FeiNiu NAS Download Manager

• Analyzed: Mar 31, 2026, 3:26 PM
• Findings: 1
• Version: 1.0.0
• Hash: 5f85f383b93d26d5dba4101fe37b30519594d9008dec7027b31b3cb2e896ccd6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a command injection vulnerability in `nas-download.sh`. The script passes the user-provided magnet link or file path (`$2`) directly into an SSH command string without adequate sanitization, which could allow an attacker to execute arbitrary commands on the target NAS (e.g., by appending shell metacharacters to a magnet link). While the script includes a basic regex check for magnet links, it is insufficient to prevent exploitation. No clear evidence of malicious intent or data exfiltration was found.