ClawHub
Back to skill

Security audit

ClawRoam

Security checks for vulnerabilities and agentic risk

Overview

ClawRoam is a real sync tool, but its implementation uses broad local access and unsafe setup/authentication patterns that need review before installation.

Install only after reviewing or fixing the broad OpenClaw mirroring, cloud authentication/key-enrollment flow, rclone installer behavior, SSH host-key policy, and package-install eval path. Use a test machine and non-sensitive vault/provider accounts until those issues are addressed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
src/sync-engine.sh:153
Finding

Undeclared synchronization of the entire OpenClaw directory

Content
View full analysis
/dev/null | head -1 | awk '{print $2}' | tr -d '"') if [[ -z "$openclaw_dir" || ! -d "$openclaw_dir" ]]; then return 0 fi # Mirror entire openclaw directory into vault (excluding .git and runtime files) mkdir -p "$VAULT_DIR/openclaw" rsync -a --delete \ --exclude '.git/' \ --exclude 'node_modules/' \ --exclude '*.swp' \ --exclude '*.swo' \ "$openclaw_dir/" "$VAULT_DIR/openclaw/" 2>/dev/null || true } ``` ### Technical Analysis The declared synchronization policy in `SKILL.md` distinguishes between files that are always synchronized, files that must remain local, and sensitive configuration or credentials that require explicit opt-in. In particular, it states that `SOUL.md` and `IDENTITY.md` must not be synchronized without permission and that credentials are separately encrypted. The implementation does not enforce that policy. It recursively mirrors the complete detected OpenClaw directory into `~/.clawroam/openclaw`, excluding only Git metadata, `node_modules`, and editor swap files. The resulting directory is inside the vault and is therefore included in provider pushes unless a provider-specific exclusion happens to block it. No exclusion is present for credentials, tokens, channel authentication data, model configuration, runtime state, SOUL files, or IDENTITY files inside the mirrored tree. This exceeds the minimum filesystem access required for the declared functionality. Cloud-side encryption does not resolve the consent problem because the Skill still collects and transmits files outside its documented synchronization scope. ### Attack Path 1. A user initializes ClawRoam on a machine containing ...[truncated 1073 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
cloud-api-worker/src/index.ts:248
Finding

Unauthenticated key registration and weak dashboard authentication enable cloud-vault takeover

Content
View full analysis
{ const { email, vault_id } = await c.req.json<{ email: string; vault_id: string }>(); if (!email || !vault_id) return c.json({ error: "email and vault_id required" }, 400); const vault = await c.env.DB.prepare("SELECT id, email FROM vaults WHERE id = ? AND email = ?").bind(vault_id, email).first<{ id: string; email: string }>(); if (!vault) return c.json({ error: "Invalid credentials" }, 401); const now = Math.floor(Date.now() / 1000); const token = await signJWT({ vault_id, email, iat: now, exp: now + 86400 }, c.env.JWT_SECRET); return c.json({ token, vault_id, email, expires_in: 86400 }); }); app.post("/v1/signup", async (c) => { const body = await c.req.json<{ email: string; public_key: string; hostname?: string; os?: string; instance_id?: string }>(); if (!body.email) return c.json({ error: "email required" }, 400); const db = c.env.DB; const existing = await db.prepare("SELECT id FROM vaults WHERE email = ?").bind(body.email).first<{ id: string }>(); if (existing) { if (body.public_key) { const fp = await computeFingerprintAsync(body.public_key); const dup = await db.prepare("SELECT id FROM vault_keys WHERE vault_id = ? AND fingerprint = ? AND revoked_at IS NULL").bind(existing.id, fp).first(); if (!dup) await db.prepare("INSERT INTO vault_keys (id, vault_id, public_key, fingerprint, hostname, instance_id) VALUES (?, ?, ?, ?, ?, ?)").bind(crypto.randomUUID(), existing.id, body.public_key, fp, body.hostname || "", body.instance_id || "").run(); } return c.json({ vault_id: existing.id, status: "existing" }); } const vaultId = crypto.randomUUID(); await db.prepare("INSERT INTO vaults (id, email) VALUES (?, ?)").bind(vaultId, body.email ...[truncated 2937 chars]
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
providers/s3.sh:8
Finding

