ClawHub
Back to skill

Security audit

IPFS Server

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a normal IPFS server operations skill, but it includes root-level installer guidance and credential-handling examples that deserve review before use.

Review the installation path before using it. Prefer a trusted package manager or verify Kubo checksums/signatures before running any downloaded installer with sudo. Keep the IPFS API bound to localhost unless you have firewalling and authentication in place, be deliberate before exposing a public gateway, and avoid entering real remote-pinning JWTs directly into shell history or shared terminals.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:22
Finding
Unverified Downloaded Installer Executes with Root Privileges<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 22-25 **Vulnerability Type**: Unverified third-party binary installation **Risk Level**: High ```bash # Or download binary from dist.ipfs.tech curl -O https://dist.ipfs.tech/kubo/v0.24.0/kubo_v0.24.0_darwin-amd64.tar.gz tar -xzf kubo_v0.24.0_darwin-amd64.tar.gz sudo ./kubo/install.sh ``` ### Technical Analysis The documented installation procedure downloads a third-party archive, extracts it, and executes its installation script with `sudo`. It does not verify a cryptographic checksum or release signature before execution. HTTPS provides transport encryption and server authentication, but it does not independently establish that the downloaded artifact is the authentic, expected Kubo release. Compromise of the distribution infrastructure, the release artifact, or the applicable certificate trust path could cause an altered `install.sh` to be executed with root privileges. ### Attack Path 1. An attacker compromises or successfully impersonates the artifact distribution path, or replaces the hosted release archive. 2. A user follows the documented `curl` command and downloads the modified archive. 3. The archive is extracted without integrity or authenticity verification. 4. The user runs the attacker-controlled `install.sh` through `sudo`. 5. The malicious installer executes arbitrary commands with root privileges. ### Impact Assessment Successful exploitation permits arbitrary root-level code execution on the machine performing the installation. This can result in complete host compromise, including modification or theft of files, credential access, security-control tampering, installation of persistent malware, and replacement of the IPFS executable. The immediate scope is the installation host and any data or credentials accessible to the root account. Further lateral movement would depend on credentials and network access available from that host. ]]>
Remediation
<![CDATA[ ## Remediation Suggestions - Publish and document a cryptographic SHA-256 or stronger checksum for the exact release archive. - Download the checksum through an authenticated release channel and verify it before extraction: ```bash curl -O https://dist.ipfs.tech/kubo/v0.24.0/kubo_v0.24.0_darwin-amd64.tar.gz curl -O https://dist.ipfs.tech/kubo/v0.24.0/kubo_v0.24.0_darwin-amd64.tar.gz.sha256 shasum -a 256 -c kubo_v0.24.0_darwin-amd64.tar.gz.sha256 ``` - Prefer a verified release signature over checksum-only validation where upstream signing material is available. - Pin the expected release version and trusted signing-key fingerprint in the documentation. - Abort installation if any integrity or signature verification fails. - Prefer the package-manager installation route when it provides a trusted and auditable supply-chain process. - Inspect the extracted installer and minimize the portion that must run under `sudo`; do not execute the whole installation process as root when only a final file-copy operation requires elevation. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:99
Finding
Remote Pinning JWT Is Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 99 **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ```bash ipfs pin remote service add pinata https://api.pinata.cloud/psa YOUR_JWT ``` ### Technical Analysis The example instructs users to substitute a remote-pinning JWT directly into a command-line argument. A real token entered this way can be retained in shell history. While the command is running, it may also be observable through process-inspection interfaces by users or monitoring software with sufficient local permissions. The command configures a persistent remote pinning service, so disclosure compromises a credential intended to authorize subsequent remote API operations. The exact privileges available to an attacker depend on the scopes assigned to the JWT. ### Attack Path 1. A user replaces `YOUR_JWT` with a valid Pinata or other remote-pinning service token. 2. The shell records the complete command in its history, or the token becomes temporarily visible in the process argument list. 3. A local user, process, support bundle, terminal logger, or monitoring system obtains the exposed argument or history entry. 4. The observer extracts the JWT. 5. The observer authenticates to the remote service and performs operations allowed by the token. ### Impact Assessment An attacker can obtain the remote-service permissions granted to the stolen JWT. Depending on token scope, this may include listing, adding, or removing remote pins, modifying content-retention state, consuming service quotas, and causing financial or operational impact. This issue does not directly grant root access to the local host. Its primary scope is the affected remote-pinning account and the content or quota controlled by the exposed credential. ]]>
Remediation
<![CDATA[ ## Remediation Suggestions - Do not place long-lived secrets directly in documented command-line arguments. - Use an interactive, non-echoing prompt or another IPFS-supported secret-input mechanism that does not expose the token in process arguments. - If the CLI cannot accept the credential securely, clearly warn users about process-list and shell-history exposure and direct them to the safest supported credential-storage workflow. - Retrieve the JWT from a dedicated secret manager or protected credential file with restrictive permissions, such as mode `0600`. - Avoid examples that expand an environment variable into the command line because the expanded value can still appear in process arguments. - Configure least-privilege token scopes and use separate tokens for separate nodes or environments. - Rotate tokens regularly and immediately revoke any token entered into persistent shell history. - Provide shell-specific instructions for securely removing any existing history entry and verify that terminal logging or command auditing does not retain the secret. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The README encourages users to initialize and run an IPFS node and highlights gateway services, peer management, and API-related capabilities without warning that these actions may expose network services, consume significant bandwidth/storage, or unintentionally make content accessible to others. In the context of an infrastructure skill, omission of these operational security warnings can lead users to deploy a reachable node or gateway with insufficient access controls and poor understanding of the resource and privacy implications.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# Or download binary from dist.ipfs.tech
curl -O https://dist.ipfs.tech/kubo/v0.24.0/kubo_v0.24.0_darwin-amd64.tar.gz
tar -xzf kubo_v0.24.0_darwin-amd64.tar.gz
sudo ./kubo/install.sh
```

## Node Initialization
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill includes a remote pinning command that takes a JWT credential inline but does not warn users against pasting real secrets into shell history, logs, screenshots, or shared terminals. In an agent skill focused on operational commands, this increases the chance of credential exposure and unauthorized use of the remote pinning account.

External Transmission

Medium
Category
Data Exfiltration
Content
**Remote pinning services:**
```bash
# Configure remote pinning (Pinata, Web3.Storage, etc.)
ipfs pin remote service add pinata https://api.pinata.cloud/psa YOUR_JWT

# Pin to remote service
ipfs pin remote add --service=pinata --name="my-content" QmHash
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.