T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:23- Finding
Mutable Remote Executable Is Downloaded and Trusted Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Localsend
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local file-transfer helper, but it installs unpinned external code and can auto-accept nearby network files into the workspace, so it needs review before use.
Only install this after pinning and verifying the CLI source, changing receive mode to require explicit approval for each transfer, using safe temporary-file handling for text payloads, and treating received files as untrusted before opening, extracting, installing, or deploying them.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:245- Finding
Arbitrary Text Payload Is Interpolated Into a Shell Command
- Content
View full analysis
/tmp/localsend-text.txt localsend-cli send --to "Fast Potato" /tmp/localsend-text.txt rm /tmp/localsend-text.txt ``` ``` ### Technical Analysis The workflow instructs the Agent to insert arbitrary user-provided text into a double-quoted shell command. Double quotes do not neutralize command substitution, backticks, embedded quote termination, or all shell metacharacter sequences. For example, a payload resembling the following could terminate the quoted argument and introduce another command if substituted literally: ```text "; id > /tmp/localsend-command-output; # ``` The resulting shell command would contain an attacker-controlled command between the original `echo` and its redirection. Command substitutions such as `$(command)` could also be evaluated while the shell constructs the argument. The vulnerability exists because payload data and shell command syntax share the same parsing context. ### Attack Path 1. The user or another party controlling the chat enters the Send Text flow. 2. The Skill asks for arbitrary text. 3. The attacker supplies text containing shell syntax, quote termination, backticks, or command substitution. 4. The Agent follows the documented template and interpolates the text into the `echo` command. 5. The operating-system shell parses the injected syntax. 6. The injected command executes with the privileges of the Agent process. ### Impact Assessment Successful exploitation can result in arbitrary command execution as the Agent's operating-system account. This can expose or modify any data available to that account, initiate outbound network connections, tamper with the workspace, or ...[truncated 213 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:250- Finding
Predictable Shared Temporary Files Permit Symlink Attacks and Session Collisions
- Content
View full analysis
/tmp/localsend-text.txt localsend-cli send --to "Fast Potato" /tmp/localsend-text.txt rm /tmp/localsend-text.txt ``` The same pattern is also used for receiver state: ```bash ls -1 /home/rami/.openclaw/workspace/_incoming/ > /tmp/localsend-before.txt ``` ```bash ls -1 /home/rami/.openclaw/workspace/_incoming/ > /tmp/localsend-after.txt diff /tmp/localsend-before.txt /tmp/localsend-after.txt ``` ### Technical Analysis The Skill uses fixed filenames in the globally shared `/tmp` directory. It does not create the files atomically, verify ownership, reject symbolic links, set explicit restrictive permissions, or isolate files by session. On typical Unix-like systems, shell redirection follows symbolic links. A local attacker may therefore pre-create `/tmp/localsend-text.txt`, `/tmp/localsend-before.txt`, or `/tmp/localsend-after.txt` as a symbolic link to another file writable by the Agent. The subsequent redirection can truncate or overwrite that target. Fixed names also cause concurrent Skill sessions to overwrite each other's payload and receive-state snapshots. Depending on the process umask, text contents and incoming filenames may be exposed to other local users. ### Attack Path 1. A local attacker predicts one of the documented `/tmp/localsend-*.txt` paths. 2. The attacker creates a symbolic link at that path pointing to a user-owned file writable by the Agent, or creates a competing regular file. 3. The Skill performs shell redirection to the predictable path. 4. The shell follows the link and truncates or overwrites the linked target, or the competing process alters the temporary data. 5. For the text file, the modified content may be sent to the selected LocalSend peer; for state file ...[truncated 605 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:324- Finding
LAN Receiver Automatically Accepts Files Without Sender Authentication or Transfer Approval
- Content
View full analysis
/tmp/localsend-before.txt ``` ### Step 2 — Start receiver in background ```bash localsend-cli --alias openclaw-workspace receive --save-dir /home/rami/.openclaw/workspace/_incoming/ -y ``` Run with `run_in_background: true`. Store the task ID. **CRITICAL:** `--alias` MUST come BEFORE `receive` (global flag). ### Step 3 — Confirm ready with buttons **Message:** ``` 📡 Receiver active — "openclaw-workspace" 📁 Saving to: ~/incoming/ ✅ Auto-accept: ON Send files from your device whenever ready. ``` ``` ### Technical Analysis The `-y` option enables automatic acceptance of incoming transfers. The documented receiver does not require a PIN, authenticate a selected sender, maintain an allowlist, request per-transfer approval, or impose file-count and aggregate-size quotas. The receiver is advertised on the local network as `openclaw-workspace` and writes accepted content into the OpenClaw workspace's `_incoming` directory. The protocol reference also states that LocalSend peers use self-signed certificates and clients skip certificate verification (`references/protocol.md:39`), so TLS alone does not establish trusted peer identity. The Skill later proposes contextual actions such as extracting archives, installing APKs, previewing scripts, and deploying website archives. Those actions are not implemented in the audited files, so automatic code execution is not established; however, they increase the likelihood that untrusted received content will be acted upon. ### Attack Path 1. An attacker obtains access to the same reachable local network as the Agent. 