Localsend

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:10 PM UTC
• Version: 3.4.0

Overview

This skill is a local file-transfer helper, but it installs unpinned external code and can auto-accept nearby network files into the workspace, so it needs review before use.

Only install this after pinning and verifying the CLI source, changing receive mode to require explicit approval for each transfer, using safe temporary-file handling for text payloads, and treating received files as untrusted before opening, extracting, installing, or deploying them.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:23
• Finding: Mutable Remote Executable Is Downloaded and Trusted Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:23-26` **Vulnerability Type**: Remote payload retrieval and software supply-chain risk **Risk Level**: High ```bash curl -fsSL https://raw.githubusercontent.com/Chordlini/localsend-cli/master/localsend-cli -o ~/.local/bin/localsend-cli chmod +x ~/.local/bin/localsend-cli ``` ### Technical Analysis The installation instructions download an executable Python CLI directly from the mutable `master` branch of an external GitHub repository. The downloaded content is made executable without validating a cryptographic checksum, release signature, pinned commit, or reviewed version. Consequently, the code executed by the Skill can change after the Skill itself has been audited. Compromise of the upstream account or repository, malicious modification of the branch, or an unreviewed upstream change could introduce arbitrary code into the installed CLI. The Skill later invokes this executable for device discovery, sending files, and operating a network receiver. ### Attack Path 1. An attacker compromises the upstream repository, its maintainer credentials, or another mechanism capable of modifying the referenced `master` branch. 2. The attacker replaces or modifies `localsend-cli` with malicious Python code. 3. A user follows the documented installation command. 4. The mutable remote payload is saved under `~/.local/bin/localsend-cli` and marked executable. 5. The Skill invokes the CLI during a discovery, send, or receive operation. 6. The malicious payload executes with the privileges and filesystem/network access of the OpenClaw user. ### Impact Assessment Successful exploitation provides arbitrary code execution under the Agent's operating-system account. The payload could access files available to that account, inspect environment variables, modify user-owned files, transmit data over the network, or alter future file-transfer behavior. The issue does not directly demonstrate root-level privilege e ...[truncated 114 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the dependency to a specific reviewed release or immutable commit hash rather than `master`. - Publish and verify a SHA-256 or stronger cryptographic digest before marking the file executable. - Prefer a signed release artifact and verify its signature against a separately authenticated maintainer key. - Fail closed if checksum or signature verification fails. - Vendor the reviewed CLI into the Skill package when practical, while maintaining a documented update and review process. - Execute the CLI with the minimum necessary filesystem and network permissions, ideally in a sandbox. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:245
• Finding: Arbitrary Text Payload Is Interpolated Into a Shell Command<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:245-252` **Vulnerability Type**: Shell command injection **Risk Level**: High ```bash ### Send Text (`callback_data: ls:sendtext`) 1. Ask: `"Type the text you want to send:"` 2. User types their message 3. Write text to temp file, send: ```bash echo "user's text" > /tmp/localsend-text.txt localsend-cli send --to "Fast Potato" /tmp/localsend-text.txt rm /tmp/localsend-text.txt ``` ``` ### Technical Analysis The workflow instructs the Agent to insert arbitrary user-provided text into a double-quoted shell command. Double quotes do not neutralize command substitution, backticks, embedded quote termination, or all shell metacharacter sequences. For example, a payload resembling the following could terminate the quoted argument and introduce another command if substituted literally: ```text "; id > /tmp/localsend-command-output; # ``` The resulting shell command would contain an attacker-controlled command between the original `echo` and its redirection. Command substitutions such as `$(command)` could also be evaluated while the shell constructs the argument. The vulnerability exists because payload data and shell command syntax share the same parsing context. ### Attack Path 1. The user or another party controlling the chat enters the Send Text flow. 2. The Skill asks for arbitrary text. 3. The attacker supplies text containing shell syntax, quote termination, backticks, or command substitution. 4. The Agent follows the documented template and interpolates the text into the `echo` command. 5. The operating-system shell parses the injected syntax. 6. The injected command executes with the privileges of the Agent process. ### Impact Assessment Successful exploitation can result in arbitrary command execution as the Agent's operating-system account. This can expose or modify any data available to that account, initiate outbound network connections, tamper with the workspace, or ...[truncated 213 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not construct shell source code using the user-provided payload. - Write the text with a safe file API that accepts content as data rather than passing it through a shell. - If a process execution API is used, pass every argument as a separate argument vector element and disable shell evaluation. - If shell use is unavoidable, supply content through a pre-established environment variable or standard input and use a constant command such as `printf '%s' "$TEXT"`; do not interpolate the payload into the command string. - Add tests covering embedded quotes, newlines, `$()`, backticks, semicolons, redirections, and leading hyphens. - Apply restrictive permissions to the generated file and ensure reliable cleanup. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:250