Provider setup executes mutable remote installation scripts with elevated privileges

Content
View full analysis
/dev/null; then log "rclone not found. Installing..." case "$(uname -s)" in Darwin) brew install rclone 2>/dev/null || curl https://rclone.org/install.sh | bash ;; Linux) curl https://rclone.org/install.sh | sudo bash ;; esac fi } ``` Equivalent installation behavior is present in the Dropbox, Google Drive, and WebDAV providers: ```bash Darwin) brew install rclone 2>/dev/null || curl https://rclone.org/install.sh | bash ;; Linux) curl https://rclone.org/install.sh | sudo bash ;; ``` ### Technical Analysis When `rclone` is absent, the affected provider scripts retrieve the current contents of `https://rclone.org/install.sh` and stream the response directly into a shell. On Linux, the shell runs under `sudo`. The downloaded payload is not version-pinned, displayed for review, saved atomically, checksum-verified, or signature-verified. HTTPS protects the connection in normal circumstances but does not protect against a compromised upstream server, compromised release infrastructure, malicious changes to the mutable installer, or a trust failure involving DNS or certificate authorities. This behavior creates an execution channel whose effective payload may change after the Skill package has been audited. ### Attack Path 1. A user selects S3, Dropbox, Google Drive, or WebDAV on a machine without `rclone`. 2. Provider setup invokes `ensure_rclone`. 3. The script downloads the current remote installer. 4. The response body is immediately interpreted by Bash. 5. On Linux, the downloaded code executes with root privileges through `sudo`. 6. A compromised or malicious response can install binaries, alte ...[truncated 621 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
track-packages.sh:272
Finding

Shell command injection through synchronized package names

Content
View full analysis
/dev/null | grep '^\s*- name:' | awk -F'"' '{print $2}') for pkg in $mgr_pkgs; do if echo "$missing" | grep -qx "$pkg"; then mgr_missing="$mgr_missing $pkg" fi done if [[ -n "$mgr_missing" ]]; then local cmd="" case "$mgr" in brew) cmd="brew install$mgr_missing" ;; apt) cmd="sudo apt install -y$mgr_missing" ;; npm_global) cmd="npm install -g$mgr_missing" ;; pip_global) cmd="pip3 install$mgr_missing" ;; snap) cmd="sudo snap install$mgr_missing" ;; flatpak) cmd="flatpak install$mgr_missing" ;; esac if [[ -n "$cmd" ]]; then echo "Install command ($mgr):" echo " $cmd" echo "" read -rp "Run this command? [y/N]: " yn if [[ "$yn" =~ ^[Yy] ]]; then eval "$cmd" || log "Some packages failed to install" fi fi fi done ``` ### Technical Analysis Package names are parsed from the synchronized vault requirements file and concatenated into a shell command string. The string is then executed through `eval`, causing shell metacharacters, substitutions, redirections, and separators embedded in a package value to be interpreted as shell syntax. The confirmation prompt does not sanitize the command. A malicious package entry can be made visually misleading or can append additional shell operations after a plausible package name. The threat boundary is significant because the manifest may originate from remote storage, another profile, or a cloud vault compromised ...[truncated 1451 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
providers/ftp.sh:42
Finding

