Remote Disk Mount

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:06 AM UTC
• Version: 0.4.0

Overview

The skill is not overtly malicious, but its root-level mount guidance includes unsafe password handling and cleartext network examples that users should review carefully.

Review and modify the commands before use. Prefer SFTP or HTTPS WebDAV, avoid cleartext FTP and HTTP WebDAV, do not place passwords in generated shell commands, use a temporary credential file with strict permissions and cleanup, validate all server and mount-point inputs, and approve each sudo command only after checking the fully expanded command.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:67
• Finding: Persistent Plaintext SMB Credentials at a Predictable Root-Owned Path<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:67-72` **Vulnerability Type**: Plaintext credential storage and unsafe fixed file usage **Risk Level**: Medium ### Vulnerable Code ```bash # 1. Create credential file echo "username=$USERNAME" | sudo tee /root/.smbcredentials echo "password=$PASSWORD" | sudo tee -a /root/.smbcredentials sudo chmod 600 /root/.smbcredentials # 2. Mount sudo mount.cifs //SERVER_IP/share ~/mount_name -o credentials=/root/.smbcredentials,uid=1000,gid=1000 ``` ### Technical Analysis The workflow writes an SMB username and password in plaintext to the fixed path `/root/.smbcredentials`. Although the final permissions are set to mode `600`, the sensitive data remains persistently stored after the mount operation. The documented checklist only recommends deleting the file “if sensitive,” but all password-containing credential files are sensitive, and no cleanup command is supplied. The first `tee` invocation truncates `/root/.smbcredentials` if it already exists. Consequently, following this workflow can destroy credentials or configuration maintained by another process. Using a predictable global path also prevents safe isolation between concurrent or sequential mount operations. The password is passed through the standard input of `sudo tee`, rather than being included directly in the command-line arguments. This reduces shell-history exposure but does not address persistent plaintext storage, command logging by an executing Agent, or the risk of overwriting an existing file. ### Attack Path 1. A user requests an SMB mount and supplies a username and password. 2. The Agent substitutes the credentials into the documented commands. 3. `sudo tee /root/.smbcredentials` truncates any existing file at that path and writes the new username. 4. The password is appended in plaintext. 5. The SMB share is mounted using the credential file. 6. No mandatory cleanup operation removes the file after mounting, unmounting, or fa ...[truncated 876 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Create a unique credential file with `sudo mktemp` instead of using `/root/.smbcredentials`. - Establish restrictive permissions before writing any secret, rather than correcting permissions afterward. - Check that the destination does not already exist and never truncate a shared credential path. - Register a cleanup trap before writing the password so the temporary file is removed after success, failure, interruption, and unmounting. - Avoid displaying or recording the substituted command when it contains a password. - Prefer a protected existing credential provider, secret manager, or interactive mechanism when supported. - Make credential cleanup mandatory rather than conditional. - If persistent mounts are required, explicitly tell the user that credentials will remain on disk and obtain confirmation for that separate persistence decision. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:77
• Finding: Cleartext FTP and WebDAV Transports Expose Credentials and Mounted Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:77-79, 92-95` **Vulnerability Type**: Cleartext transmission of credentials and data **Risk Level**: High ### Vulnerable Code ```bash ### FTP (curlftpfs) **Interactive password (recommended):** ```bash curlftpfs -o user=$USERNAME ftp://SERVER_IP/ ~/mount_name # Password will be prompted interactively - never shown in command ``` ``` ```bash ### WebDAV ```bash sudo mount -t davfs http://SERVER_IP/webdav /mnt/webdav -o uid=1000,gid=1000 # Password prompted interactively ``` ``` ### Technical Analysis Interactive password prompts prevent passwords from appearing directly in shell command history, but they do not encrypt network traffic. The FTP example explicitly uses `ftp://`, while the WebDAV example explicitly uses `http://`. Traditional FTP transmits authentication information and content without transport encryption. HTTP WebDAV similarly provides no TLS protection for credentials, file contents, metadata, or server responses. An attacker with access to the same network, a compromised gateway, DNS infrastructure, or another on-path position may observe or modify the traffic. The Skill recommends these commands without requiring explicit acknowledgement of the cleartext transport risk. This conflicts with its broader security-oriented treatment of credentials because protecting a password from local process arguments does not protect it during transmission. ### Attack Path 1. A user requests an FTP or WebDAV mount and follows the documented example. 