Security audit

AList CLI (Cloud Storage CLI for AList)

Security checks across malware telemetry and agentic risk

Overview

The skill is a plausible AList file-management CLI, but it includes overbroad admin API references, privileged setup instructions, and plaintext credential persistence guidance that need manual review.

Install only after reviewing the setup steps. Prefer a virtual environment or direct script invocation, do not use sudo setup unless you intentionally want host-level changes, and do not save AList passwords in shell startup files. Use a least-privilege AList account limited to the paths you want the agent to manage, require explicit confirmation before rm or mv, and treat the bundled OpenAPI reference as overbroad admin documentation rather than a file-only interface.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (24)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The onboarding instructs the agent to install dependencies system-wide, including a sudo-based fallback with --break-system-packages. That expands the skill from AList file operations into host modification and privileged package management, increasing the blast radius if followed on a shared or sensitive system.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The document directs creation of a symlink in /usr/local/bin using sudo, which is a privileged filesystem modification unrelated to the core file-management task. This grants the skill an unnecessary persistence and command-exposure mechanism on the local machine.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The guide recommends writing ALIST_URL, username, and password into shell startup files, causing persistent storage of live credentials in plaintext. In the context of an agent skill, this is especially risky because it turns temporary task credentials into durable secrets exposed to local users, backups, logs, and future shell sessions.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The OpenAPI file exposes a very broad administrative surface including user, role, storage, driver, settings, token, and task administration, far beyond the skill's declared purpose of file management. In an agent context, this creates a dangerous authority mismatch: a user invoking an apparently narrow file-management tool could unintentionally grant the agent powerful account and platform-control capabilities.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: User-administration endpoints allow listing, creating, updating, deleting users, and cancelling 2FA, which is unrelated to normal file management. If an agent can access these operations, prompt injection or simple user confusion could lead to account takeover, privilege escalation, or disabling protections for other users.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Storage and driver administration endpoints permit creating, modifying, enabling, disabling, and deleting storage backends and inspecting driver templates with sensitive configuration fields. In practice, this could let an agent rewire data sources, mount attacker-controlled backends, expose secrets, or disrupt service availability.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Settings and token administration endpoints expose high-risk controls such as listing private settings, resetting permanent tokens, and setting external downloader credentials. In an agent environment, these endpoints can directly leak secrets or allow the agent to rotate credentials and seize durable access to the instance.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Authentication and registration endpoints exceed a narrow file-management skill and expand the available attack surface to account lifecycle operations. While login may be operationally necessary for the backend, exposing register and multiple auth-management routes to the agent increases the chance of misuse, credential handling mistakes, or unauthorized account creation.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Role and permission-management endpoints allow creating, updating, and deleting authorization models and permission scopes. For an agent advertised as a file-management CLI, this is highly dangerous because it can be used to escalate privileges, weaken access controls, or grant persistent overbroad access.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The README advertises very broad natural-language triggers such as uploading files, listing directories, searching, and sharing files. In an agent skill context, these examples can cause the skill to activate on ordinary user requests and perform sensitive remote file operations without a clearly scoped confirmation boundary, increasing the chance of unintended data access or modification.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The README highlights destructive capabilities such as delete and move but provides no warning about the risk of permanent data loss or accidental modification of remote storage. In a file-management skill intended for agent use, omission of safety guidance makes accidental destructive actions more likely, especially when triggered from conversational requests.

Missing User Warnings

Low

Confidence: 73% confidence
Finding: The README states that authentication tokens are automatically managed and refreshed but does not explain how credentials are stored, protected, or rotated. For a skill that handles cloud storage access, this can lead to unsafe deployment practices, token leakage, or overtrust in background credential handling.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger phrases are broad enough that an agent may invoke this skill for generic file-management requests without clear user intent to interact with an AList server. Because the skill can authenticate with stored credentials and perform destructive operations like rm and mv over the network, accidental invocation could expose or modify remote data.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The onboarding includes privileged package installation and privileged symlink creation without a prominent upfront warning that these steps modify the host system. This can mislead an agent into making unnecessary system changes under elevated privileges for a skill that should primarily perform remote file operations.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The instructions present credential persistence to shell startup files without a clear warning about plaintext storage, long-term exposure, or profile-sourcing effects. Because the skill handles authentication to a remote file server, persistent credential leakage could directly enable unauthorized access to stored files.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The rm command performs immediate deletion of remote content with no confirmation prompt, dry-run mode, or safeguard against accidental invocation. In an agent skill context, this is more dangerous because an LLM or automation may issue destructive commands based on ambiguous instructions, causing irreversible data loss.

Ssd 3

High

Confidence: 97% confidence
Finding: The examples for admin settings explicitly show retrieval of private values such as permanent tokens and service secrets. In an agent setting, example-rich schemas can prime tool use and normalize secret-returning operations, increasing the chance that sensitive values are surfaced in model context, logs, or user-visible output.

Ssd 3

High

Confidence: 99% confidence
Finding: The settings example includes a permanent token value, demonstrating that the API can return long-lived credentials. If exposed through an agent, that token could be copied from conversation context or logs and reused for persistent unauthorized access.

Ssd 3

High

Confidence: 99% confidence
Finding: The example qBittorrent URL embeds credentials directly in the URL, which is a classic secret-exposure pattern. In an agent environment, such URLs are likely to be logged, echoed, or reused unsafely, leaking credentials to users, telemetry, or downstream tools.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: pip3 install requests 2>/dev/null && echo "OK" # 尝试 3: sudo pip（PEP 668 限制时） sudo pip3 install --break-system-packages requests 2>/dev/null && echo "OK" # 尝试 4: venv（隔离环境，不会污染系统） SKILL_DIR="<skill_dir>"
Confidence: 93% confidence
Finding: The command sudo pip3 install --break-system-packages requests performs privileged package installation and explicitly bypasses system package protections. In an agent skill context, this is dangerous because it authorizes elevated host changes well beyond the stated purpose of interacting with an AList server.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: chmod +x <skill_dir>/scripts/alist_cli.py # 创建 symlink 到 PATH 目录 sudo ln -sf <skill_dir>/scripts/alist_cli.py /usr/local/bin/alist-cli # 验证 alist-cli --help
Confidence: 92% confidence
Finding: The sudo ln -sf command writes into /usr/local/bin, a privileged location on many systems, creating a persistent executable entry point. This unnecessarily broadens the skill's capabilities and may overwrite or mask existing commands depending on environment configuration.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests
Confidence: 93% confidence
Finding: The dependency is unpinned, so installs may resolve to different versions over time, including versions with breaking changes or newly introduced vulnerabilities. In an agent-facing file management CLI that performs upload/download and likely handles credentials, uncontrolled dependency drift increases supply-chain risk and can unexpectedly expose the skill to insecure library behavior.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 96% confidence
Finding: Declaring requests without a version constraint allows installation of versions affected by multiple published CVEs, including credential leakage and other security flaws. This is especially risky in an AList file-management skill because it likely makes authenticated HTTP requests and may process attacker-controlled URLs, making credential exposure or unsafe request handling materially more dangerous in context.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Content: ```bash alist-cli ls / alist-cli ls /private alist-cli ls /public ```
Confidence: 88% confidence
Finding: The YARA hit is not evidence of malware here, but it correctly surfaces a persistence-like pattern: appending environment exports, including a plaintext password, to ~/.bashrc. In this skill context that behavior is dangerous because it creates durable credential exposure and automatic reuse in future sessions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: references/openapi.json:1085