2. The attacker discovers the advertised `openclaw-workspace` LocalSend receiver. 3. The attacker initiates one or more transfers containing mal ...[truncated 1081 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: localsend description: Send and receive files to/from nearby devices using the LocalSend protocol. Trigger with /localsend to get an interactive Telegram menu with real inline buttons — device discovery, file sending, text sending, and receiving. metadata: openclaw: emoji: "📡" trigger: "/localsend" requires: bins: - localsend-cli - openssl install: | cp ./localsend-cli ~/.local/bin/localsend-cli && chmod +x ~/.local/bin/localsend-cli --- # LocalSend Interactive file transfer between devices on the local network using **real Telegram inline keyboard bu
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 93% confidence
- Finding
The send-text flow constructs shell commands around user-provided text and performs filesystem operations in /tmp, creating risk of command injection, shell metacharacter abuse, unsafe redirection, or symlink/race issues depending on how the agent materializes the command. Even if the example is illustrative, it normalizes passing untrusted content through the shell instead of using safe file APIs or securely created temporary files.
- Content
bash echo "user's text" > /tmp/localsend-text.txt localsend-cli send --to "Fast Potato" /tmp/localsend-text.txt rm /tmp/localsend-text.txt- Confirm:
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The receive instructions start a background listener with auto-accept enabled and save incoming files directly to disk, but the skill lacks a prominent upfront warning to the user about this behavior. Users may not realize they are exposing local storage to unsolicited nearby transfers, which increases the chance of receiving malicious or sensitive content without informed consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger condition includes broad natural-language phrases about sending or receiving files locally, which may match ordinary conversation and unintentionally invoke the skill. In an agent context, accidental invocation can lead to device discovery, file selection prompts, or receive-mode activation without the user intending to start a network file-transfer workflow.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
]
text Do NOT run any commands yet. Wait for the button tap. ---
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Using generic phrases like 'scan', 'discover', or 'find devices' as triggers is ambiguous and likely to overlap with normal user requests unrelated to LocalSend. That can cause unsolicited network discovery activity and selection of nearby devices, which is especially risky in stateful agent workflows.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The receive flow is activated by vague phrases like 'receive', 'start receiving', or 'listen', all of which can appear in unrelated chat contexts. Since receive mode starts a background listener and can auto-accept files, accidental triggering has meaningful security consequences beyond simple UI confusion.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The receive workflow expands a file-transfer skill into post-receipt actions like extract, deploy, install, preview, and open-folder. Those actions materially increase the trust boundary: untrusted files arriving over the network could be turned into executable or high-impact follow-on operations, enabling code execution, unsafe deployment, or opening malicious content with minimal additional user friction.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description presents LocalSend as a nearby file-transfer utility, but the documented receive behavior includes deployment and file-handling features unrelated to simple transfer. This mismatch can mislead users and downstream agents about the capability scope, causing them to approve or invoke the skill under a lower-risk mental model than is warranted.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Receive Flow Run HTTPS server on port 53317, handle `/prepare-upload` and `/upload` endpoints. Each device uses a self-signed TLS certificate; clients skip verification. ## Error Codes
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The protocol explicitly states that clients skip TLS certificate verification while using self-signed certificates. This removes authentication from TLS and enables machine-in-the-middle attacks on the local network, allowing an attacker to impersonate a device, intercept transfers, or inject malicious content despite the use of HTTPS.
- Content
Static analysis
No suspicious patterns detected.