2. The Agent connects to an `ftp://` or `http://` endpoint. 3. The user enters credentials through the interactive prompt. 4. The client transmits authentication and subsequent mount traffic without TLS protection. 5. An on-path attacker captures the authentication exchange or modifies network responses and file content. 6. The attacker reuses recovered credentials against the remote service or manipulates data consumed through the mounted ...[truncated 786 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace FTP with SFTP or a correctly configured FTPS client. - Require `https://` for WebDAV endpoints. - Require valid certificate verification and do not recommend disabling TLS hostname or certificate checks. - Reject cleartext FTP and HTTP endpoints by default. - If legacy cleartext access is unavoidable on an isolated trusted network, explain the credential and data exposure risks and obtain explicit user confirmation. - Clarify that interactive prompting only protects against command-line disclosure and does not provide network encryption. - Encourage least-privileged remote accounts restricted to only the required directories and operations. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25
• Finding: Unvalidated User Input Is Interpolated into Shell and Privileged Mount Commands<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:25-30, 54-55, 67-72, 79, 87-88, 94-95` **Vulnerability Type**: Shell argument injection and unsafe command construction **Risk Level**: Medium ### Vulnerable Code ```markdown Ask the user for: - **Protocol**: SMB / FTP / SFTP / WebDAV? - **Server IP/hostname**: e.g., `192.168.1.100` or `nas.example.com` - **Username**: (for SMB/FTP/SFTP) - **Password**: (will be used interactively, never shown in commands) - **Share name**: (for SMB only, e.g., `shared`) - **Mount point name**: (optional, e.g., `nas`, `backup`) ``` ```bash mkdir -p ~/mount_<name> ``` ```bash # 1. Create credential file echo "username=$USERNAME" | sudo tee /root/.smbcredentials echo "password=$PASSWORD" | sudo tee -a /root/.smbcredentials sudo chmod 600 /root/.smbcredentials # 2. Mount sudo mount.cifs //SERVER_IP/share ~/mount_name -o credentials=/root/.smbcredentials,uid=1000,gid=1000 ``` ```bash curlftpfs -o user=$USERNAME ftp://SERVER_IP/ ~/mount_name ``` ```bash sshfs $USERNAME@SERVER_IP:/ ~/mount_name -o uid=1000,gid=1000 # Use -o identityfile=~/.ssh/id_rsa for key-based auth ``` ```bash sudo mount -t davfs http://SERVER_IP/webdav /mnt/webdav -o uid=1000,gid=1000 # Password prompted interactively ``` ### Technical Analysis The Skill instructs the Agent to collect hostnames, usernames, share names, and mount-point names and then place them into shell command templates. It provides no mandatory syntax validation, robust quoting rules, canonicalization, or rejection of shell metacharacters and option-like values. If an Agent performs literal string substitution, values containing whitespace, semicolons, command substitutions, redirection operators, glob characters, or leading hyphens can change how the shell or the called utility interprets the command. Quoting in the SMB credential-writing example does not solve all concerns: embedded newlines can alter the credential-file format, while the server, share, username, UR ...[truncated 2721 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Validate each input according to a strict allowlist: - Accept only supported protocol identifiers. - Validate hostnames and IP addresses with dedicated parsers. - Restrict mount names to a safe character set such as ASCII letters, digits, underscores, and hyphens. - Reject control characters, newlines, shell metacharacters, and leading-option values. - Validate SMB share names and remote paths independently. - Construct commands as argument arrays through an execution API instead of building shell command strings. - Quote every variable expansion where shell usage is unavoidable. - Use an end-of-options delimiter (`--`) where the relevant utility supports it. - Resolve and verify mount-point paths before execution and ensure they remain under an approved base directory. - Do not embed passwords in generated shell text or Agent-visible command previews. - Display the exact safely escaped command and explain its effects before requesting confirmation for each `sudo` operation. - Use the current numeric UID and GID rather than hardcoded `1000` values. - Prefer SSH agent or standard SSH key discovery for SFTP; if a specific identity is needed, ask the user to select an existing key without reading, copying, or modifying its contents. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Chaining Abuse

