Adguard Home

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:59 PM UTC
• Version: 1.2.7

Overview

The skill does what it claims, but it can send AdGuard admin credentials over unencrypted HTTP and has confusing guidance about storing credentials in local files.

Review before installing. Use HTTPS-only AdGuard Home URLs, avoid the documented http:// examples, and do not store administrator passwords in adguard-instances.json unless the file is strictly local and locked down. Install only if you are comfortable granting this skill access to DNS query history, client identifiers, filtering rules, and other AdGuard control-plane data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:60
• Finding: AdGuard Administrator Credentials and Session Cookies May Be Transmitted Over Plaintext HTTP## Vulnerability Details **File Location**: `index.js:60-67`, `index.js:112-164`, `index.js:169-176`, `SKILL.md:59-62`, `SKILL.md:202-204`, `SKILL.md:225-228`, `README.md:43-45`, `README.md:62-65` **Vulnerability Type**: Cleartext transmission of sensitive information **Risk Level**: High The URL validator explicitly permits both HTTP and HTTPS. The HTTP client then selects the unencrypted Node.js `http` transport whenever the configured URL uses the `http:` scheme. Authentication credentials are submitted in the request body, and the resulting session cookie is attached to subsequent requests using the same unencrypted transport. Complete relevant code: ```javascript /** * Validate URL format */ function validateUrl(urlStr) { try { const parsed = new URL(urlStr); return (parsed.protocol === 'http:' || parsed.protocol === 'https:') && parsed.hostname; } catch { return false; } } ``` ```javascript /** * Make HTTP POST request with cookie handling */ function httpRequest(baseUrl, endpoint, method = 'GET', postData = null, cookie = null) { return new Promise((resolve, reject) => { const fullUrl = new URL(endpoint, baseUrl); const protocol = fullUrl.protocol === 'https:' ? https : http; const options = { hostname: fullUrl.hostname, port: fullUrl.port || (fullUrl.protocol === 'https:' ? 443 : 80), path: fullUrl.pathname + fullUrl.search, method: method, headers: { 'Content-Type': 'application/json', 'Accept': 'application/json', } }; if (cookie) { options.headers['Cookie'] = cookie; } if (postData) { options.headers['Content-Length'] = Buffer.byteLength(postData); } const req = protocol.request(options, (res) => { const cookies = res.headers['set-cookie']; let cookieValue = null; if (cookies) { cookieValu ...[truncated 3536 chars]
• Remediation: ## Remediation Suggestions 1. Require HTTPS in the URL validator: ```javascript function validateUrl(urlStr) { try { const parsed = new URL(urlStr); return parsed.protocol === 'https:' && Boolean(parsed.hostname); } catch { return false; } } ``` 2. If plaintext HTTP is necessary for isolated development environments, require an explicit opt-in such as `ADGUARD_ALLOW_INSECURE_HTTP=true`. Reject HTTP by default and display a prominent warning that credentials and cookies will be exposed in transit. 3. Replace every `http://` configuration example in `README.md`, `SKILL.md`, and runtime error messages with an `https://` example. 4. Preserve Node.js certificate verification. Do not set `rejectUnauthorized: false`. Document how users can configure a trusted internal certificate authority for self-hosted AdGuard Home deployments. 5. Recommend a dedicated least-privileged account where supported rather than a general-purpose administrator account. 6. Update `SECURITY_AUDIT.md` so it does not characterize the current implementation as providing secure HTTP communication while plaintext HTTP remains accepted. 7. Add automated tests confirming that HTTP URLs are rejected by default and that credentials and cookies are only transmitted over TLS.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Attack Vector:**
- Malicious instance configuration with crafted `url`, `username`, or `password`
- Example: `password: "admin' && rm -rf / #"`
- Shell command injection via unescaped parameters

**Fix:**

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Attack Vector:**
- Malicious instance configuration with crafted `url`, `username`, or `password`
- Example: `password: "admin' && rm -rf / #"`
- Shell command injection via unescaped parameters

**Fix:**

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High

• Category: Tool Misuse

Content

**Attack Vector:**
- Malicious instance configuration with crafted `url`, `username`, or `password`
- Example: `password: "admin' && rm -rf / #"`
- Shell command injection via unescaped parameters

**Fix:**

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match

Content

verity:** CRITICAL  
**CVSS Score:** 9.8 (Critical)

**Issue:**
```javascript
// VULNERABLE CODE (v1.1.1)
execSync(`curl -s -X POST ${url}/control/login -H "Content-Type: application/json" -d '{"name":"${username}","password":"${password}"}' -c ${cookieFile}`);
```

**Attack Vector:**
- Malicious instance configuration with crafted `url`, `username`, or `password`
- Example: `password: "admin' && rm -rf / #"`
- Shell command injection via unescaped parameters

**Fix:**
```javascript
// SECURE CODE (v1.2.0)
async function authenticate(baseUrl, username, password) {
  const response = await httpRequest(
    baseUrl, 
    '/control/login', 
    'POST', 
    JSON.stringify({ name: username, password: password })
  );
  return response.cookie;
}
```

