ClawHub
Back to skill

Security audit

openclaw-nextcloud

Security checks for vulnerabilities and agentic risk

Overview

This is a broad Nextcloud account-management skill, but its credential use, destructive actions, and public-link sharing are disclosed and bounded by user-facing safety guidance and CLI confirmation tokens.

Install only if you are comfortable giving the skill an account-level Nextcloud app password. Use a dedicated app password, prefer a test account first, keep NEXTCLOUD_URL on HTTPS, and be especially careful with delete commands and shares create-link because public links can expose files outside your account.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The supplied code is clearly part of the date-fns library, containing formatter functions, locale data, timezone formatting, and date utility helpers. These are generic support utilities and not the declared core behavior of a Nextcloud management skill. Since the visible code chunk does not implement or demonstrate any of the described Nextcloud capabilities, the description does not accurately represent this chunk's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

Based on the provided snippet, the implementation shown does not match the declared end-user purpose. The code mostly exposes date-fns-style date helpers and includes XML/entity parsing and related utility libraries. Those components could be supporting dependencies for a Nextcloud integration, especially for CalDAV/WebDAV XML handling, but the excerpt itself does not show any actual Nextcloud-specific behavior such as HTTP requests, authentication, CRUD operations on notes/tasks/events/files/contacts, or Deck board management. Because the visible code’s primary behavior is generic parsing and utility functionality rather than the declared Nextcloud management capabilities, this is a description-behavior mismatch for the supplied code chunk.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
- **Node.js 24+** on PATH (`node scripts/nextcloud.js` in Claude Code or a

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
- **Node.js 24+** on PATH (`node scripts/nextcloud.js` in Claude Code or a

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code can create public link shares for arbitrary Nextcloud paths, optionally with edit permission, which can expose sensitive files to anyone possessing the URL. Because that capability is not clearly justified in the stated purpose as written, an agent or user may invoke a high-risk sharing action without understanding that it publishes data beyond the authenticated account.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/nextcloud.js (reported line 16242)May include surrounding context.

js
her.readOnly();
   * // pass view to callbacks — it stays in sync automatically
   * view.matches(expr);       // ✓
   * view.getCurrentTag();     // ✓
   * // view.push(...)         // ✗ method does not exist — caught by TypeScript
   */
  readOnly() {
    return this._view;
  }
};

// node_modules/is-unsafe/src/contexts/html.js
var HTML_PATTERNS = [
  {
    id: "html-script-open",
    description: "<script opening tag",
    pattern: /<script[\s>/]/i
  },
  {
    id: "html-script-close",
    description: "</script closing tag",
    pattern: /<\/script[\s>]/i
  },
  {
    id: "html-javascript-protocol",
    description: "javascript: URI scheme (with optional whitespace/encoding)",
    // Handles j&#x61;vascript:, j\u0061vascript:, and whitespace variants
    pattern: /j[\t\n\r ]*a[\t\n\r ]*v[\t\n\r ]*a[\t\n\r ]*s[\t\n\r ]*c[\t\n\r ]*r[\t\n\r ]*i[\t\n\r ]*p[\t\n\r ]*t[\t\n\r ]*:/i
  },
  {
    id: "html-vbscript-protocol",
    description: "vbscript: URI scheme",
    pattern:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README documents a public-share feature that allows creation and deletion of externally accessible links, including optional edit permissions, but the manifest description only advertises notes, tasks, calendar, files, contacts, and Deck management. This creates a scope mismatch that can mislead reviewers, users, or policy controls into granting a skill broader data-sharing capability than they expect, increasing the risk of accidental external exposure of Nextcloud content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documented shares create-link operation supports creation of public links with --permissions edit, which materially expands the skill from internal file management to external write-capable sharing. If agents or users rely on the manifest's narrower description, they may authorize or invoke the skill without realizing it can expose files or folders to third parties and grant modification access through a public link.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 430)May include surrounding context.

md
2. **If user sets a default:**
   - Remember `default_task_calendar` and/or `default_event_calendar`
   - Use automatically for subsequent operations without asking

3. **If user declines to set a default:**
   - Ask again next time they create a task/event without specifying a calendar

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 454)May include surrounding context.

md
2. **If user sets a default:**
   - Remember `default_task_calendar` and/or `default_event_calendar`
   - Use automatically for subsequent operations without asking

3. **If user declines to set a default:**
   - Ask again next time they create a task/event without specifying a calendar

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 477)May include surrounding context.

md
2. **If user sets a default:**
   - Remember `default_task_calendar` and/or `default_event_calendar`
   - Use automatically for subsequent operations without asking

3. **If user declines to set a default:**
   - Ask again next time they create a task/event without specifying a calendar

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code implements share listing, public-link creation, and share deletion through the Nextcloud OCS sharing API, but the provided description does not mention file sharing at all. This is a security-relevant hidden capability because it can expose private files outside the Nextcloud account boundary via public URLs, changing the data-sharing risk profile of the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The files delete path issues a WebDAV DELETE request that removes remote content, but the surrounding implementation provides no confirmation prompt, print/log disclosure, or inline comment/docstring warning at the point of deletion. For a destructive operation, this file itself does not give the user any immediate warning before the action executes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The calendar delete helper removes an event via DELETE on the CalDAV resource, but there is no prompt, visible warning, or explanatory comment at the operation site. Because deleting a calendar event is destructive, the code should disclose that behavior more explicitly to the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The contacts delete path sends a DELETE request for the selected vCard resource and immediately returns success, but it does not display any warning or request confirmation at the point of execution. This is a destructive operation on user data and lacks in-file disclosure.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
index.js:32

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/nextcloud.js:17724