Security audit

AList CLI (Cloud Storage CLI for AList)

Security checks for vulnerabilities and agentic risk

Overview

This AList file-management skill mostly matches its stated purpose, but its setup and login guidance create avoidable risks around credentials, shell execution, and privileged host changes.

Review this skill carefully before installing. Use only a trusted HTTPS AList server, avoid eval/source of login output, do not store ALIST_PASSWORD in shell startup files, prefer a virtual environment or direct script path, and require explicit confirmation before delete or move operations.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/alist_cli.py:115
Finding: Shell Command Injection Through Documented eval-Based Login Workflow
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/alist_cli.py:101
Finding: Credentials and Bearer Tokens Can Be Transmitted Over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/ONBOARDING.md:33
Finding: Unpinned Dependency Installation Into Privileged System Environments
Content: View full analysis
/dev/null && echo "OK" # 尝试 2: pip pip3 install requests 2>/dev/null && echo "OK" # 尝试 3: sudo pip（PEP 668 限制时） sudo pip3 install --break-system-packages requests 2>/dev/null && echo "OK" # 尝试 4: venv（隔离环境，不会污染系统） SKILL_DIR="" cd "$SKILL_DIR" && uv venv .venv && .venv/bin/pip install requests ``` ### Technical Analysis The `requests` dependency has no exact version constraint or integrity hash. Each installation can therefore resolve to different package and transitive-dependency versions. The onboarding workflow prioritizes installation into the system interpreter and recommends `sudo pip3 install --break-system-packages` as a fallback. This bypasses operating-system package-management protections and may execute package installation logic with root privileges. The package name itself is legitimate and no malicious dependency is proven to be present in the audited artifact. The vulnerability is the unsafe supply-chain and privilege model: mutable artifacts are retrieved at installation time without integrity verification, potentially using elevated privileges or a user-configured package index. ### Attack Path 1. The Agent detects that `requests` is unavailable and follows the mandatory onboarding instructions. 2. `pip` or `uv` resolves the unpinned package and transitive dependencies using the active package-index configuration. 3. The package index, network resolution path, account configuration, or a future package release supplies a compromised artifact. 4. The installer processes the unverified package. 5. If the documented sudo fallback is used, package ins ...[truncated 525 chars]
Remediation: View remediation
/dev/null`, because doing so hides index, certificate, and package-integrity failures that users need to assess. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/ONBOARDING.md:57
Finding: Onboarding Forcibly Replaces a Global Command Using Elevated Privileges
Content: View full analysis
/scripts/alist_cli.py # 创建 symlink 到 PATH 目录 sudo ln -sf /scripts/alist_cli.py /usr/local/bin/alist-cli # 验证 alist-cli --help ``` A non-privileged alternative is mentioned only afterward: ```bash alias alist-cli="python3 /scripts/alist_cli.py" ``` ### Technical Analysis The CLI can be run directly with Python and does not require root privileges or a global installation. Nevertheless, onboarding instructs the Agent to use `sudo ln -sf` to create a link in `/usr/local/bin`. The `-f` option forcibly replaces an existing path named `/usr/local/bin/alist-cli` without checking ownership, origin, or whether another application already provides that command. The resulting global command points into the Skill directory rather than to an immutable or root-controlled installed copy. This exceeds the minimum privileges required by the declared functionality and creates a system-wide command-resolution change. ### Attack Path 1. The user or Agent follows the onboarding process with sudo access. 2. The forced symbolic-link operation replaces any existing `/usr/local/bin/alist-cli`. 3. Shells resolving `alist-cli` through `/usr/local/bin` execute the script from the Skill directory. 4. If that target script is later modified, replaced, or updated with malicious content, subsequent invocations through the global command execute the changed code. 5. If an administrator later invokes the globally linked command from an elevated context, the modified target can execute with elevated privileges. ### Impact Assessment The immediate operation can overwrite an existing globally installed command and change behavior for users whose PATH includes `/usr/local/bin`. It also creates a trusted-look ...[truncated 349 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (39)

Tainted flow: 'username' from os.environ.get (line 390, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/alist_cli.py (reported line 102)May include surrounding context.
python
return False def _do_login(self, username, password, silent=False): data = requests.post( f"{self.url}/api/auth/login", json={"username": username, "password": password}, ).json()

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about AList file management for AI agents, including operational file actions and authentication handling. The supplied code does not perform any AList interaction or file management operations like upload/download/list/mkdir/rm/mv/search/url. Instead, it implements a project metadata/version consistency check across SKILL.md, plugin.json files, and git tags. This is a materially different primary purpose and unrelated to the declared triggers.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.
md
- `references/openapi.json` - AList API specification

