R2 Storage

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:42 AM UTC
• Version: 1.0.0

Overview

This R2 storage skill is mostly purpose-aligned, but it uses unsafe privileged installation and exposes persistent cloud credentials in ways users should review carefully.

Review before installing. Prefer installing rclone through a trusted package manager or verified release instead of running the provided curl | sudo bash command. Use least-privilege, bucket-scoped R2 tokens, check permissions on ~/.config/r2/config.json and ~/.config/rclone/rclone.conf, avoid using show-creds unless necessary, and preview targets carefully before delete, purge, or sync --delete operations.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup.sh:27

Finding

Unverified Remote Installation Script Executed with Root Privileges

Content

View full analysis

/dev/null; then echo "Installing rclone..." curl -fsSL https://rclone.org/install.sh | sudo bash fi ``` The same installation command is declared in the Skill metadata and documentation: ```yaml metadata: {"clawdbot":{"emoji":"☁️","requires":{"bins":["rclone"]},"env":["R2_CONFIG"],"install":[{"id":"rclone","kind":"shell","command":"curl -fsSL https://rclone.org/install.sh | sudo bash","label":"Install rclone"}]}} ``` ```bash curl -fsSL https://rclone.org/install.sh | sudo bash ``` ### Technical Analysis The setup process downloads a mutable shell script from an external URL and immediately executes it through `sudo bash`. The downloaded payload is not pinned to a specific release and is not verified using a cryptographic checksum or signature. HTTPS authenticates the connection under normal conditions, but it does not make the mutable upstream script safe against compromise of the hosting infrastructure, upstream project, DNS/TLS trust chain, or release process. Because the response is piped directly into a privileged interpreter, there is no opportunity to inspect the effective payload before execution. The executable behavior can also change after the Skill has been reviewed. ### Attack Path 1. An attacker compromises the upstream installation script, its delivery infrastructure, or another relevant part of the delivery chain. 2. A user or agent runs `scripts/setup.sh` on a system where `rclone` is not installed, or follows the documented installation command. 3. `curl` retrieves the attacker-controlled shell content. 4. The content is passed directly to `sudo bash`. 5. The payload executes with root privileges and can modify any part of the host. ...[truncated 357 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:56

Finding

R2 Credentials Stored Without Explicitly Restrictive File Permissions

Content

View full analysis

"$CONFIG_FILE" echo "✅ Config saved to $CONFIG_FILE" # Write rclone config mkdir -p ~/.config/rclone cat > ~/.config/rclone/rclone.conf << EOF [${REMOTE_NAME}] type = s3 provider = Cloudflare access_key_id = ${ACCESS_KEY} secret_access_key = ${SECRET_KEY} endpoint = ${ENDPOINT} acl = private no_check_bucket = true EOF ``` ### Technical Analysis The script stores the R2 access key and secret key in plaintext in both `~/.config/r2/config.json` and `~/.config/rclone/rclone.conf`. It does not establish a restrictive `umask`, explicitly create the directories with mode `700`, or set the resulting files to mode `600`. The effective permissions therefore depend on the caller's environment and the permissions of any pre-existing files. Under a permissive umask, sensitive files may be readable by other local users. Redirecting over an existing file also preserves that file's existing permissions, which may already be unsafe. ### Attack Path 1. A user runs `scripts/setup.sh` with a permissive umask, or with pre-existing configuration files that have broad permissions. 2. The script writes plaintext R2 credentials without correcting the resulting file permissions. 3. Another local account or process reads either configuration file. 4. The attacker extracts the access key, secret key, and endpoint. 5. The attacker uses those credentials to perform operations permitted by the associated Cloudflare R2 token. ### Impact Assessment The exposed credentials may permit unauthorized object reading, listing, uploading, modification, or deletion, depending on the Cloudflare token's assigned permissions. The impact covers every bucket and object authorized for that token and can include confidentiality loss, data tampering, an ...[truncated 94 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/show-creds.sh:7