SSH host verification is disabled for SFTP and Git synchronization

Content
View full analysis
/dev/null || true log "Pushing via $proto to $host (profile: $profile_name)..." rsync -avz -e "ssh -i $key -p $port -o StrictHostKeyChecking=no" \ $EXCLUDE "$VAULT_DIR/" "$user@$host:$target_path/" 2>&1 | tail -3 log "Push complete (profile: $profile_name)" } cmd_pull() { _load; local key="$VAULT_DIR/keys/clawroam_ed25519" local d="$VAULT_DIR/.pull-ftp"; mkdir -p "$d" local profile_name; profile_name=$(get_profile_name) local source_path="$rpath/profiles/$profile_name" # Fallback to root if profiles/ doesn't exist if ! ssh -i "$key" -p "$port" -o StrictHostKeyChecking=no "$user@$host" "ls '$rpath/profiles'" &>/dev/null; then source_path="$rpath" log "No profiles found, falling back to root..." fi log "Pulling via $proto from $host (profile: $profile_name)..." rsync -avz -e "ssh -i $key -p $port -o StrictHostKeyChecking=no" \ --exclude local/ "$user@$host:$source_path/" "$d/" 2>&1 | tail -3 ``` The Git provider applies the same unsafe policy: ```bash _git() { GIT_SSH_COMMAND="ssh -i $VAULT_DIR/keys/clawroam_ed25519 -o StrictHostKeyChecking=no" git -C "$REPO_DIR" "$@"; } ``` ### Technical Analysis `StrictHostKeyChecking=no` prevents SSH from reliably enforcing the expected identity of the remote server. Public-key client authentication proves the client's identity to the server; it does not protect the client unless the server host key is also verified. A network-positioned attacker or malicious DNS endpoint may impers ...[truncated 1666 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (138)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill promises encrypted, user-chosen provider-based syncing, but the finding indicates behavior such as automatic software installation and credential collection that is not transparently disclosed. In a vault/identity-sync context, hidden installer behavior or unsupported-provider fallbacks are dangerous because users may expose sensitive data or modify their system under false assumptions about storage, provider choice, and encryption.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill promises encrypted, user-chosen provider-based syncing, but the finding indicates behavior such as automatic software installation and credential collection that is not transparently disclosed. In a vault/identity-sync context, hidden installer behavior or unsupported-provider fallbacks are dangerous because users may expose sensitive data or modify their system under false assumptions about storage, provider choice, and encryption.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill promises encrypted, user-chosen provider-based syncing, but the finding indicates behavior such as automatic software installation and credential collection that is not transparently disclosed. In a vault/identity-sync context, hidden installer behavior or unsupported-provider fallbacks are dangerous because users may expose sensitive data or modify their system under false assumptions about storage, provider choice, and encryption.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill promises encrypted, user-chosen provider-based syncing, but the finding indicates behavior such as automatic software installation and credential collection that is not transparently disclosed. In a vault/identity-sync context, hidden installer behavior or unsupported-provider fallbacks are dangerous because users may expose sensitive data or modify their system under false assumptions about storage, provider choice, and encryption.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.2 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High
Category
Supply Chain
Confidence
97% confidence
Finding

The project directly depends on hono 4.12.2, and the listed advisories include cookie handling and routing flaws that can affect HTTP response construction and request path handling. In a cloud API worker that likely handles sync, backup, restore, and identity-vault traffic, framework-level HTTP flaws are especially relevant because they may enable header injection, cookie abuse, or authorization/path-routing mistakes.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: sharp==0.34.5 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High
Category
Supply Chain
Confidence
90% confidence
Finding

sharp 0.34.5 is present as a transitive devDependency through miniflare, and the advisories indicate inherited native-library issues in libvips/libheif. This is a real supply-chain risk, though its practical exposure is lower here because it appears confined to local development tooling rather than the deployed worker runtime.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==7.18.2 — 16 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +13 more

High
Category
Supply Chain
Confidence
95% confidence
Finding

undici 7.18.2 is included via miniflare and carries multiple HTTP parsing and smuggling-related advisories. Even as a devDependency, vulnerabilities in an HTTP client/server stack used by local worker simulation can expose developers or CI environments to request smuggling, response poisoning, or header injection when interacting with untrusted services.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
93% confidence
Finding

ws 8.18.0 is reported vulnerable to memory disclosure and memory exhaustion DoS. Because it is pulled in through development tooling, the main risk is to developer or CI systems running local simulation services rather than the production Cloudflare Worker itself, but it remains a true vulnerable dependency.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.2 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High
Category
Supply Chain
Confidence
97% confidence
Finding

