Security audit

file-transfer-thru-local-workspace

Security checks across malware telemetry and agentic risk

Overview

This skill is a real local file-transfer tool, but it installs a persistent network file manager with weakly scoped authentication and access to installed skill packages.

Install only if you intentionally want a browser-accessible file manager on port 15170. Use a strong gateway token, avoid password-only or no-auth configurations, restrict the port to trusted hosts or localhost/firewall rules, and inspect/remove any generated systemd service environment containing copied credentials. Do not use it on a shared or exposed machine unless you are comfortable with installed skill packages and uploaded files being accessible through this service.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The documentation claims file access is limited to the uploads directory, but elsewhere explicitly advertises browsing and downloading installed skill packages, which are outside that directory. This creates a misleading security boundary: operators may rely on the stated restriction even though the feature set implies broader filesystem exposure, increasing the chance of unintended disclosure of local code or packaged secrets.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The installer extracts the main OpenClaw gateway token/password from the user's config and reuses it for a separate upload service. This violates credential separation and can expose a more privileged secret to another process, service definition, logs, process inspection, or any weakness in the upload server, potentially broadening compromise beyond the upload feature.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script installs and starts a persistent HTTP upload service bound to a fixed port and explicitly supports unauthenticated operation when no credential is found. In the context of a file-transfer skill, this creates a network-reachable file ingress path into the local workspace, which is dangerous because it can allow unauthorized file placement and persistence on the host.

Intent-Code Divergence

Low

Confidence: 88% confidence
Finding: The comment states systemd service creation is optional, but the code automatically creates, enables, and starts the service whenever systemd is available. This is security-relevant because it misleads the operator about persistence and network exposure, reducing informed consent around a background service.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The page is presented as a generic file-upload interface, but it also exposes functionality to enumerate and download installed skill packages. That mismatch can mislead users and reviewers about the true capabilities of the page, and skill packages may contain proprietary logic, embedded secrets, prompts, or other sensitive implementation details if access control is weak or shared via URL token.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The code fetches /api/skills and supports downloading arbitrary skill packages even though the page appears primarily intended for user file upload. In a skill context, package enumeration and export materially increase the risk of unauthorized discovery and exfiltration of installed skills, especially because access is keyed off a token pulled from the URL query string.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The manifest advertises potentially destructive capabilities such as file deletion and downloading/installing skills, but it does not clearly warn users about the operational and security consequences of those actions. In a file-management skill exposed through a web UI, this omission can lead users to grant trust or permissions without understanding that local files may be removed or that additional code/content may be fetched into the environment.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script reads a token or password from the main config and places it into an environment variable for the upload service. Environment variables may be exposed through process inspection, service metadata, crash reports, or administrative tooling, making credential leakage more likely.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The installer writes to /etc/systemd/system, reloads systemd, enables the service at boot, and starts it immediately without confirmation. This creates persistence and network exposure as a side effect of installation, which is risky because users may not realize they have installed a long-lived background service.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: When systemd is unavailable, the script still launches the upload server in the background with nohup, exposing a network service without prior confirmation. In a file-upload context, silently starting a background listener increases the chance of unintended exposure and unauthorized file delivery to the workspace.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/upload-server.js:202