Security audit

openclaw-nextcloud

Security checks across malware telemetry and agentic risk

Overview

This skill gives an agent broad but clearly disclosed access to a user's Nextcloud account, including public share links, with confirmation requirements for the riskiest actions.

Install only if you are comfortable giving the agent full account-level Nextcloud access. Use a revocable app password, prefer a test account first, confirm public shares carefully, use passwords and expiry dates for shared links, and revoke the app password if anything looks wrong.

SkillSpector

By NVIDIA

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The top-level description omits public-share functionality even though the skill can list, create, and revoke public links, including editable links. That mismatch is dangerous because operators or users may authorize the skill believing it only manages private Nextcloud content, while it can also expose files externally via public URLs.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code implements share-link creation and deletion through the Nextcloud OCS sharing API, but the skill description only advertises Notes, Tasks, Calendar, Files, Contacts, and Deck boards/stacks/cards. This capability expansion matters because it enables public exposure of files and changes the agent’s effective authority beyond what a user may infer from the manifest.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The share creation path can generate public links to files, optionally with edit permissions, without any in-band warning at execution time beyond the generic confirmation gate. In an agent setting, this is sensitive because a user may request file operations without appreciating that the action exposes data to anyone possessing the link.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: index.js:32

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/nextcloud.js:17724