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The onboarding recommends appending ALIST_URL, ALIST_USERNAME, and ALIST_PASSWORD to ~/.bashrc, persisting credentials in plaintext on the host. This creates long-lived exposure of sensitive secrets to other local processes, future shells, backups, and accidental disclosure.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 96% confidence
Finding: Appending plaintext AList credentials to ~/.bashrc matches a persistence-style pattern because it installs secrets into a long-lived shell startup file. While not obviously malicious malware here, in skill context it is still dangerous because it creates durable secret exposure and conditions agents to make sensitive host modifications.
Content: Scanner excerpt · references/ONBOARDING.md (reported line 108)May include surrounding context.
名 | 用户提供 | | ALIST_PASSWORD | 登录密码 | 用户提供 |

重要：如果环境变量未设置，必须询问用户提供这三个值。不要猜测或使用默认值。

设置方式（选一种）：

bash
# 临时（当前 session） export ALIST_URL="https://..." export ALIST_USERNAME="xxx" export ALIST_PASSWORD="xxx" # 持久化（写入 shell 配置） echo 'export ALIST_URL="https://..."' >> ~/.bashrc echo 'export ALIST_USERNAME="xxx"' >> ~/.bashrc echo 'export ALIST_PASSWORD="xxx"' >> ~/.bashrc source ~/.bashrc

Windows PowerShell 当前会话：

powershell
$env:ALIST_URL = "https://..." $env:ALIST_USERNAME = "<username>" $env:ALIST_PASSWORD = "<password>"

密码和 token 不得写入仓库。Agent 未获用户明确同意时，不把密码追加到 shell profile 或其他持久化配置。

Step 5: 验证连接

bash
alist-cli whoami

期望输出：

text
用户: <username> ID: <id> 根目�

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The OpenAPI surface includes extensive admin functionality well beyond the advertised file-management CLI scope, including user management, storage administration, settings, token reset, and task controls. In an agent skill context, this creates a dangerous capability mismatch: an AI or downstream integrator may invoke privileged endpoints that enable full server takeover or destructive administration when only basic file operations were expected.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: User and role administration endpoints are unrelated to normal file management and allow creation, modification, deletion of users, role changes, and 2FA cancellation. If an agent or compromised workflow can reach these operations, an attacker could escalate privileges, create backdoor accounts, or disable protections on existing accounts.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Storage-backend administration endpoints allow creating, updating, enabling, disabling, and deleting storage mounts, which exceeds the expected behavior of a file-management CLI. Abuse of these endpoints could redirect data flows, mount attacker-controlled backends, expose additional secrets, or disrupt access to legitimate storage.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Settings and token-management endpoints include access to private settings and token reset functionality, which can directly expose secrets or mint new long-lived credentials. In an agent-integrated skill, that effectively enables full persistence and control over the AList instance, far beyond ordinary file operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README states that login and token refresh are automatic but does not warn that the skill will handle credentials and authentication tokens for the user's storage account. This matters because agent users may not realize sensitive secrets are being processed and persisted, which increases the risk of over-trusting the skill or misconfiguring the environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises delete and move capabilities for remote files but does not warn that these operations affect live data in remote storage and may be irreversible. In an AI-agent workflow, users may treat examples as low-risk assistant actions, so omission of destructive-operation warnings raises the chance of accidental data loss.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example trigger phrases are broad enough to activate the skill for generic requests like uploading, browsing, searching, or sharing files without clearly signaling that the action targets AList remote storage. In an agent setting, this can cause unintended invocation of a skill that performs authenticated remote file operations, increasing the risk of accidental data exposure or destructive actions in the wrong context.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 63)May include surrounding context.
md
alist-cli/ ├── .claude-plugin/plugin.json ├── .codex-plugin/plugin.json ├── skills/alist-cli/SKILL.md ├── SKILL.md ├── scripts/ │ └── alist_cli.py

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares no explicit tool scope or permissions even though it clearly relies on environment variables and network access for authentication and file operations. In an agent setting, missing scope boundaries can cause the runtime to grant broader-than-expected capabilities, increasing the chance of secret exposure or unintended remote actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest trigger text lists broad phrases like "file management" and "upload/download," which overlap with common everyday requests and do not clearly distinguish when this AList-specific skill should or should not activate. The description also lacks negative examples or constraints that would narrow invocation to AList-related contexts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documented rm <path> command enables destructive deletion, but the skill text does not require confirmation, dry-run behavior, or a prominent warning before use. In an agent workflow, ambiguous user requests or path mistakes could lead to irreversible data loss on remote storage.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document instructs the AI agent in Chinese and does not offer a language choice or state that Chinese is required for a justified region-specific reason. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The onboarding instructs agents to install dependencies system-wide, including using pip against the host interpreter and even sudo with --break-system-packages. That exceeds the skill’s file-management purpose and can alter or destabilize the host environment, especially when executed automatically by an agent.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 94% confidence
Finding: This instruction explicitly uses sudo to install Python packages on the host, which elevates privileges for a non-essential setup action. In an automated agent workflow, encouraging root execution increases the risk of unintended system modification or abuse if the package source or command path is compromised.
Content: Scanner excerpt · references/ONBOARDING.md (reported line 43)May include surrounding context.
md
# 尝试 2: pip pip3 install requests 2>/dev/null && echo "OK" # 尝试 3: sudo pip（PEP 668 限制时） sudo pip3 install --break-system-packages requests 2>/dev/null && echo "OK" # 尝试 4: venv（隔离环境，不会污染系统）

