ClawHub
Back to skill

Security audit

1panel-install

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says, but it can make root-level server changes and includes a test script that can disrupt an existing 1Panel installation.

Install only on a server you control and intentionally want to modify. Review the remote package source, require explicit confirmation before running install.sh, protect any returned username/password from chat logs or screenshots, change the panel password immediately, restrict network access to the panel, and do not run test.sh on a production host.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill clearly performs shell-based installation actions, downloads packages, extracts archives, runs an install script, and manages services, yet it declares no explicit permissions. This mismatch weakens platform safety controls and can cause high-risk actions to run without clear user-visible authorization boundaries, especially because the workflow includes remote code execution as root.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The test script modifies a live system by moving /opt/1panel and /usr/bin/1pctl, and stopping/disabling services to simulate an uninstalled state. Even though framed as testing, this exceeds passive verification and can disrupt production availability or leave the system in a partially broken state if the script aborts mid-run.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The restoration path deletes live files under /opt/1panel, /usr/bin/1pctl, and systemd service units before copying back backups. This is destructive system state manipulation beyond the advertised install/check behavior, and failure during restore can permanently break the installed panel or service registration.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The README states that the assistant will return the panel's access address, username, and password after installation, but it does not prominently warn that these are highly sensitive secrets that should be minimized, masked, and never exposed in insecure contexts. In an agent skill, automatic disclosure of freshly generated admin credentials increases the chance of credential leakage into chat logs, terminals, screenshots, or shared session history.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The activation scope is broad enough to trigger on generic requests about installing, deploying, or configuring 1Panel, and the skill is designed to automatically proceed with installation. This increases the chance of unintended execution of a privileged install flow from ambiguous user intent, particularly in conversational contexts where the user may only be asking for guidance or status.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The examples reinforce an open-ended trigger model and show the assistant 'executing installation' directly, without clarifying when it should refrain from acting. In a skill that can download and run a remote installer with elevated privileges, missing boundaries materially increases the risk of accidental system modification.

Missing User Warnings

High
Confidence
99% confidence
Finding
The script performs destructive actions before any explicit user confirmation: it moves installed files and stops/disables services immediately when 1Panel is present. Because the script requires root and is presented as a test helper, users may run it expecting inspection, not immediate service disruption.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The restore step removes files and service definitions with rm -rf/rm -f, but the preceding prompt only asks whether to restore the backup and does not clearly disclose that existing files will be deleted first. This can cause accidental data loss or service breakage if the current installation differs from the backed-up state.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
### 2. 检查 root 权限

此脚本需要 root 权限安装系统服务。如果当前用户不是 root，提示用户使用 sudo 执行。

## 安装流程
Confidence
94% confidence
Finding
sudo

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.