Finding

Credential Display Helper Executes the Environment File as Shell Code

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/show-creds.sh:28

Finding

Complete R2 Secret Key Disclosed Through Standard Output

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is described as R2 storage management, but it also documents credential-display functionality that reads and outputs access keys in plain text. That behavior materially expands the sensitivity of the skill from file transfer to secret disclosure, making it easier for an agent or user to expose reusable cloud credentials.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill metadata instructs the system to fetch a remote install script and pipe it directly into sudo bash. This combines unverified network content with privileged execution, creating a straightforward path to arbitrary code execution and full host compromise if the script source or delivery is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: r2
description: Cloudflare R2 Storage management — setup, upload, download, sync via rclone
metadata: {"clawdbot":{"emoji":"☁️","requires":{"bins":["rclone"]},"env":["R2_CONFIG"],"install":[{"id":"rclone","kind":"shell","command":"curl -fsSL https://rclone.org/install.sh | sudo bash","label":"Install rclone"}]}}
---

# r2 ☁️

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The metadata uses command chaining by piping downloaded content directly into sudo bash, preventing inspection and amplifying the effect of any compromise. This is a classic dangerous pattern because it turns remote text into privileged shell execution in one step.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: r2
description: Cloudflare R2 Storage management — setup, upload, download, sync via rclone
metadata: {"clawdbot":{"emoji":"☁️","requires":{"bins":["rclone"]},"env":["R2_CONFIG"],"install":[{"id":"rclone","kind":"shell","command":"curl -fsSL https://rclone.org/install.sh | sudo bash","label":"Install rclone"}]}}
---

# r2 ☁️

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The documented install command executes a remote script immediately instead of requiring review or integrity verification. Because it also elevates privileges via sudo, exploitation would likely yield complete control of the local machine.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Install

bash

curl -fsSL https://rclone.org/install.sh | sudo bash

Credentials Required

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The install example chains a network fetch into privileged shell execution, which is an unsafe composition of tools rather than merely a convenience shortcut. The skill context makes this more dangerous because installation is likely to be copy-pasted or agent-executed automatically.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Install

bash

curl -fsSL https://rclone.org/install.sh | sudo bash

Credentials Required

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

The skill documents direct deletion primitives for objects and bucket contents with no visible safeguards or parameter validation guidance. In an agent setting, malformed paths, misunderstood prefixes, or overbroad targets could lead to unintended destruction of remote data.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

bash

r2-rm file.txt                           # Delete single file
r2-rm folder/                            # Delete folder contents
r2-purge my-bucket                       # Delete all files in bucket

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script fetches a remote installer over the network and immediately executes it with sudo via a shell pipeline. This is dangerous because any compromise of the download source, TLS interception, DNS hijack, or unexpected upstream change can result in arbitrary root-level code execution on the user's machine.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Fetching and executing an external script in one step is a classic supply-chain risk pattern. In a storage-management skill that handles cloud credentials, compromise of the installer can additionally expose or steal those credentials after installation, making the context more dangerous than a generic setup helper.

Content

Scanner excerpt · scripts/setup.sh (reported line 30)May include surrounding context.

sh

# Check rclone
if ! command -v rclone &> /dev/null; then
    echo "Installing rclone..."
    curl -fsSL https://rclone.org/install.sh | sudo bash
fi

# Get config from arg or interactive

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The pipeline chaining of curl output directly into sudo bash removes any review boundary and combines two dangerous actions: untrusted network retrieval and privileged execution. This chaining makes exploitation easier and faster because a single upstream compromise immediately becomes local root code execution.

Content

Scanner excerpt · scripts/setup.sh (reported line 30)May include surrounding context.

sh

# Check rclone
if ! command -v rclone &> /dev/null; then
    echo "Installing rclone..."
    curl -fsSL https://rclone.org/install.sh | sudo bash
fi

