Security audit

fn-fpk

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent fnOS packaging guidance, but it includes unsafe development examples that could lead an agent to generate vulnerable NAS lifecycle scripts or install an unverified tool system-wide.

Review before installing. This is not an exfiltration or backdoor artifact, but users should avoid copying the unsafe shell examples as-is, verify fnpack from an authenticated source before installing it, keep apps running as the package user unless root is strictly required, and validate or parse configuration files instead of sourcing them as shell.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:838
Finding: Arbitrary Shell Command Execution Through Sourced Configuration
Content: View full analysis
Remediation: View remediation
"${TRIM_TEMP_LOGFILE}" exit 1 ;; esac if [ "$configured_port" -lt 1 ] || [ "$configured_port" -gt 65535 ]; then echo "Configured port is outside the valid range" >"${TRIM_TEMP_LOGFILE}" exit 1 fi PORT="$configured_port" fi ``` The parser should be extended carefully for other approved keys rather than using `eval`, `source`, or the dot command. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:652
Finding: Command Injection Through Dynamically Constructed bash -c Command
Content: View full analysis
> ${LOG_FILE} } start_process() { if status; then return 0; fi log_msg "Starting process ..." bash -c "${CMD}" >> ${LOG_FILE} 2>&1 & printf "%s" "$!" > ${PID_FILE} return 0 } ``` ### Technical Analysis The script combines runtime-derived paths into a single command string and submits that string to `bash -c`. This causes Bash to parse the interpolated values as shell program text rather than treating them as opaque data. `DATA_DIR` comes from `TRIM_DATA_SHARE_PATHS`, while `TRIM_APPDEST` is also interpolated without shell-level argument separation. If either value contains spaces, command separators, command substitutions, redirection operators, or other shell metacharacters, those characters can change the command's meaning when `bash -c` evaluates it. Quoting `"${CMD}"` when passing it to `bash -c` preserves the string as one argument, but the receiving shell then deliberately parses the string. It therefore does not prevent injection. Several file variables are also used without quoting, increasing the possibility of word splitting and pathname expansion. ### Attack Path 1. An attacker causes an application-accessible shared directory or another interpolated path to contain shell metacharacters. This requires influence over a path propagated into `TRIM_DATA_SHARE_PATHS` or equivalent control over the runtime value. 2. The lifecycle script assigns that path to `DATA_DIR`. 3. The value is concatenated into `CMD` without shell escaping. 4. Application startup invokes `bash -c "${CMD}"`. 5. Th ...[truncated 1025 chars]
Remediation: View remediation
>"$LOG_FILE" } start_process() { if status; then return 0 fi log_msg "Starting process ..." DATA_DIR="$DATA_DIR" PORT=5001 \ node "${TRIM_APPDEST}/server/server.js" >>"$LOG_FILE" 2>&1 & printf '%s' "$!" >"$PID_FILE" } ``` Additional hardening should include: 1. Quote every path expansion, including log and PID file paths. 2. Validate that `DATA_DIR` is an existing directory. 3. Resolve the path canonically and verify that it is within an fnOS-authorized share. 4. Reject control characters and unexpected path formats. 5. Avoid `eval`, `bash -c`, and any string-to-command conversion for values derived from paths or configuration. 6. Use least-privilege package execution and avoid root mode unless it is strictly required. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:39
Finding: System-Wide Installation of an Unverified Downloaded Executable
Content: View full analysis
Remediation: View remediation
&2 exit 1 fi chmod 0755 fnpack-1.2.3-linux-amd64 sudo install -o root -g root -m 0755 \ fnpack-1.2.3-linux-amd64 /usr/local/bin/fnpack ``` The placeholder digest must be replaced with a value obtained through a separately authenticated official channel. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list is overly broad because it activates on very common terms such as vendor/platform names and generic API references. This can cause the skill to fire in unrelated contexts, increasing the chance that packaging, deployment, permission, or Open API guidance is injected where it was not intended, which is risky in a security-sensitive admin environment.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
安装：

bash
chmod +x fnpack-1.2.3-linux-amd64 sudo mv fnpack-1.2.3-linux-amd64 /usr/local/bin/fnpack fnpack --help

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.
md
ctl_stop = true # 是否显示启动/停止按钮，默认 true checkport = true # 是否启用端口检查，默认 true service_port = 8080 # 应用监听端口（单个端口） disable_authorization_path = false # 是否禁用授权目录功能 # ═══════════════ 用户界面 ═══════════════ desktop_uidir = ui # UI 组件目录（相对应用根目录）

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.
md
ctl_stop = true # 是否显示启动/停止按钮，默认 true checkport = true # 是否启用端口检查，默认 true service_port = 8080 # 应用监听端口（单个端口） disable_authorization_path = false # 是否禁用授权目录功能 # ═══════════════ 用户界面 ═══════════════ desktop_uidir = ui # UI 组件目录（相对应用根目录）

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: SKILL.md:672