ClawHub
Back to skill

Security audit

perkoon-transfer

Security checks across malware telemetry and agentic risk

Overview

Perkoon is a disclosed file-transfer skill, but it should be reviewed because some automation paths bypass confirmations, run unpinned remote code, or dynamically fetch latest packages.

Install only if you are comfortable granting an agent file-transfer capability. Require explicit approval for each file sent, use passwords for sensitive transfers, avoid the browser automation commands that skip confirmations or run downloaded scripts, and check receive destinations before allowing overwrite behavior.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (9)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
Replace `/path/to/file` with the actual file path:

```bash
rm -f /tmp/perkoon-send.log /tmp/perkoon-send.pid
npx -y perkoon@0.5.7 send /path/to/file --json --timeout 1800 > /tmp/perkoon-send.log 2>&1 &
echo $! > /tmp/perkoon-send.pid
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
Replace `/path/to/file` with the actual file path:

```bash
rm -f /tmp/perkoon-send.log /tmp/perkoon-send.pid
npx -y perkoon@0.5.7 send /path/to/file --json --timeout 1800 > /tmp/perkoon-send.log 2>&1 &
echo $! > /tmp/perkoon-send.pid
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
Replace `CODE` with the 12-character session code:

```bash
rm -f /tmp/perkoon-recv.log /tmp/perkoon-recv.pid
npx -y perkoon@0.5.7 receive CODE --json --overwrite --output /home/openclaw/.openclaw/workspace/received/ > /tmp/perkoon-recv.log 2>&1 &
echo $! > /tmp/perkoon-recv.pid
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Context Leakage

High
Category
Data Exfiltration
Content
}
```

### Create a send session

```json
{
Confidence
85% confidence
Finding
The A2A 'send session' flow creates externally reachable transfer sessions and returns sender URLs, CLI commands, and sender keys intended to move files outside the current trust boundary. In this skill's context, that expands the chance of sensitive context or files being exfiltrated if an agent initiates a send with insufficient user confirmation or data classification.

Self-Modification

High
Category
Rogue Agent
Content
| `--timeout <sec>` | Peer wait time in P2P mode (default: 300, use 1800 for sends) |
| `--output <dir>` | Save directory (default: ./received) |
| `--output -` | Stream to stdout (no disk write) |
| `--overwrite` | Replace existing files |
| `--quiet` | Suppress human-readable output |

## JSON event stream
Confidence
85% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Unbounded Output

Medium
Category
Output Handling
Content
The agent data layer. Perkoon moves files between agents and the physical world —
  agent to human, agent to agent, agent to pipeline. Small files get free
  cloud delivery — a durable link, fire-and-forget, no receiver needed.
  Larger files stream direct P2P over WebRTC, no size limit.
  Free. Encrypted. Unlimited. No accounts.
  CLI, MCP server, A2A protocol, browser automation — pick the interface
  that fits your runtime.
Confidence
75% confidence
Finding
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The browser automation section instructs users to fetch JavaScript directly from a remote domain with curl and immediately execute it with node. This is dangerous because it grants arbitrary code execution to whatever content is served at that URL at runtime, which is broader than the stated file-transfer function and creates a supply-chain/RCE risk if the endpoint is compromised or changed.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill tells agents to download and run remote scripts without any warning that this executes untrusted code from the network. In an agent setting, that omission materially increases the chance of silent arbitrary code execution and compromise of the host environment.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
### Manual sender flow

1. Navigate to `https://perkoon.com/create`, accept TOS, click Start
2. Skip confirmation modals: `localStorage.setItem('perkoon_skip_confirm_direct-confirm', 'true')` and `localStorage.setItem('perkoon_skip_confirm_staged-confirm', 'true')`
3. Add files: `page.setInputFiles('[data-testid="file-input"]', filePath)`
4. Share session code with recipient
5. Wait for receiver: `page.waitForFunction(() => window.__perkoon?.participants?.length >= 2, null, { timeout: 300000 })`
Confidence
86% confidence
Finding
The browser automation guidance explicitly instructs agents to skip confirmation modals by mutating localStorage flags. This bypasses user-facing safety and consent checkpoints, enabling unattended transfers or actions the UI intentionally designed to require acknowledgement.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.