ClawHub
Back to skill

Security audit

NetDisk Search

Security checks for vulnerabilities and agentic risk

Overview

This is a plausible net-disk search skill, but its Docker deployment and network defaults need human review before installation.

Review and harden the deployment before installing: pin the Docker image and skill source to reviewed digests or commits, bind the service to 127.0.0.1 by default, enable strong authentication before any remote exposure, avoid --network host, remove eval from deploy.sh, and do not pass or print passwords in shell commands.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/deploy.sh:27
Finding

Arbitrary Shell Command Injection Through Deployment Arguments

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/deploy.sh:76
Finding

Mutable and Unverified Remote Code and Container Retrieval

Content
View full analysis
Remediation
View remediation
" ``` - Pin Skill installation to a reviewed Git commit rather than `main`. - Publish SHA-256 checksums for release archives and verify them before extraction. - Prefer signed release artifacts and verify signatures using a documented trusted key. - Enable container signature or provenance verification, such as Sigstore/Cosign, where supported. - Avoid silently upgrading production deployments through `latest`. - Document a controlled update process that reviews source changes, verifies provenance, updates the pinned digest, and supports rollback. - Scan downloaded images and archives before deployment. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/deploy.sh:8
Finding

Unauthenticated Search Service Exposed on All Host Interfaces by Default

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/deploy.sh:27
Finding

Authentication Password Exposed Through Process Arguments and Terminal Output

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (36)

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The documentation instructs running the container with --network host, which removes Docker's network isolation and gives the container direct access to the host network namespace. If the container image or application is compromised, this makes lateral movement, local service access, traffic interception, and exposure of host-only services substantially easier.

Content

Scanner excerpt · README.md (reported line 196)May include surrounding context.

-p 8888:8888
-e PROXY="socks5://127.0.0.1:1080"
--restart unless-stopped
--network host
ghcr.io/fish2018/pansou:latest

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 218)May include surrounding context.

curl -L https://github.com/godzx001-dot/NDS/archive/main.zip -o /tmp/nds.zip unzip /tmp/nds.zip -d ~/.hermes/skills/ mv ~/.hermes/skills/NDS-main ~/.hermes/skills/netdisk-search rm /tmp/nds.zip

text

OpenClaw 用户安装到 `~/.openclaw/skills/netdisk-search`。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
bash scripts/deploy.sh

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md
bash scripts/deploy.sh

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md
bash scripts/deploy.sh

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md
bash scripts/deploy.sh

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md
bash scripts/deploy.sh

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 91)May include surrounding context.

ghcr.io/fish2018/pansou:latest

验证是否启动成功

curl http://localhost:8888/api/health

text

成功响应：

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill defines broad natural-language triggers such as searching for movies, resources, links, and deployment actions, which overlap with ordinary user requests. In an agent setting, this can cause unintended invocation of the skill and automatic execution of search or deployment-related actions without sufficiently explicit user intent, increasing the chance of misuse or policy bypass.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 402)May include surrounding context.

bash
# 基础搜索
curl -X POST http://localhost:8888/api/search \
  -H "Content-Type: application/json" \
  -d '{"kw": "速度与激情"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The example posts plaintext credentials to an unauthenticated HTTP endpoint (/api/auth/login) on localhost. While local transport reduces exposure, this still encourages insecure credential handling and could leak secrets through shell history, process inspection, local proxies, or if the service is rebound or exposed beyond loopback.

Content

Scanner excerpt · README.md (reported line 616)May include surrounding context.

docker exec netdisk-search env | grep AUTH

重新获取 Token

curl -X POST http://localhost:8888/api/auth/login
-H "Content-Type: application/json"
-d '{"username":"admin","password":"your-password"}'

text

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · README.md (reported line 702)May include surrounding context.

md
payload["cloud_types"] = cloud_types
    
    data = json.dumps(payload).encode()
    req = urllib.request.Request(
        "http://localhost:8888/api/search",
        data=data,
        headers={"Content-Type": "application/json"}

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases include very broad everyday language such as '搜资源', '找资源', '搜电影', and '找电影', which can cause accidental invocation during ordinary conversation. In an agent setting, unintended activation can lead to unsolicited network searches, data transmission, and execution of supporting scripts without clear user intent. The skill context makes this more dangerous because the triggered actions call external APIs and may deploy or query network services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The description presents search and link-check features without warning that user queries, URLs, and possibly credentials or extraction codes may be sent to a locally hosted or third-party-backed API service. This omission can mislead users about privacy and data handling, especially since the service aggregates results from plugins and external sources. In this skill context, the risk is elevated because the core function is network search and link validation, both of which inherently transmit user-supplied data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

bash
# 下载并解压
curl -L https://github.com/godzx001-dot/NDS/archive/main.zip -o nds.zip
unzip nds.zip -d ~/.hermes/skills/
mv ~/.hermes/skills/NDS-main ~/.hermes/skills/netdisk-search
rm nds.zip

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs users to deploy a container from ghcr.io/fish2018/pansou:latest, which is an unpinned mutable image tag. A mutable tag can change over time and may pull a different or compromised image than the one originally reviewed, creating a supply-chain risk with code execution on the host via Docker. The skill context increases danger because it explicitly asks the agent/user to run this deployment command as part of normal setup.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The natural-language invocation guidance encourages broad free-form requests like asking the agent to '帮我搜一下' or '帮我部署一下', without requiring a clear command syntax or confirmation step. This ambiguity increases the chance that the agent interprets ordinary user speech as authorization to search third-party services or run deployment scripts. Because the skill can perform both remote queries and local deployment actions, accidental invocation has meaningful security and privacy consequences.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

bash
# 基础搜索
curl -X POST http://localhost:8888/api/search \
  -H "Content-Type: application/json" \
  -d '{"kw": "速度与激情"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation exposes a concrete default administrative username and password (admin / admin123) for obtaining a JWT. If these defaults are present in deployed environments, an attacker could authenticate as an administrator and fully compromise the local service; the risk is increased because the docs present the credentials without any warning to change or disable them.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 63)May include surrounding context.

示例:

bash
curl -X POST http://localhost:8888/api/search \
  -H "Content-Type: application/json" \
  -d '{
    "kw": "速度与激情",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 137)May include surrounding context.

示例:

bash
curl -X POST http://localhost:8888/api/check/links \
  -H "Content-Type: application/json" \
  -d '{
    "items": [

Static analysis

No suspicious patterns detected.