T09 · Insecure Skill Coding Practices
Error
- Location
scripts/unraid-query.sh:93- Finding
API Key Exposure Through Disabled TLS Verification and Redirect Following
- Content
View full analysis
- Remediation
View remediation
Security audit
Unraid
Security checks for vulnerabilities and agentic risk
Overview
This Unraid monitoring skill is mostly purpose-aligned, but it handles API keys, logs, and persistent agent memory in ways users should review before installing.
Install only if you are comfortable with a local shell skill using an Unraid API key to query infrastructure details and logs. Use a dedicated Viewer key, avoid running the dashboard until its memory-bank and debug-file behavior is acceptable to you, prefer verified HTTPS, and treat any generated reports or log output as sensitive.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T02 · Agent Memory Poisoning
Error
- Location
scripts/dashboard.sh:7- Finding
Untrusted Server Data Is Written Into Persistent Agent Memory
- Content
View full analysis
"$OUTPUT_FILE" ``` Remote response fields are then written without Markdown escaping or content validation: ```bash CPU_MODEL=$(echo "$RESPONSE" | jq -r '.data.info.cpu.model') OS_REL=$(echo "$RESPONSE" | jq -r '.data.info.os.release') UPTIME=$(echo "$RESPONSE" | jq -r '.data.metrics.cpu.percentTotal | tostring + "% CPU Load"') echo "**OS:** $OS_REL | **CPU:** $CPU_MODEL" >> "$OUTPUT_FILE" ``` Additional remotely supplied status data is also persisted: ```bash UNHEALTHY=$(echo "$RESPONSE" | jq -r '.data.docker.containers[] | select(.status | test("unhealthy|restarting"; "i")) | " - ⚠️ \(.names[0]): \(.status)"') if [ -n "$UNHEALTHY" ]; then echo "$UNHEALTHY" >> "$OUTPUT_FILE" fi ``` ### Technical Analysis The dashboard treats data returned by an authenticated remote server as trusted prose and writes it into `$HOME/clawd/memory/bank/unraid-inventory.md`. Fields such as CPU model, OS release, disk names, device names, container names, and status strings can contain Markdown metacharacters, links, HTML, or instruction-like content. Because the destination is explicitly an Agent memory directory, the generated content can survive the current execution and may be consumed as context by later Agent sessions. The script does not distinguish inert monitoring data from trusted instructions, does not escape Markdown, and does not obtain user approval before persistence. The insecure TLS behavior in the query helper further in ...[truncated 1274 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/dashboard.sh:49- Finding
Raw System Logs Are Persisted to Predictable and Potentially Traversable Paths
- Content
View full analysis
"${NAME}_debug.json" ``` The filename component comes from the credential configuration without validation: ```bash jq -c '.servers[]' "$CONFIG_FILE" | while read -r server; do NAME=$(echo "$server" | jq -r '.name') URL=$(echo "$server" | jq -r '.url') KEY=$(echo "$server" | jq -r '.apiKey') process_server "$NAME" "$URL" "$KEY" done ``` ### Technical Analysis Every dashboard request fetches the last 100 lines of `syslog`, even though the rendered dashboard does not use that field. The complete JSON response, including the log content, is then written to `${NAME}_debug.json` in the process's current directory. System logs may contain usernames, source IP addresses, hostnames, filesystem paths, authentication events, internal service details, and accidentally logged credentials or tokens. The output file is created using the process's ordinary umask, without explicit restrictive permissions, redaction, retention limits, or cleanup. In addition, `NAME` comes from `config.json` and is used directly as a path component. A value containing path separators or `..` components can cause the debug response to be written outside the intended directory and can overwrite an existing writable file whose resulting path ends in `_debug.json`. ### Attack Path 1. Sensitive information is recorded in the Unraid syslog. 2. A user runs `dashboard.sh`. 3. The script unnece ...[truncated 1094 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
examples/read-logs.sh:8- Finding
GraphQL Injection Through Unvalidated Log Reader Arguments
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 } (( LINES >= 1 && LINES <= 1000 )) || { echo "Line count is outside the allowed range" >&2 exit 1 } QUERY='query ReadLog($path: String!, $lines: Int!) { logFile(path: $path, lines: $lines) { path totalLines startLine content } }' VARIABLES=$(jq -n --arg path "$LOG_NAME" --argjson lines "$LINES" \ '{path: $path, lines: $lines}') ``` 3. Extend the query helper to accept a variables object and construct the entire JSON body with `jq -n`. 4. Validate `LOG_NAME` against the names returned by the API's `logFiles` query or a documented allowlist. 5. Apply a conservative maximum line count to prevent excessive log disclosure and resource consumption. 6. Continue using a dedicated Viewer API key so successful query manipulation cannot obtain write privileges. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (52)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Listing an
apiKeysendpoint for a monitoring skill is especially sensitive because API key metadata is credential-adjacent and unnecessary for ordinary health/status workflows. Exposure of key inventories can aid privilege escalation, targeting of active credentials, or follow-on social engineering and administrative abuse even if raw secrets are not returned.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The curl invocation uses -k, which disables TLS certificate verification while sending the x-api-key header and GraphQL query to the server. This enables man-in-the-middle interception or redirection attacks, allowing an attacker on the network to steal the API key, observe responses, or tamper with the returned monitoring data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README instructs users to export a live API key in the shell environment and highlights log-reading capability, but it does not warn about handling secrets, redacting output, or the possibility that logs may contain sensitive information. In an infrastructure-monitoring context, this can lead to accidental credential leakage through shell history, process environment exposure, screenshots, or disclosure of secrets contained in logs.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger list is broad and includes open-ended language such as 'And more Unraid-related monitoring tasks,' which can cause the skill to activate for loosely related requests without strong user intent confirmation. In a skill that can query infrastructure state and read logs, overbroad activation increases the chance of exposing sensitive operational data or using stored credentials in contexts the user did not clearly request.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises and demonstrates shell-based execution through helper scripts, but it does not declare any tool scope or allowed-tools restrictions. In an agent environment, this can lead to overly broad shell access being granted implicitly, increasing the chance of unintended command execution, data exposure, or misuse beyond the intended read-only Unraid monitoring workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill prominently encourages reading Unraid logs but does not warn that logs frequently contain sensitive operational details, hostnames, paths, IPs, user activity, and potentially personal or secret material. In a monitoring skill, this omission makes accidental over-collection or disclosure more likely, especially if an agent retrieves and surfaces raw log content to users or other systems.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get CPU, OS, motherboard, and hardware details.
bash curl -s -X POST "https://YOUR-UNRAID/graphql" \ -H "Content-Type: application/json" \ -H "x-api-key: YOUR_API_KEY" \ -d '{
Static analysis
No suspicious patterns detected.