The project is reported as resolving to hono 4.12.2, a version with multiple known advisories including cookie handling and routing issues. In a cloud API worker that likely processes sync, backup, authentication, or vault-related traffic, weaknesses in request routing or cookie generation can directly affect confidentiality and session integrity.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The dashboard auth endpoint issues a bearer token when a caller supplies only an email and vault_id pair that already exists in the database. That is not authentication; it is account lookup, so anyone who can guess or know those values can mint a valid JWT and then access or modify vault contents through all JWT-authorized endpoints. In the context of an identity vault and cloud backup service, this directly enables unauthorized access to highly sensitive synchronized data.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.9 — 3 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode); CVE-2026-29087 (@hono/node-server has authorization bypass for protected static paths via encode)

High
Category
Supply Chain
Confidence
97% confidence
Finding

The lockfile pins @hono/node-server to 1.19.9, and the cited advisories describe path traversal and authorization-bypass issues in static file serving. In a cloud sync/backup service that may expose downloadable content or admin assets, a vulnerable HTTP adapter can let attackers bypass protections or access unintended files if the affected serve-static functionality is used.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · docs/plans/2026-02-23-file-sync-rules.md (reported line 108)May include surrounding context.

Step 4: Test with real JWT (get token first)

bash
TOKEN=$(curl -s -X POST https://clawroam-api.ovisoftblue.workers.dev/v1/dashboard/auth \
  -H "Content-Type: application/json" \
  -d '{"vault_id":"cccd796a-d618-43c7-9009-6c39ea796e83","email":"ovisoftblue@yahoo.com"}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · docs/plans/2026-02-23-file-sync-rules.md (reported line 171)May include surrounding context.

Step 4: Test with real JWT (get token first)

bash
TOKEN=$(curl -s -X POST https://clawroam-api.ovisoftblue.workers.dev/v1/dashboard/auth \
  -H "Content-Type: application/json" \
  -d '{"vault_id":"cccd796a-d618-43c7-9009-6c39ea796e83","email":"ovisoftblue@yahoo.com"}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · docs/plans/2026-02-23-file-sync-rules.md (reported line 517)May include surrounding context.

Step 4: Test with real JWT (get token first)

bash
TOKEN=$(curl -s -X POST https://clawroam-api.ovisoftblue.workers.dev/v1/dashboard/auth \
  -H "Content-Type: application/json" \
  -d '{"vault_id":"cccd796a-d618-43c7-9009-6c39ea796e83","email":"ovisoftblue@yahoo.com"}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The example explicitly references config/secrets.yaml, normalizing handling of secret-bearing files via a remote sync-rule API. Even path-only disclosure can identify where credentials are stored, and in this product context that is sensitive metadata tied to a specific vault and profile.

Content

Scanner excerpt · docs/plans/2026-02-23-file-sync-rules.md (reported line 183)May include surrounding context.

md
curl -s -X PUT "$BASE/vaults/$VAULT/profiles/192/sync-rules" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"excluded":["knowledge/private-notes.md","config/secrets.yaml"]}'
# Expected: {"status":"ok","excluded_count":2}

# Read back

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

Reading back the exclusion list echoes the sensitive filename config/secrets.yaml, confirming remote storage and retrieval of metadata about secret locations. That makes the issue more dangerous because it demonstrates persistence of sensitive path data on the service.

Content

Scanner excerpt · docs/plans/2026-02-23-file-sync-rules.md (reported line 189)May include surrounding context.

md
# Read back
curl -s "$BASE/vaults/$VAULT/profiles/192/sync-rules" \
  -H "Authorization: Bearer $TOKEN"
# Expected: {"excluded":["config/secrets.yaml","knowledge/private-notes.md"]}

# Clear
curl -s -X PUT "$BASE/vaults/$VAULT/profiles/192/sync-rules" \

Self-Modification

High
Category
Rogue Agent
Confidence
96% confidence
Finding

The plan instructs updating the installed skill on another machine via rsync, which is a remote self-modification step. In an agent-skill setting, propagating changed code to another host increases the chance of unauthorized persistence or lateral spread if the plan or implementation is compromised.

