ClawHub
Back to skill

Security audit

FeiNiu NAS Download Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill largely does what it says, but its add-download command can expose NAS control to unsafe remote shell execution if given a crafted magnet link or unsafe credential value.

Review before installing. Use only with a NAS account you trust and restrict, avoid untrusted magnet links, move the qBittorrent password out of the script, and fix shell quoting/form encoding before allowing the add command to run against a real NAS.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill exposes shell-backed operational capability over SSH/qBittorrent but does not declare corresponding permissions, which can cause users or policy layers to underestimate its ability to affect remote systems. In this context, the undeclared capability is meaningful because the skill can list and add remote download tasks, potentially changing NAS state without clear upfront consent boundaries.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The documented purpose understates the real behavior by omitting remote SSH/SCP access and local torrent-file transfer to the NAS, which hides both network reach and file-movement side effects from the user. That mismatch is dangerous because users may invoke the skill expecting a narrow qBittorrent action while it actually performs broader remote system interactions and uploads content.

Missing User Warnings

Low
Confidence
78% confidence
Finding
The documentation omits an explicit warning that adding torrents sends magnet or torrent metadata to the NAS/qBittorrent service and changes the remote download queue. While this is expected functionality, failing to disclose the transmission and state change can lead to unintended privacy exposure or accidental remote actions.

Missing User Warnings

High
Confidence
99% confidence
Finding
The script embeds a qBittorrent password directly in source code, which exposes credentials to anyone who can read the file, shell history, backups, or repository contents. In this script, the password is also interpolated into remote curl commands, increasing the chance of accidental disclosure via process inspection, logs, or debugging.

Static analysis

No suspicious patterns detected.