Sabnzbd

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:16 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent SABnzbd management purpose, but its helper script lets a crafted NZB URL run local Python code and it performs destructive SABnzbd actions without confirmation.

Review before installing. Only use this with a trusted local SABnzbd instance and trusted NZB URLs; a crafted URL can execute local Python code through the helper script. Store the API key with owner-only permissions, prefer HTTPS for non-local SABnzbd URLs, and require explicit user confirmation before purge, delete with files, delete-history, or clearing warnings.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sab-api.sh:169

Finding

Arbitrary Python Code Execution Through Crafted NZB URL

Content

View full analysis

"`. 3. `cmd_add` places the value directly inside the Python program passed to `python3 -c`. 4. The crafted value terminates the intended Python string and appends attacker-controlled Python statements. 5. Python executes those statements with the privileges of the account running the Skill. ### Impact Assessment Successful exploitation permits arbitrary command execution and file access with the Agent's privileges. This can include reading the SABnzbd API key and other files accessible to the account, modifying local data, invoking network utilities, or executing additional programs. The vulnerability does not independently elevate privileges beyond the running account, but compromise of an automation Agent account may expose all resources ava ...[truncated 27 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sab-api.sh:26

Finding

Unencoded API Parameters Allow Request Parameter Injection

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:24

Finding

SABnzbd Credential File Is Created Without Restrictive Permissions

Content

View full analysis

~/.clawdbot/credentials/sabnzbd/config.json << 'EOF' { "url": "http://localhost:8080", "apiKey": "your-api-key-here" } EOF ``` ### Technical Analysis Accessing one explicitly configured SABnzbd credential is necessary for the Skill's declared functionality and does not, by itself, exceed minimum privilege. However, the documented setup does not enforce permissions on either the credential directory or `config.json`. The resulting permissions depend on the user's current `umask`. With a permissive configuration, the directory may be searchable and the credential file may be readable by other local users. The script subsequently reads the API key from this path and uses it for all supported SABnzbd operations, including deletion and configuration changes. ### Attack Path 1. A user follows the documented setup commands. 2. The directory and file are created according to the current `umask`, without explicit owner-only modes. 3. On a multi-user host with permissive resulting permissions, another local account reads `config.json`. 4. The account obtains the SABnzbd URL and API key. 5. The attacker uses the key to invoke SABnzbd API operations within the key's authority. ### Impact Assessment Disclosure of the API key can permit viewing download metadata, adding downloads, pausing or resuming jobs, changing job properties, clearing history, and deleting queue entries or associated files where supported. The scope is the configured SABnzbd instance and the privileges assigned to the exposed API key. This does not inherently provide operating-system privilege escalation. ]]>

Remediation

View remediation

"$HOME/.clawdbot/credentials/sabnzbd/config.json" <<'EOF' { "url": "http://localhost:8080", "apiKey": "your-api-key-here" } EOF chmod 600 "$HOME/.clawdbot/credentials/sabnzbd/config.json" ``` The script should also reject unsafe credential-file conditions where practical, including files owned by another account, symbolic links, or group/world-readable modes. Environment-variable support may remain available, but documentation should warn that environment values can also be exposed through process inspection or diagnostics in some environments. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/sab-api.sh:26

Finding

API Key Is Embedded in Request URLs and May Be Sent Over Plaintext HTTP

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill explicitly recommends persistent local storage of a long-lived API credential in a predictable path, which increases the chance of credential reuse, theft, or unintended disclosure over time. In the context of a home automation/agent skill, persistent session material is more dangerous because other tools, plugins, backups, or local compromise could harvest the stored key and then issue authenticated SABnzbd actions.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

2. Go to Config → General → Security
3. Copy your API Key

2. Create Credentials File

bash

mkdir -p ~/.clawdbot/credentials/sabnzbd

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs users to store the SABnzbd API key in a plaintext JSON file under the user's home directory without any warning about file permissions, secret handling, or safer storage options. If that file is readable by other local users, backed up insecurely, or exposed through logs/support bundles, an attacker could use the API key to control SABnzbd and inspect or manipulate download activity.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documents and relies on shell and network capabilities to call a local REST API, but it does not declare any explicit tool scope or permissions boundary. That omission increases the chance an agent can invoke broader-than-necessary capabilities, making misuse or unexpected command execution harder to constrain and audit.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill exposes destructive operations like purge and delete with files, but it provides no warning that these actions are irreversible or should require explicit user confirmation. In an agent setting, this creates a realistic risk of accidental data loss or queue destruction from ambiguous prompts or over-eager automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script implements destructive operations such as delete, purge, and delete-history, including optional file deletion via --files, but provides no confirmation prompt, warning message, or other user disclosure at the point of execution. These actions can remove queued items or history and may delete associated files irreversibly without any explicit caution in the code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The warnings-clear command clears active SABnzbd warnings but does not emit any notice or request confirmation before doing so. Although less severe than file deletion, it still performs a state-changing action that can remove operational context without informing the user.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.