ClawHub
Back to skill

Security audit

Xiaoya Download

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Xiaoya/Alist media search and local WebDAV copy helper, with normal configuration and filesystem-write risks but no evidence of hidden, deceptive, persistent, or exfiltrating behavior.

Install only if you intend to use a Xiaoya/Alist server and are comfortable letting the skill contact that configured host and copy selected files into your configured download directory. Treat search results from untrusted servers cautiously because names are printed to the terminal without control-character sanitization.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/xiaoya_download.py:88
Finding

Terminal Escape-Sequence Injection Through Untrusted Search Results

Content
View full analysis
2d} │ {name_pad:<35s} │ {tags:<20s} │ {sz:<5s} │") ``` ### Technical Analysis Search-result names are extracted from the HTML response returned by the user-configured `XIAOYA_HOST`. These values are treated as trusted display text and printed without removing ANSI escape sequences, C0/C1 control characters, or other terminal control codes. A malicious or compromised Xiaoya/Alist server can place terminal escape sequences inside an anchor's displayed name. When the user invokes the `search` command, `print()` emits those bytes to the active terminal. Depending on terminal capabilities and configuration, escape sequences can alter displayed output, conceal warnings, create deceptive hyperlinks, change terminal state, or manipulate clipboard contents through mechanisms such as OSC 52. The code does not invoke a shell with this data, so the finding does not by itself provide direct operating-system command execution. Exploitation depends on control over, or compromise of, the configured search server or its returned content. ### Attack Path 1. The victim configures `XIA ...[truncated 1450 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
python3 scripts/xiaoya_download.py setup

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
python3 scripts/xiaoya_download.py setup

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md
python3 scripts/xiaoya_download.py setup

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

├── SKILL.md ├── scripts/ │ └── xiaoya_download.py ├── .env # 用户自建（不在发布包中） ├── .env.example └── _meta.json

text

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/xiaoya_download.py (reported line 138)May include surrounding context.

python
├── SKILL.md
├── scripts/
│   └── xiaoya_download.py
├── .env           # 用户自建（不在发布包中）
├── .env.example
└── _meta.json
```

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/xiaoya_download.py (reported line 235)May include surrounding context.

python
├── SKILL.md
├── scripts/
│   └── xiaoya_download.py
├── .env           # 用户自建（不在发布包中）
├── .env.example
└── _meta.json
```

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/xiaoya_download.py (reported line 27)May include surrounding context.

python
def load_env():
    env_file = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), ".env")
    if os.path.isfile(env_file):
        with open(env_file) as f:
            for line in f:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill advertises capabilities that involve environment variables, network access, and shell execution, but it does not declare any explicit tool scope or permission boundaries. This increases the chance that an agent runtime grants overly broad access or invokes the skill without clear user/admin awareness of its operational power, especially since it performs downloads and calls rsync.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The trigger phrases are ordinary conversational requests like searching for a movie, which can easily overlap with normal chat and cause unintended skill activation. Because this skill can search remote content and copy files locally via rsync, accidental invocation could lead to unexpected network activity and filesystem writes.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/xiaoya_download.py (reported line 200)May include surrounding context.

python
dst]

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=7200)
        if result.returncode == 0:
            final = os.path.getsize(dst) if os.path.isfile(dst) else 0
            print(f"\n  ✅ 复制完成: {fmt_size(final)}")

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file’s natural-language description, usage comments, and all user-facing messages are written exclusively in Chinese, which effectively imposes a single language/locale on users. The policy for this audit flags language or locale constraints when they are enforced without an explicit opt-in or alternative.

Content

No source excerpt is available for this finding.