Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Remote Disk Mount
v0.4.0远程磁盘挂载工具，支持 SMB/CIFS、FTP、SFTP、WebDAV 协议挂载远程共享到本地目录。当用户需要：(1) 挂载 Windows/Samba 共享，(2) 挂载 FTP/SFTP 服务器，(3) 挂载 WebDAV 存储，(4) 将远程存储映射为本地磁盘使用时触发此技能。
⭐ 1· 492·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (mount SMB/FTP/SFTP/WebDAV) matches the instructions. Requiring sudo and apt packages for Debian/Ubuntu is expected. There are no unrelated environment variables, binaries, or external services requested.
Instruction Scope
The SKILL.md stays within the stated purpose: it collects protocol/server/user info, installs packages with sudo apt, creates mount points, and runs mount commands. It warns about passwords and asks for user confirmation before sudo. Points to note: it instructs creating a credential file at /root/.smbcredentials (sensitive and requires root), there are small inconsistencies in mount-point paths used (~/mount_<name>, ~/mount_name, /mnt/webdav), and some mounts use root-mounted mount.cifs vs user-space FUSE (behavior/permissions differ). These are expected for this task but are security-relevant and should be handled carefully.
Install Mechanism
This is an instruction-only skill with no install spec or code files; no downloads or package installs performed by the skill itself. The instructions ask the user/agent to run apt installs on-demand, which is appropriate and expected.
Credentials
The skill requests no environment variables or external credentials in metadata. It does instruct creating local credential files (e.g., /root/.smbcredentials) which are necessary for some mount options but are sensitive — the SKILL.md warns to remove them after use.
Persistence & Privilege
The skill requires privileged operations (sudo, writing files under /root) to function, which is proportionate to mounting filesystems. It does not request persistent or always-on privileges (always:false) and does not modify other skills or system-wide agent settings.
Assessment
This skill appears to do what it says, but mounting remote storage requires root actions and careful handling of credentials. Before using: confirm you're on Debian/Ubuntu; prefer SSH keys for SFTP; avoid placing long-lived plaintext credential files under /root (delete immediately after use or store securely with strict permissions); prefer user-space FUSE mounts when possible to limit root exposure; verify the remote server is trusted (malicious servers can attack clients via filesystem content); double-check mount-point paths and uid/gid options; and do not paste plaintext passwords into the chat. If you need higher assurance, run these commands manually or in a sandboxed VM and inspect any credential files before deleting them.Like a lobster shell, security has layers — review code before you run it.
latestvk97an8202a3na9187s4s92ny2d81z4a0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.