ClawHub
Back to skill

Security audit

nzbget

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for NZBGet status checks, but it handles NZBGet credentials insecurely by putting them in a plaintext HTTP URL.

Review before installing. Use this only against a trusted local NZBGet instance or after changing it to use HTTPS and curl authentication options instead of putting the password in the URL. Avoid using it with a remote NZBGet host over an untrusted network, and prefer a least-privileged NZBGet account if available.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/check_nzbget.sh:16
Finding

NZBGet Credentials Exposed Through Plaintext HTTP and Command-Line URL

Content
View full analysis

Vulnerability Details

File Location: scripts/check_nzbget.sh, lines 16–22
Vulnerability Type: Plaintext credential transmission and command-line credential exposure
Risk Level: High

bash
URL="http://${USER}:${PASS}@${HOST}/jsonrpc"

# Helper function to make NZBGet API calls
nzbget_api() {
    local method="$1"
    curl -s -X POST -H "Content-Type: application/json" \
        -d "{\"method\": \"${method}\", \"id\": 1}" \
        "$URL" 2>/dev/null
}

Technical Analysis

The script embeds NZBGET_USER and NZBGET_PASS directly in an HTTP URL. Because the URL explicitly uses http://, neither the credentials nor the returned NZBGet data are protected by transport encryption. A network-positioned attacker can inspect or modify traffic between the script and the NZBGet service.

Passing the credential-bearing URL as a curl command-line argument can also expose it through process-list or process-inspection interfaces to local users with sufficient visibility while the request is running. Suppressing standard error with 2>/dev/null does not protect the credentials and can conceal transport or authentication errors.

The destination is derived from NZBGET_HOST. If an attacker can alter the execution environment or its configuration, the script will send the supplied NZBGet credentials to the attacker-selected host over plaintext HTTP.

Attack Path

  1. A user configures valid NZBGET_USER, NZBGET_PASS, and NZBGET_HOST values and invokes the Skill.
  2. The script constructs a URL containing the plaintext username and password.
  3. The URL is supplied to curl as a process argument, creating a potential local observation window.
  4. curl sends the request to NZBGet without TLS protection.
  5. A network-positioned attacker captures the authentication data or tampers with API responses. Alternatively, a sufficiently privileged local observer reads the credential-bearing process ...[truncated 749 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require HTTPS for all NZBGet API communication:
    bash
    URL="https://${HOST}/jsonrpc"
  2. Keep credentials out of the URL and pass them through curl's authentication option:
    bash
    curl --fail --silent --show-error \
    --user "$USER:$PASS" \
    --header "Content-Type: application/json" \
    --data "{\"method\": \"${method}\", \"id\": 1}" \
    "$URL"
  3. Do not disable TLS certificate validation. Configure the system trust store or use --cacert with a trusted CA certificate when NZBGet uses a private certificate authority.
  4. Validate NZBGET_HOST against an expected hostname or explicit allowlist. Reject values containing schemes, user-information components, paths, control characters, or unexpected ports.
  5. Replace unconditional error suppression with --fail --show-error and return a clear failure without printing credentials.
  6. Use a dedicated, least-privileged NZBGet account where supported and rotate the currently configured password because it may already have been exposed.
  7. Restrict access to the environment or secret store containing the credentials and avoid logging command invocations or expanded environment values.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill invokes a shell script (bash scripts/check_nzbget.sh ...) but does not declare any tool restrictions or allowed-tools scope. That creates unnecessary execution latitude for an agent runtime, making it harder to enforce least privilege and increasing the risk of unintended shell execution or abuse if the skill is modified, misrouted, or combined with untrusted input.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script constructs an http:// URL with embedded username and password, then sends API requests over plaintext HTTP. This exposes credentials and session data to interception by any attacker with network visibility, and embedding secrets in the URL can also leak them via logs, process inspection, proxies, or diagnostics.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/check_nzbget.sh (reported line 21)May include surrounding context.

sh
# Helper function to make NZBGet API calls
nzbget_api() {
    local method="$1"
    curl -s -X POST -H "Content-Type: application/json" \
        -d "{\"method\": \"${method}\", \"id\": 1}" \
        "$URL" 2>/dev/null
}

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The manifest describes a skill for checking NZBGet download status and queue information, but the code also depends on reading authentication secrets from process environment variables. While this may be practical for implementation, access to credentials is an additional capability not reflected in the stated scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.