**Mitigation:**
- ✅ Removed all `execSync` and `child_process` usage
- ✅ Implemented native `http`/`https` module for API calls
- ✅ No shell command execution

---

### 2. Missing Input Validation (CWE-20) - **FIXED** ✅

**Severity:** H

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Ae1

High

• Category: analysis-evasion

Content

- **Entrypoint | 入口文件:** `index.js`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 1. Command Injection Prevention

**Test:** `node index.js stats "invalid;rm -rf /"`

**Result:** ✅ **BLOCKED**
```

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 1. Command Injection Prevention

**Test:** `node index.js stats "invalid;rm -rf /"`

**Result:** ✅ **BLOCKED**
```

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High

• Category: Tool Misuse

Content

### 1. Command Injection Prevention

**Test:** `node index.js stats "invalid;rm -rf /"`

**Result:** ✅ **BLOCKED**
```

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Issue:**
```javascript
// VULNERABLE CODE (v1.1.1)
execSync(`curl -s -X POST ${url}/control/login -H "Content-Type: application/json" -d '{"name":"${username}","password":"${password}"}' -c ${cookieFile}`);
```

**Attack Vector:**

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

3. **Restrict config file permissions:**
   ```bash
   chmod 600 ~/.openclaw/workspace/adguard-instances.json
   ls -la ~/.openclaw/workspace/adguard-instances.json
   # Should show: -rw------- (only owner can read/write)
   ```

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

3. **Secure the config file | 保护配置文件:**
   ```bash
   chmod 600 ~/.openclaw/workspace/adguard-instances.json
   ```

4. **Test the skill | 测试技能:**

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

3. **Secure the config file | 保护配置文件:**
   ```bash
   chmod 600 ~/.openclaw/workspace/adguard-instances.json
   ```

4. **Test the skill | 测试技能:**

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

3. **Secure the config file | 保护配置文件:**
   ```bash
   chmod 600 ~/.openclaw/workspace/adguard-instances.json
   ```

4. **Test the skill | 测试技能:**

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly surfaces recent DNS queries, blocked domains, and client IP activity, which may reveal sensitive browsing patterns, internal hostnames, and device identifiers. Without a privacy warning or access-control guidance, operators may expose highly sensitive monitoring data to users who should not see it.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The document claims file-based credential loading was removed, yet it still instructs users to create `adguard-instances.json` containing an admin username and password. This inconsistency can mislead users into storing sensitive credentials on disk despite the stated security posture, increasing risk of accidental exposure through backups, workspace sharing, or version control.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Recommendations
1. ✅ **Deploy to production** - Safe for use
2. ⚠️ **Restrict config file permissions** - `chmod 600`
3. 📝 **Update ClawHub** - Publish v1.2.0
4. 🔍 **Monitor for updates** - Security patches as needed

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Recommendations
1. ✅ **Deploy to production** - Safe for use
2. ⚠️ **Restrict config file permissions** - `chmod 600`
3. 📝 **Update ClawHub** - Publish v1.2.0
4. 🔍 **Monitor for updates** - Security patches as needed

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The URL validation explicitly allows both http and https, and the tool then sends AdGuard credentials to /control/login and later retrieves query logs, client details, and DNS configuration over whatever scheme is configured. If an instance is configured with plain HTTP, credentials and sensitive operational data can be exposed to interception or manipulation by anyone on the network path.

Excessive Permissions

Low

• Category: Privilege Escalation

Content

cat ~/.openclaw/workspace/adguard-instances.json
   ```

3. **Restrict config file permissions:**
   ```bash
   chmod 600 ~/.openclaw/workspace/adguard-instances.json
   ls -la ~/.openclaw/workspace/adguard-instances.json

• Confidence: 80% confidence
• Finding: Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Intent-Code Divergence

Low

• Confidence: 94% confidence
• Finding: The FAQ/version history asserts that file-config references were removed from the documentation, but the same document still includes multiple file-based configuration examples. While this is primarily a documentation integrity issue, it can cause users to trust inaccurate security claims and follow weaker credential-handling practices.

Excessive Permissions

Low

• Category: Privilege Escalation

Content

**Issue:** Credentials stored in plaintext in `adguard-instances.json`

**Current Permissions:**
```bash
-rw-rw-r-- 1 foxleoly foxleoly 268 Feb 24 00:39 adguard-instances.json
```

• Confidence: 98% confidence
• Finding: This report explicitly documents that credentials are stored in plaintext in `adguard-instances.json` and shows the file as world-readable by others on the system (`-rw-rw-r--`). On a multi-user host, local users could read the file and recover AdGuard administrative credentials, enabling unauthorized access to the DNS management interface.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: Line L62 identifies the checker as "Programming Master (编程大师)", introducing a specific language/locale element in natural-language content without any user opt-in or documented justification. This can conflict with language/locale policy requirements that avoid forcing or implicitly imposing a language choice.

Static analysis

No suspicious patterns detected.