Content

Scanner excerpt · docs/plans/2026-02-23-file-sync-rules.md (reported line 567)May include surrounding context.

npx wrangler deploy

text

**Step 2: Update skill on jasper**

```bash
rsync -av --delete \

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · docs/plans/2026-02-23-file-sync-rules.md (reported line 463)May include surrounding context.

md
ts=$(date +%s)
  local sig
  sig=$(sign_request "sync-rules:${vault_id}:${profile_name}:${ts}" 2>/dev/null || echo "unsigned")
  $CURL -sf \
    -H "X-ClawRoam-Signature: $sig" \
    -H "X-ClawRoam-Timestamp: $ts" \
    "$API_BASE/vaults/$vault_id/profiles/$profile_name/sync-rules" 2>/dev/null \

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · providers/cloud.sh (reported line 52)May include surrounding context.

sh
ts=$(date +%s)
  local sig
  sig=$(sign_request "sync-rules:${vault_id}:${profile_name}:${ts}" 2>/dev/null || echo "unsigned")
  $CURL -sf \
    -H "X-ClawRoam-Signature: $sig" \
    -H "X-ClawRoam-Timestamp: $ts" \
    "$API_BASE/vaults/$vault_id/profiles/$profile_name/sync-rules" 2>/dev/null \

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The pull flow copies remote files directly into the local vault and configured openclaw directory without prompting, diffing, backup creation, integrity validation of file contents beyond transport, or conflict handling. If the remote account, API, or server-side stored content is compromised, this can overwrite trusted local configuration, manifests, project knowledge, and package-related files, leading to data loss or potentially unsafe downstream behavior.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

Fetching an external script and executing it directly with bash bypasses review, pinning, and integrity verification. In a portable vault skill that may be used across machines, this creates a strong supply-chain risk and gives any compromise of the delivery path arbitrary code execution on every host where setup runs.

Content

Scanner excerpt · providers/dropbox.sh (reported line 12)May include surrounding context.

sh
if ! command -v rclone &>/dev/null; then
    log "rclone not found. Installing..."
    case "$(uname -s)" in
      Darwin) brew install rclone 2>/dev/null || curl https://rclone.org/install.sh | bash ;;
      Linux)  curl https://rclone.org/install.sh | sudo bash ;;
    esac
  fi

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script downloads an installer over the network and pipes it directly into bash, including a sudo path on Linux, with no integrity verification or confirmation. If the remote server, network path, or installer content is compromised, this results in immediate arbitrary code execution and potentially full system compromise as root.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

This is the same external-script-fetching pattern but with sudo, which raises the consequence from user-level code execution to root-level compromise. Any attacker controlling the fetched script or able to tamper with transport can obtain complete control of the system.

Content

Scanner excerpt · providers/dropbox.sh (reported line 13)May include surrounding context.

sh
log "rclone not found. Installing..."
    case "$(uname -s)" in
      Darwin) brew install rclone 2>/dev/null || curl https://rclone.org/install.sh | bash ;;
      Linux)  curl https://rclone.org/install.sh | sudo bash ;;
    esac
  fi
}

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The shell pipeline directly chains network data into a privileged interpreter, leaving no inspection point and magnifying any upstream compromise into immediate root execution. This pattern is especially dangerous in an automation-oriented skill because it normalizes opaque privileged actions during setup.

Content

Scanner excerpt · providers/dropbox.sh (reported line 13)May include surrounding context.

sh
log "rclone not found. Installing..."
    case "$(uname -s)" in
      Darwin) brew install rclone 2>/dev/null || curl https://rclone.org/install.sh | bash ;;
      Linux)  curl https://rclone.org/install.sh | sudo bash ;;
    esac
  fi
}

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script sets StrictHostKeyChecking=no for ssh and rsync, which disables server identity verification and allows man-in-the-middle interception or redirection to an attacker-controlled host. In this skill's context, the tool syncs identity, memory, and package data across machines, so accepting any host key can expose sensitive vault contents and permit malicious remote state injection.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.insecure_tls_verification, suspicious.obfuscated_code

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
cloud-api/src/db.ts:8

Potential obfuscated payload detected.

Warn
Code
suspicious.obfuscated_code
Location
src/keypair.sh:55