• Finding: Predictable Shared Temporary Files Permit Symlink Attacks and Session Collisions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:250-252` **Additional Locations**: `SKILL.md:330`, `SKILL.md:368-369`, and `SKILL.md:478-479` **Vulnerability Type**: Unsafe temporary-file handling **Risk Level**: Medium ```bash echo "user's text" > /tmp/localsend-text.txt localsend-cli send --to "Fast Potato" /tmp/localsend-text.txt rm /tmp/localsend-text.txt ``` The same pattern is also used for receiver state: ```bash ls -1 /home/rami/.openclaw/workspace/_incoming/ > /tmp/localsend-before.txt ``` ```bash ls -1 /home/rami/.openclaw/workspace/_incoming/ > /tmp/localsend-after.txt diff /tmp/localsend-before.txt /tmp/localsend-after.txt ``` ### Technical Analysis The Skill uses fixed filenames in the globally shared `/tmp` directory. It does not create the files atomically, verify ownership, reject symbolic links, set explicit restrictive permissions, or isolate files by session. On typical Unix-like systems, shell redirection follows symbolic links. A local attacker may therefore pre-create `/tmp/localsend-text.txt`, `/tmp/localsend-before.txt`, or `/tmp/localsend-after.txt` as a symbolic link to another file writable by the Agent. The subsequent redirection can truncate or overwrite that target. Fixed names also cause concurrent Skill sessions to overwrite each other's payload and receive-state snapshots. Depending on the process umask, text contents and incoming filenames may be exposed to other local users. ### Attack Path 1. A local attacker predicts one of the documented `/tmp/localsend-*.txt` paths. 2. The attacker creates a symbolic link at that path pointing to a user-owned file writable by the Agent, or creates a competing regular file. 3. The Skill performs shell redirection to the predictable path. 4. The shell follows the link and truncates or overwrites the linked target, or the competing process alters the temporary data. 5. For the text file, the modified content may be sent to the selected LocalSend peer; for state file ...[truncated 605 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Create a private per-session directory with `mktemp -d` and verify that creation succeeds. - Set a restrictive umask such as `077` before writing sensitive temporary content. - Use unique, atomically created files rather than deterministic names. - Open temporary files with exclusive-creation and no-follow semantics where supported. - Keep send payloads and receiver snapshots in separate per-session files. - Register cleanup logic that runs on success, failure, interruption, and cancellation. - Prefer in-memory state or safe language-level temporary-file APIs over shell redirection. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:324
• Finding: LAN Receiver Automatically Accepts Files Without Sender Authentication or Transfer Approval<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:324-362` **Vulnerability Type**: Unauthenticated automatic file reception **Risk Level**: High ```bash ### Step 1 — Snapshot current files ```bash ls -1 /home/rami/.openclaw/workspace/_incoming/ > /tmp/localsend-before.txt ``` ### Step 2 — Start receiver in background ```bash localsend-cli --alias openclaw-workspace receive --save-dir /home/rami/.openclaw/workspace/_incoming/ -y ``` Run with `run_in_background: true`. Store the task ID. **CRITICAL:** `--alias` MUST come BEFORE `receive` (global flag). ### Step 3 — Confirm ready with buttons **Message:** ``` 📡 Receiver active — "openclaw-workspace" 📁 Saving to: ~/incoming/ ✅ Auto-accept: ON Send files from your device whenever ready. ``` ``` ### Technical Analysis The `-y` option enables automatic acceptance of incoming transfers. The documented receiver does not require a PIN, authenticate a selected sender, maintain an allowlist, request per-transfer approval, or impose file-count and aggregate-size quotas. The receiver is advertised on the local network as `openclaw-workspace` and writes accepted content into the OpenClaw workspace's `_incoming` directory. The protocol reference also states that LocalSend peers use self-signed certificates and clients skip certificate verification (`references/protocol.md:39`), so TLS alone does not establish trusted peer identity. The Skill later proposes contextual actions such as extracting archives, installing APKs, previewing scripts, and deploying website archives. Those actions are not implemented in the audited files, so automatic code execution is not established; however, they increase the likelihood that untrusted received content will be acted upon. ### Attack Path 1. An attacker obtains access to the same reachable local network as the Agent. 2. The attacker discovers the advertised `openclaw-workspace` LocalSend receiver. 3. The attacker initiates one or more transfers containing mal ...[truncated 1081 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Disable automatic acceptance by default and require explicit confirmation for each transfer. - Require a PIN or equivalent pairing mechanism and bind the receiving session to an explicitly selected sender. - Display verified sender details, filenames, sizes, and total transfer size before approval. - Enforce maximum file size, aggregate session size, file count, transfer duration, and available-disk thresholds. - Sanitize filenames, reject absolute paths and traversal components, and ensure files cannot escape the destination directory. - Define safe collision behavior and do not overwrite existing files without explicit confirmation. - Store incoming files in a quarantined directory with restrictive permissions. - Scan received content before offering further actions. - Require a separate, explicit confirmation before extracting, installing, previewing, or deploying content. - Never infer that content is safe solely from its filename extension. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: localsend
description: Send and receive files to/from nearby devices using the LocalSend protocol. Trigger with /localsend to get an interactive Telegram menu with real inline buttons — device discovery, file sending, text sending, and receiving.
metadata:
  openclaw:
    emoji: "📡"
    trigger: "/localsend"
    requires:
      bins:
        - localsend-cli
        - openssl
    install: |
      cp ./localsend-cli ~/.local/bin/localsend-cli && chmod +x ~/.local/bin/localsend-cli
---