# Get config from arg or interactive

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill exposes shell-based capabilities through install and operational commands but does not declare an explicit tool scope such as permissions or allowed-tools. This increases the chance that an agent can invoke powerful shell actions without clear policy boundaries or user expectations, which is especially risky in a storage-management skill that can modify local files and cloud data.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The metadata includes an install command that runs with sudo, granting root privileges to fetched installer content. In an agent-managed environment, privileged execution substantially raises the blast radius of any mistake or compromise during installation.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: r2
description: Cloudflare R2 Storage management — setup, upload, download, sync via rclone
metadata: {"clawdbot":{"emoji":"☁️","requires":{"bins":["rclone"]},"env":["R2_CONFIG"],"install":[{"id":"rclone","kind":"shell","command":"curl -fsSL https://rclone.org/install.sh | sudo bash","label":"Install rclone"}]}}
---

# r2 ☁️

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The installation instructions tell users to pipe an external script into sudo bash, resulting in immediate root-level code execution. This is dangerous because any compromise of the remote script, network path, or domain would lead to full system compromise.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Install

bash

curl -fsSL https://rclone.org/install.sh | sudo bash

Credentials Required

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

**Get credentials from Cloudflare:**
1. Go to https://dash.cloudflare.com → R2
2. Create API token with Object Read/Write/List permissions
3. Copy Account ID (from R2 dashboard URL)
4. Endpoint format: `https://<account_id>.r2.cloudflarestorage.com`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The sync example using --delete can remove destination files, but the documentation does not clearly warn about that destructive behavior. In cloud storage workflows, direction mistakes are common, so an undocumented mirror-delete option can quickly erase valid data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented delete and purge commands are irreversible but are presented without warnings, confirmation steps, or safeguards. In an agent context, terse examples can be executed with little scrutiny, causing accidental large-scale data loss in the target bucket.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill advertises a credential-display script, including a raw output mode, without warning that it may expose active access keys and secrets. Because these are cloud credentials, disclosure can enable unauthorized bucket access, exfiltration, modification, or deletion.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes the skill as handling setup, upload, download, and sync via rclone, but this script implements deletion and full bucket purging. Destructive removal is a materially different operation from the listed behaviors and is not implied by the manifest wording.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The single-path deletion branch performs rclone delete immediately with no confirmation, dry-run, or validation of the supplied target. In an agentic or automated context, a mistaken path, prompt injection, or unsafe upstream input could cause irreversible deletion of remote data with no user checkpoint.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This line invokes sudo to run an externally fetched script as root. While sudo itself is not always a vulnerability, in this context it materially increases severity because any malicious or tampered installer gains full system privileges instead of user-level access.

Content

Scanner excerpt · scripts/setup.sh (reported line 30)May include surrounding context.

sh

# Check rclone
if ! command -v rclone &> /dev/null; then
    echo "Installing rclone..."
    curl -fsSL https://rclone.org/install.sh | sudo bash
fi

# Get config from arg or interactive

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script writes the provided R2 JSON and the generated rclone configuration, including access_key_id and secret_access_key, to disk in plaintext under the user's home directory without setting restrictive permissions or warning the user. This creates a persistent credential exposure risk if the files are read by other local users, captured by backups, or later exfiltrated by malware.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The script persists sensitive cloud configuration into ~/.config/r2/config.json, creating long-lived local storage of secrets beyond the current session. Session persistence of credentials increases exposure time and makes compromise more likely through local disclosure, backups, or later host compromise.

Content

Scanner excerpt · scripts/setup.sh (reported line 57)May include surrounding context.

sh

fi

# Save config JSON
mkdir -p ~/.config/r2
echo "$CONFIG_JSON" > "$CONFIG_FILE"
echo "✅ Config saved to $CONFIG_FILE"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This script intentionally prints Cloudflare R2 access credentials, including the secret access key, directly to stdout in both human-readable and raw formats. Secrets written to stdout are easily exposed through terminal history capture, shell logging, CI logs, remote session transcripts, or accidental copy/paste, making credential compromise plausible even if the script is meant for convenience.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script passes a user-controlled --delete flag directly to rclone sync, which can remove files from the destination to mirror the source without any interactive confirmation, dry-run, or scope validation. In a storage-management skill, this is especially risky because source/destination mix-ups, malformed paths, or automation mistakes can cause irreversible bulk deletion of local data or remote R2 objects.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.