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The sudo pip guidance is part of a broader privileged installation path and normalizes root execution for dependency setup. Even if intended for compatibility, it unnecessarily expands the blast radius of mistakes and conflicts with least-privilege operation for this skill.
Content: Scanner excerpt · references/ONBOARDING.md (reported line 44)May include surrounding context.
md
pip3 install requests 2>/dev/null && echo "OK" # 尝试 3: sudo pip（PEP 668 限制时） sudo pip3 install --break-system-packages requests 2>/dev/null && echo "OK" # 尝试 4: venv（隔离环境，不会污染系统） SKILL_DIR="<skill_dir>"

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document directs creation of a symlink in /usr/local/bin via sudo, which modifies the host PATH and requires elevated privileges unrelated to core file operations. In an agent setting, this broadens the skill’s effective capabilities and creates persistence on the machine beyond the current task.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 97% confidence
Finding: Using sudo ln -sf to place a binary in /usr/local/bin requires root and creates a persistent system-wide executable entry. For a file-management CLI used by agents, this is unnecessary host modification and increases persistence and trust surface on the machine.
Content: Scanner excerpt · references/ONBOARDING.md (reported line 66)May include surrounding context.
md
chmod +x <skill_dir>/scripts/alist_cli.py # 创建 symlink 到 PATH 目录 sudo ln -sf <skill_dir>/scripts/alist_cli.py /usr/local/bin/alist-cli # 验证 alist-cli --help

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/ONBOARDING.md (reported line 72)May include surrounding context.
alist-cli --help

text
如果无 sudo 权限，可用 alias 替代： ```bash alias alist-cli="python3 <skill_dir>/scripts/alist_cli.py"

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/ONBOARDING.md (reported line 165)May include surrounding context.
md
| 错误 | 原因 | 解决 | |------|------|------| | `No module named 'requests'` | 依赖未安装 | 回到 Step 2 | | `Permission denied` | 无 sudo 权限 / 脚本无执行权 | Step 3 改用 alias 或 venv | | `❌ 请设置 ALIST_URL` | 环境变量未设置 | Step 4 | | `❌ 登录失败` | 用户名或密码错误 | 检查凭据，重新设置 | | `❌ 未认证` | Token 过期 | 重新登录或设置 ALIST_USERNAME/PASSWORD 让脚本自动登录 |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: The API metadata references external OCR and preview services, which indicates that file content or URLs may be sent to third-party infrastructure. In a file-management skill, this is materially risky because agents may handle sensitive documents, and external transmission can leak file contents, metadata, or access URLs outside the expected trust boundary.
Content: Scanner excerpt · references/openapi.json (reported line 2898)May include surrounding context.
json
"iframe_previews": "{\n\t\"doc,docx,xls,xlsx,ppt,pptx\": {\n\t\t\"Microsoft\":\"https://view.officeapps.live.com/op/view.aspx?src=$e_url\",\n\t\t\"Google\":\"https://docs.google.com/gview?url=$e_url&embedded=true\"\n\t},\n\t\"pdf\": {\n\t\t\"PDF.js\":\"https://alist-org.github.io/pdf.js/web/viewer.html?file=$e_url\"\n\t},\n\t\"epub\": {\n\t\t\"EPUB.js\":\"https://alist-org.github.io/static/epub.js/viewer.html?url=$e_url\"\n\t}\n}", "logo": "https://cdn.jsdelivr.net/gh/alist-org/logo@main/logo.svg", "main_color": "#1890ff", "ocr_api": "https://api.nn.ci/ocr/file/json", "package_download": "true", "pagination_type": "all", "robots_txt": "User-agent: *\nAllow: /",

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: references/openapi.json:1085

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Tainted flow: 'username' from os.environ.get (line 390, credential/environment) → requests.post (network output)

Tp4

Ae1

Context-Inappropriate Capability

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Step 5: 验证连接

Description-Behavior Mismatch

Context-Inappropriate Capability

Context-Inappropriate Capability

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Vague Triggers

Skill Enumeration

Undeclared Tool Scope

Vague Triggers

Missing User Warnings

Natural-Language Policy Violations

Context-Inappropriate Capability

Sudo/Root Execution

Sudo/Root Execution

Context-Inappropriate Capability

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

External Transmission

Static analysis

Install source points to URL shortener or raw IP.