compromise of the hosting service, deployment pipeline, domain, or relevant signing infrastructure could replace either script with an arbitrary payload. The downloaded process would run with the same operating-system permissions, environment variables, filesystem access, and network access as the invoking agent. This exceeds the minimum privileges needed for file transfer because a remote server is implicitly granted the ability to supply general-purpose executable code rather than only exchange file data through a constrained protocol. ### Attack Path 1. An attacker compromises the Perkoon web host, its deployment pipeline, or another component capable of modifying the referenced scripts. 2. The attacker replaces `perkoon_send.mjs` or `perkoon_receive.mjs` with malicious JavaScript. 3. An agent follows the documented command and downloads the altered script. 4. The shell executes the downloaded script through `node` without validating its identity or integrity. 5. The payload reads files, environment variables, workspace content, or credentials available to the agent. 6. The payload can exfiltrate those resources or perform other actions allowed by the agent account. ### Impact Assessment Successful exp ...[truncated 413 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:88
Finding

Third-Party npm Packages Are Downloaded and Executed Without a Pinned Integrity Digest

Content
View full analysis
/tmp/perkoon-send.log 2>&1 & ``` Additional send and receive examples execute the same package through `npx -y`. ### Technical Analysis The instructions use explicit package versions, which is safer than using `latest`, but version pinning alone does not establish that the retrieved package is the exact artifact that was independently reviewed. No trusted lockfile integrity value, package signature, vendored artifact, or reproducible-build verification is supplied. The `-y` option suppresses the normal installation confirmation, after which npm package installation or runtime code executes under the agent account. If the registry artifact, publisher account, package distribution process, or a transitive dependency is compromised, malicious code can execute before or during the intended file-transfer operation. The issue affects both the MCP server and CLI paths. These packages necessarily process local file paths selected for transfer, making dependency compromise particularly sensitive. ### Attack Path 1. An attacker compromises the package publisher, registry artifact, release process, or an included dependency. 2. A malicious artifact is made available for a package version referenced by the Skill, or the resolution path otherwise supplies attacker-controlled code. 3. The agent runs an `npx -y` command from the documentation. 4. npm retrieves and executes the package without interactive approval and without comparison to a Skill-pinned trusted digest. 5. Malicious package or lifecy ...[truncated 679 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:123
Finding

Transfer Passwords Are Exposed Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (7)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

Replace /path/to/file with the actual file path:

bash
rm -f /tmp/perkoon-send.log /tmp/perkoon-send.pid
npx -y perkoon@0.5.7 send /path/to/file --json --timeout 1800 > /tmp/perkoon-send.log 2>&1 &
echo $! > /tmp/perkoon-send.pid

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

Replace /path/to/file with the actual file path:

bash
rm -f /tmp/perkoon-send.log /tmp/perkoon-send.pid
npx -y perkoon@0.5.7 send /path/to/file --json --timeout 1800 > /tmp/perkoon-send.log 2>&1 &
echo $! > /tmp/perkoon-send.pid

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

The receive example combines destructive temp-file cleanup with an automated receive flow that writes untrusted remote content to disk using --overwrite. In the skill context, this is more dangerous than the send examples because it operationalizes unattended intake of externally supplied files and can replace existing files in the target directory without validation.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

Replace CODE with the 12-character session code:

bash
rm -f /tmp/perkoon-recv.log /tmp/perkoon-recv.pid
npx -y perkoon@0.5.7 receive CODE --json --overwrite --output /home/openclaw/.openclaw/workspace/received/ > /tmp/perkoon-recv.log 2>&1 &
echo $! > /tmp/perkoon-recv.pid

Context Leakage

High
Category
Data Exfiltration
Confidence
85% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

}

text

### Create a send session

```json
{

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

The skill prescribes --overwrite for receives and documents that it replaces existing files. In an agent environment, unconditional overwrite can destroy prior artifacts or clobber important files if the output directory is misconfigured, and it reduces recovery options when handling untrusted incoming data.

Content

Scanner excerpt · SKILL.md (reported line 360)May include surrounding context.

md
| `--timeout <sec>` | Peer wait time in P2P mode (default: 300, use 1800 for sends) |
| `--output <dir>` | Save directory (default: ./received) |
| `--output -` | Stream to stdout (no disk write) |
| `--overwrite` | Replace existing files |
| `--quiet` | Suppress human-readable output |

## JSON event stream

Unbounded Output

Medium
Category
Output Handling
Confidence
75% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
The agent data layer. Perkoon moves files between agents and the physical world —
  agent to human, agent to agent, agent to pipeline. Small files get free
  cloud delivery — a durable link, fire-and-forget, no receiver needed.
  Larger files stream direct P2P over WebRTC, no size limit.
  Free. Encrypted. Unlimited. No accounts.
  CLI, MCP server, A2A protocol, browser automation — pick the interface
  that fits your runtime.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
92% confidence
Finding

The browser automation guidance explicitly tells the agent to bypass confirmation modals by setting localStorage flags. That weakens an intended human-in-the-loop safeguard and increases the chance an agent will proceed with transfers without meaningful user review, especially in an autonomous runtime handling sensitive files.

Content

Scanner excerpt · SKILL.md (reported line 330)May include surrounding context.

md
### Manual sender flow

1. Navigate to `https://perkoon.com/create`, accept TOS, click Start
2. Skip confirmation modals: `localStorage.setItem('perkoon_skip_confirm_direct-confirm', 'true')` and `localStorage.setItem('perkoon_skip_confirm_staged-confirm', 'true')`
3. Add files: `page.setInputFiles('[data-testid="file-input"]', filePath)`
4. Share session code with recipient
5. Wait for receiver: `page.waitForFunction(() => window.__perkoon?.participants?.length >= 2, null, { timeout: 300000 })`

Static analysis

No suspicious patterns detected.