Security audit

File Manager Service

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent file manager, but it exposes powerful file operations through an unauthenticated web service that binds to all network interfaces and has serious containment and web UI security flaws.

Install only if you are comfortable running a background file-management web service with read/write/delete access to your OpenClaw projects. Do not run it on a shared, VPN, container, or exposed network until it binds to localhost only, adds authentication and CSRF protection, fixes upload path validation and XSS issues, and pins or vendors dependencies.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/server.py:843
Finding: Unauthenticated File Management Service Exposed on All Network Interfaces
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/server.py:358
Finding: Arbitrary Filesystem Write Through Single-File Upload Path Traversal
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/templates/index.html:450
Finding: Stored and Reflected Cross-Site Scripting in File Manager UI
Content: View full analysis
'; html += '📂 projects'; let acc = ''; parts.forEach((p, i) => { acc = acc ? `${acc}/${p}` : p; if (i === parts.length - 1) html += ` / ${p}`; else html += ` / ${p}`; }); // ... document.getElementById('breadcrumb').innerHTML = html; } function renderGrid(c, data) { let h = '
'; data.directories.forEach(d => { h += `

📝

${esc(d.name)}
${d.has_note ? `
${truncate(d.note,50)}
` : ''}
`; }); c.innerHTML = h + '
'; } function updatePreview() { const content = document.getElementById('file-editor').value; const mp = document.getElementById('markdown-preview'); // ... if (typeof marked !== 'undefined') mp.innerHTML = marked.parse(content); } async function searchFiles() { const q = document.getElementById('search-input').value.trim(); // ... document.getElementById('breadcrumb').innerHTML = `📂 projects
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/templates/index.html:8
Finding: Unpinned Runtime Browser Dependency Loaded from a Third-Party CDN
Content: View full analysis
``` Related installation guidance in `README.md:22` also leaves Python packages unpinned: ```bash pip install flask requests ``` ### Technical Analysis The browser loads `marked` from a third-party CDN at runtime without specifying an exact package version and without a Subresource Integrity hash. The effective JavaScript executed by the application can therefore change after the Skill package has been reviewed. The remotely loaded script runs in the file manager's origin and can make same-origin requests to every file-management API. Availability or compromise of the CDN, package publication account, dependency resolution process, or upstream release can consequently affect the security of the local service. The documented Python installation command similarly installs unspecified versions of Flask and Requests, preventing reproducible dependency review and increasing exposure to incompatible or compromised future releases. ### Attack Path 1. A user installs unspecified current versions of the Python dependencies and starts the service. 2. The user opens the Web interface. 3. The browser resolves the unversioned `marked` URL through jsDelivr. 4. A compromised or unexpectedly changed upstream artifact is returned. 5. The artifact executes as trusted same-origin JavaScript. 6. It invokes the unauthenticated file APIs to read, modify, upload, or delete project content. ### Impact Assessment Compromise of the remotely loaded dependency can provide control over the Web interface and the same-origin file-management APIs. The practical scope includes disclosure and modification of the full managed project tree. Unpinned Python dependencies also make buil ...[truncated 126 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/server.py:596
Finding: Regular Expression Denial of Service in Recursive Search
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (46)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description understates the actual functionality by omitting editing, saving, deleting, moving, searching, and metadata management operations. This is dangerous because users or orchestration systems may approve the skill for limited file browsing/service control while it actually supports destructive and broader content-manipulation actions.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.
md
python scripts/file_manager.py start

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
md
python scripts/file_manager.py start

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README content and example invocations are presented entirely in Chinese, including the natural-language commands intended for skill use, without offering an alternative language or stating that the skill is intentionally region-specific. This can violate language/locale policy when a specific language is imposed without user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file documents a delete command for files/directories, but it does not warn users that the action may permanently remove data or require confirmation before execution. Although the README mentions '安全删除' and that the root directory cannot be deleted, it does not clearly disclose deletion risk to user data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.