High

• Category: Tool Misuse

Content

**Credential file method:**
```bash
# 1. Create credential file
echo "username=$USERNAME" | sudo tee /root/.smbcredentials
echo "password=$PASSWORD" | sudo tee -a /root/.smbcredentials
sudo chmod 600 /root/.smbcredentials

• Confidence: 93% confidence
• Finding: Piping data into a privileged writer (`| sudo tee`) is a chaining pattern that can amplify mistakes and causes command contents to traverse more surfaces such as logs and transcripts. In this skill, it is especially risky because the same pattern is used immediately adjacent to write a password, making the chaining approach part of an insecure secret-handling workflow.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# 1. Create credential file
echo "username=$USERNAME" | sudo tee /root/.smbcredentials
echo "password=$PASSWORD" | sudo tee -a /root/.smbcredentials
sudo chmod 600 /root/.smbcredentials

# 2. Mount

• Confidence: 99% confidence
• Finding: This pipeline sends a plaintext password through shell command text into `sudo tee`, creating multiple opportunities for disclosure via history, telemetry, transcripts, debugging output, or audit tooling. The combination of shell interpolation, pipeline chaining, and root file write makes this a true and material credential-handling vulnerability.

Credential Access

High

• Category: Privilege Escalation

Content

**Key-based auth (recommended):**
```bash
sshfs $USERNAME@SERVER_IP:/ ~/mount_name -o uid=1000,gid=1000
# Use -o identityfile=~/.ssh/id_rsa for key-based auth
```

### WebDAV

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## ⚠️ Security Guidelines

1. **Never pass passwords on command line** — Use credential files or interactive prompts instead
2. **Confirm with user before running sudo commands** — Don't auto-execute privileged operations
3. **Use SSH keys for SFTP** — Avoid password-based authentication
4. **Mount untrusted storage with caution** — It can expose local files

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## ⚠️ Security Guidelines

1. **Never pass passwords on command line** — Use credential files or interactive prompts instead
2. **Confirm with user before running sudo commands** — Don't auto-execute privileged operations
3. **Use SSH keys for SFTP** — Avoid password-based authentication
4. **Mount untrusted storage with caution** — It can expose local files

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## ⚠️ Security Guidelines

1. **Never pass passwords on command line** — Use credential files or interactive prompts instead
2. **Confirm with user before running sudo commands** — Don't auto-execute privileged operations
3. **Use SSH keys for SFTP** — Avoid password-based authentication
4. **Mount untrusted storage with caution** — It can expose local files

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## ⚠️ Security Guidelines

1. **Never pass passwords on command line** — Use credential files or interactive prompts instead
2. **Confirm with user before running sudo commands** — Don't auto-execute privileged operations
3. **Use SSH keys for SFTP** — Avoid password-based authentication
4. **Mount untrusted storage with caution** — It can expose local files

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## ⚠️ Security Guidelines

1. **Never pass passwords on command line** — Use credential files or interactive prompts instead
2. **Confirm with user before running sudo commands** — Don't auto-execute privileged operations
3. **Use SSH keys for SFTP** — Avoid password-based authentication
4. **Mount untrusted storage with caution** — It can expose local files

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## ⚠️ Security Guidelines

1. **Never pass passwords on command line** — Use credential files or interactive prompts instead
2. **Confirm with user before running sudo commands** — Don't auto-execute privileged operations
3. **Use SSH keys for SFTP** — Avoid password-based authentication
4. **Mount untrusted storage with caution** — It can expose local files

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# SMB
sudo apt install smbclient cifs-utils -y

# FTP
sudo apt install curlftpfs -y

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# SMB
sudo apt install smbclient cifs-utils -y

# FTP
sudo apt install curlftpfs -y

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# SMB
sudo apt install smbclient cifs-utils -y

# FTP
sudo apt install curlftpfs -y

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# SMB
sudo apt install smbclient cifs-utils -y

# FTP
sudo apt install curlftpfs -y

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# SMB
sudo apt install smbclient cifs-utils -y

# FTP
sudo apt install curlftpfs -y

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# SMB
sudo apt install smbclient cifs-utils -y

# FTP
sudo apt install curlftpfs -y

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Credential file method:**
```bash
# 1. Create credential file
echo "username=$USERNAME" | sudo tee /root/.smbcredentials
echo "password=$PASSWORD" | sudo tee -a /root/.smbcredentials
sudo chmod 600 /root/.smbcredentials

• Confidence: 96% confidence
• Finding: This command pipes user-controlled content into `sudo tee` to create a root-owned credentials file, exposing the username in command text and establishing a risky pattern that is paired with password handling on the next line. Even if the username itself is not highly sensitive, using root pipelines for secret material increases logging and audit exposure and encourages unsafe credential handling.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The skill claims not to support plaintext passwords on the command line, but the SMB example uses `echo "password=$PASSWORD" | sudo tee ...`, which places the secret in shell command text and likely shell history, agent logs, transcripts, or process/audit records. This contradiction makes the guidance unsafe because it normalizes insecure handling of credentials while writing them into a root-owned file via a pipeline.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# 1. Create credential file
echo "username=$USERNAME" | sudo tee /root/.smbcredentials
echo "password=$PASSWORD" | sudo tee -a /root/.smbcredentials
sudo chmod 600 /root/.smbcredentials

# 2. Mount

• Confidence: 99% confidence
• Finding: This line writes the SMB password into a root-owned file using `echo "password=$PASSWORD" | sudo tee -a ...`, directly exposing the secret in command text and likely in shell history, agent transcripts, monitoring, or audit logs. Because the skill explicitly says not to use plaintext passwords on the command line, this is a clear unsafe contradiction.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 1. Create credential file
echo "username=$USERNAME" | sudo tee /root/.smbcredentials
echo "password=$PASSWORD" | sudo tee -a /root/.smbcredentials
sudo chmod 600 /root/.smbcredentials

# 2. Mount
sudo mount.cifs //SERVER_IP/share ~/mount_name -o credentials=/root/.smbcredentials,uid=1000,gid=1000

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.