Unraid XML Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:12 AM UTC
• Version: 1.0.1

Overview

This skill has a coherent Unraid template-generation purpose, but it steers agents toward risky container startup overrides and ships an unsafe generator that can inject DockerMan settings or overwrite arbitrary writable files.

Review before installing. Use this only with trusted inputs, inspect generated XML before import, avoid the default ENTRYPOINT-bypass pattern unless specifically needed, pin Docker images, and do not let an agent choose --output, --extra-params, --post-args, startup commands, or volume mappings without explicit user review.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_template.py:137

Finding

Unescaped CLI Input Allows XML and DockerMan Configuration Injection

Content

View full analysis

{args.extra_params}" elif args.bypass_entrypoint: extra_params = "\n --entrypoint /bin/sh" # PostArgs post_args = build_post_args(args) # WebUI webui = "" if args.web_port: webui = f"\n http://[IP]:[PORT:{args.web_port}]/" # Icon icon = "" if args.icon: icon = f"\n {args.icon}" # Extra volumes from CLI extra_volumes = "" for vol in (args.volume or []): host_path, container_path = vol.split(":") extra_volumes += f"\n {host_path}" template = f""" {args.name} {args.image} bridge{icon}{webui}{extra_params} {post_args} {config_xml}{extra_volumes} """ ``` Related unsafe interpolation is also present in `build_configs()` at lines 35–103, where names, proxy settings, time zones, and environment-variable values are inserted into XML attributes or text nodes without escaping. ### Technical Analysis The generator constructs XML using Python formatted strings. User-controlled values are inserted into XML text nodes and attributes without XML escaping, validation, or use of a structured XML API. Characters such as `<`, `>`, `&`, single quotes, and double quotes can therefore terminate the intended XML element or attribute. An attacker can inject additional DockerMan elements, including `Config`, `ExtraParams`, or `PostArgs` entries. ...[truncated 2150 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_template.py:200

Finding

Arbitrary Writable File Overwrite Through Unrestricted Output Path

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 91% confidence

Finding

The manifest embeds operational guidance that promotes bypassing container ENTRYPOINT behavior as a learned technique, which is consistent with tool/skill metadata poisoning: the skill description itself steers the agent toward unsafe execution patterns. Because agents often treat manifest metadata as trusted routing and behavioral context, poisoning at this layer can systematically bias future outputs toward risky or persistence-enabling configurations.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: unraid-xml-generator
description: |
  Generate Unraid DockerMan user template XML files from structured input.

  Use when: the user asks to "生成 Unraid XML 模板", "创建 Docker 模板",
  "为 XXX 写 Unraid 模板", or "生成 DockerMan XML" for any container.

  Key technique learned (2026-04-02):
    Unraid DockerMan templates support <ExtraParams>--entrypoint /bin/sh</ExtraParams>
    + <PostArgs> to bypass the container image's ENTRYPOINT. This allows
    overriding any image's startup command from the template.

  Config variables use: <Config Name="..." Target="ENV_VAR" Default="..." Type="..." Displ

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 97% confidence

Finding

The skill’s core pattern instructs overriding the container image ENTRYPOINT to /bin/sh and passing the real startup command via shell -ec. This is dangerous because it bypasses image author startup controls and enables arbitrary shell command injection or stealthy behavior through template configuration, especially when combined with user-configurable variables and optional deployment to a live Unraid templates directory.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

<Repository>image:tag</Repository>
  <Network>bridge</Network>

  <!-- KEY: override ENTRYPOINT to /bin/sh -->
  <ExtraParams>--entrypoint /bin/sh</ExtraParams>

  <!-- KEY: pass real startup command through shell -ec -->

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill explicitly states it can deploy generated XML to /boot/config/plugins/dockerMan/templates-user/my-.xml, which is a file-write capability, but the manifest does not declare a restrictive tool scope or permissions boundary. In an agent environment, undeclared write capability increases the risk of unauthorized persistence or configuration tampering because the agent may be invoked without clear user- or platform-level constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrases are broad enough to activate on generic requests to create templates, which can cause the skill to run in contexts the user did not specifically intend. Because this skill teaches and normalizes ENTRYPOINT bypass and can optionally deploy files, overbroad activation materially raises the chance of risky template generation or persistence actions being suggested inappropriately.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script defaults the TZ value to "Asia/Shanghai", which imposes a specific locale setting when the user does not provide one. This is a natural-language locale policy issue because the file does not present the locale as an opt-in choice or document why that region-specific default is required.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The argument definition hard-codes a timezone default while exposing it in user-facing help text, effectively steering all users to a specific locale. Because no opt-in or justification is provided, this violates the rule against forcing a language or locale choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation presents Asia/Shanghai as the standard TZ value, which can steer generated outputs toward a specific locale setting by default. There is no accompanying note that timezone should be selected based on user preference or environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.