# LocalSend

Interactive file transfer between devices on the local network using **real Telegram inline keyboard bu

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
   echo "user's text" > /tmp/localsend-text.txt
   localsend-cli send --to "Fast Potato" /tmp/localsend-text.txt
   rm /tmp/localsend-text.txt
   ```
4. Confirm:

• Confidence: 93% confidence
• Finding: The send-text flow constructs shell commands around user-provided text and performs filesystem operations in /tmp, creating risk of command injection, shell metacharacter abuse, unsafe redirection, or symlink/race issues depending on how the agent materializes the command. Even if the example is illustrative, it normalizes passing untrusted content through the shell instead of using safe file APIs or securely created temporary files.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The receive instructions start a background listener with auto-accept enabled and save incoming files directly to disk, but the skill lacks a prominent upfront warning to the user about this behavior. Users may not realize they are exposing local storage to unsolicited nearby transfers, which increases the chance of receiving malicious or sensitive content without informed consent.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger condition includes broad natural-language phrases about sending or receiving files locally, which may match ordinary conversation and unintentionally invoke the skill. In an agent context, accidental invocation can lead to device discovery, file selection prompts, or receive-mode activation without the user intending to start a network file-transfer workflow.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

]
```

Do NOT run any commands yet. Wait for the button tap.

---

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: Using generic phrases like 'scan', 'discover', or 'find devices' as triggers is ambiguous and likely to overlap with normal user requests unrelated to LocalSend. That can cause unsolicited network discovery activity and selection of nearby devices, which is especially risky in stateful agent workflows.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The receive flow is activated by vague phrases like 'receive', 'start receiving', or 'listen', all of which can appear in unrelated chat contexts. Since receive mode starts a background listener and can auto-accept files, accidental triggering has meaningful security consequences beyond simple UI confusion.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The receive workflow expands a file-transfer skill into post-receipt actions like extract, deploy, install, preview, and open-folder. Those actions materially increase the trust boundary: untrusted files arriving over the network could be turned into executable or high-impact follow-on operations, enabling code execution, unsafe deployment, or opening malicious content with minimal additional user friction.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill description presents LocalSend as a nearby file-transfer utility, but the documented receive behavior includes deployment and file-handling features unrelated to simple transfer. This mismatch can mislead users and downstream agents about the capability scope, causing them to approve or invoke the skill under a lower-risk mental model than is warranted.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Receive Flow

Run HTTPS server on port 53317, handle `/prepare-upload` and `/upload` endpoints. Each device uses a self-signed TLS certificate; clients skip verification.

## Error Codes

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The protocol explicitly states that clients skip TLS certificate verification while using self-signed certificates. This removes authentication from TLS and enables machine-in-the-middle attacks on the local network, allowing an attacker to impersonate a device, intercept transfers, or inject malicious content despite the use of HTTPS.

Static analysis

No suspicious patterns detected.