ClawHub
Back to skill

Security audit

AIOS File Transfer

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate S3 file-transfer skill, but its current implementation can bypass its promised sender workspace isolation and can use S3 credentials against caller-named buckets.

Install only in a controlled AIOS/OpenClaw environment with tightly scoped S3 credentials and trusted per-sender workspaces. Before broad use, fix symlink-aware path containment, reject or canonicalize symlinked sender/upload/generated paths, restrict downloads to approved inbox buckets/prefixes, and avoid runtime bucket creation unless explicitly required and separately authorized.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/transfer_s3.mjs:218
Finding

Symbolic Links Bypass Sender Workspace Isolation

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/transfer_s3.mjs:143
Finding

User-Controlled S3 Bucket Enables Confused-Deputy Access

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (13)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
- 传输操作优先使用内置脚本 `scripts/transfer_s3.mjs`，不要在对话中临时写新的传输脚本。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
- 传输操作优先使用内置脚本 `scripts/transfer_s3.mjs`，不要在对话中临时写新的传输脚本。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
- 传输操作优先使用内置脚本 `scripts/transfer_s3.mjs`，不要在对话中临时写新的传输脚本。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md
- 传输操作优先使用内置脚本 `scripts/transfer_s3.mjs`，不要在对话中临时写新的传输脚本。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md
- 传输操作优先使用内置脚本 `scripts/transfer_s3.mjs`，不要在对话中临时写新的传输脚本。

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The primary safety and operational instructions are written in Chinese only, with no indication that users may choose another language or that the locale restriction is intentional and justified. This can violate a language/locale policy when the skill is used in multilingual environments without explicit opt-in.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill requires access to sensitive S3 credentials and environment variables but does not declare an explicit tool scope or permissions boundary. In an agent environment, that ambiguity can let a broader runtime expose env-backed secrets or capabilities than intended, increasing the chance of unauthorized file access or credential misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description and the entire operational guidance are written as prescriptive instructions in Chinese, and the file does not state that language choice is optional or limited to a specific region for compliance reasons. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is advertised as an S3 file-transfer helper, but the documentation introduces broader business-system operations like create/update/approve/delete flows. This scope expansion is dangerous because it can socially steer an agent into taking actions outside the skill's expected purpose, weakening operator trust and increasing the chance of misuse in a high-privilege deployment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest says this skill should handle file transfers via an AWS S3-compatible SDK and avoid external S3 client programs. Lines L081-L093 add package-management behavior, including checking dependencies and executing npm install, which is not part of the declared transfer behavior and introduces broader environment modification.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
89% confidence
Finding

The dependency uses a caret version range, which allows newer compatible releases to be installed over time. This can introduce supply-chain risk if a future upstream release is compromised or introduces a breaking security regression, though the package itself is a common legitimate dependency and there is no direct evidence of malicious intent here.

Content

Scanner excerpt · package.json (reported line 6)May include surrounding context.

json
"private": true,
  "type": "module",
  "dependencies": {
    "@aws-sdk/client-s3": "^3.1045.0",
    "dayjs": "^1.11.21",
    "pino": "^10.3.1"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
89% confidence
Finding

The use of a caret version for dayjs permits automatic resolution to later minor/patch versions, reducing build reproducibility and increasing exposure to supply-chain compromise. In a file-transfer skill, dependency trust matters because compromised code could affect handling of user files, but this package.json alone does not indicate active exploitation.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json
"type": "module",
  "dependencies": {
    "@aws-sdk/client-s3": "^3.1045.0",
    "dayjs": "^1.11.21",
    "pino": "^10.3.1"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
89% confidence
Finding

The pino dependency is not pinned to an exact version, so future installs may pull different code than originally tested. This is a low-severity supply-chain weakness rather than an application logic flaw, but in an agent skill that processes file transfers and logs operational events, a compromised transitive dependency could still affect confidentiality or integrity.

Content

Scanner excerpt · package.json (reported line 8)May include surrounding context.

json
"dependencies": {
    "@aws-sdk/client-s3": "^3.1045.0",
    "dayjs": "^1.11.21",
    "pino": "^10.3.1"
  }
}

Static analysis

No suspicious patterns detected.