Cloud Mount

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:38 AM UTC
• Version: 1.5.0

Overview

The skill is mostly a coherent cloud-storage mounting helper, but it needs review because its docs/scripts include under-scoped autostart privilege guidance and broad scheduled cloud-backup examples that can expose or delete sensitive data.

Review before installing on production machines. Avoid running the autostart script with sudo unless you have audited and adapted it for a system service, protect ~/.config/rclone/rclone.conf, and do not use the broad /etc and /home cron backup example as written; use explicit allowlists, exclusions for secrets, encryption, dry-runs, and verified mounted destinations.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/enable-autostart.sh:60

Finding

Executable Configuration and Unsafe systemd Unit Generation

Content

View full analysis

"$SERVICE_FILE" << EOF [Unit] Description=Cloud Storage Mount ($CLOUD_REMOTE) After=network-online.target Wants=network-online.target [Service] Type=forking Environment="HOME=$HOME" ExecStart=$RCLONE_BIN mount $CLOUD_REMOTE: $MOUNT_POINT --daemon --vfs-cache-mode writes --vfs-cache-max-size 1G ExecStop=/bin/fusermount -u $MOUNT_POINT || /bin/true Restart=on-failure RestartSec=10 StartLimitBurst=3 StartLimitInterval=60s # Resource limits MemoryMax=512M MemoryHigh=256M [Install] WantedBy=default.target EOF log_info "Service file created: $SERVICE_FILE" } ``` The original script messages and comments are localized, but the executable statements above are reproduced without changing their behavior. ### Technical Analysis The script treats `~/.config/cloud-mount/config.sh` as trusted executable shell code by loading it with `source`. A configuration file is therefore not merely data: command substitutions, function calls, redirections, and arbitrary shell statements in that file execute with the privileges of the account running the script. The script subsequently inserts `CLOUD_REMOTE`, `MOUNT_POINT`, `HOME`, and `RCLONE_BIN` directly into a generated systemd service. These values are not checked for newlines, control characters, whitespace, or systemd directive syntax. A crafted value can consequently modify the generated unit or add directives. Because the unit is enabled for future sessions, service-file injection can turn a on ...[truncated 1716 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:338

Finding

Scheduled Backup Example Can Upload Broad Sensitive Filesystem Content

Content

View full analysis

~/backup.sh << 'EOF' #!/bin/bash rsync -av --delete /var/www/ ~/backup/www/ rsync -av --delete /etc/ ~/backup/etc/ rsync -av --delete /home/ ~/backup/home/ EOF # 4. Configure scheduled task crontab -e # Back up every day at 2:00 a.m. 0 2 * * * /bin/bash ~/backup.sh ``` The comments above are translated into English for reporting; the commands are unchanged. ### Technical Analysis The example recursively copies all readable content from `/var/www`, `/etc`, and `/home` into a cloud-backed mount. These paths commonly contain application configuration, private user data, SSH material, service credentials, API tokens, environment files, password hashes or references, and other sensitive information. The example provides no allowlist, exclusion rules, client-side encryption requirement, data-classification step, or confirmation of cloud-account scope. Running it through cron repeats the transfer automatically and can upload newly created secrets without further user review. The `--delete` option also mirrors local deletion into the destination. This weakens the backup's resilience against accidental deletion, compromised local accounts, or destructive activity because previously uploaded copies can be removed during the next scheduled synchronization. ### Attack Path 1. A user follows the documented server-backup example. 2. The user mounts a cloud remote at `~/backup`. 3. The user creates `~/backup.sh` with the documented recursive `rsync` commands. 4. The user registers the script in their crontab. 5. Every scheduled run copies all files readable by that account from the listed trees to the cloud mount. 6. Sensitive files created later are uploaded automatically without a new consent or ...[truncated 783 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (50)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The backup example uses rsync -av --delete against important directories, which can propagate accidental emptiness, wrong mount targets, or path mistakes into destructive deletions in the destination. In a cloud-mounted backup context, a failed or stale mount can make the command operate on an unintended local path and silently wipe prior backups.

Content

Scanner excerpt · SKILL.md (reported line 340)May include surrounding context.

md

# 3. 创建备份脚本
cat > ~/backup.sh << 'EOF'
#!/bin/bash
rsync -av --delete /var/www/ ~/backup/www/
rsync -av --delete /etc/ ~/backup/etc/
rsync -av --delete /home/ ~/backup/home/
EOF

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Applying rsync --delete to /etc/ backup content is particularly risky because configuration backups are small but critical, and a mount/path mistake can erase the only retained copies at the destination. The skill presents this as a normal example without guardrails such as filesystem verification or dry-run validation.

Content

Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.

md

cat > ~/backup.sh << 'EOF'
#!/bin/bash
rsync -av --delete /var/www/ ~/backup/www/
rsync -av --delete /etc/ ~/backup/etc/
rsync -av --delete /home/ ~/backup/home/
EOF

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Using rsync --delete on /home/ in a scheduled backup recipe can cause large-scale destructive sync behavior if the destination is wrong, unavailable, or unexpectedly empty. Because this skill centers on cloud mounts, the chance of transient mount failures makes deletion-based sync materially more dangerous in context than a local-only backup example.

Content

Scanner excerpt · SKILL.md (reported line 342)May include surrounding context.

md

#!/bin/bash
rsync -av --delete /var/www/ ~/backup/www/
rsync -av --delete /etc/ ~/backup/etc/
rsync -av --delete /home/ ~/backup/home/
EOF

# 4. 设置定时任务

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire publish log is written in Chinese, including headings, status information, installation context, and operational notes, with no indication that the skill is China-specific or that users may choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The main skill description is presented in Chinese and the README continues entirely in Chinese, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. The policy explicitly flags language or locale constraints when they are imposed without user opt-in or justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README makes inconsistent security claims about autostart: earlier it says systemd user service works without sudo, while later sections instruct users to create and manage a system-level service under /etc/systemd/system with sudo. This mismatch can mislead users about the actual privilege boundary and cause them to grant elevated privileges they did not expect.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · README.md (reported line 183)May include surrounding context.

md

ps aux | grep rclone

# 3. 查看挂载点
ls -la ~/cloud-storage/onedrive/

# 4. 查看系统日志
dmesg | tail -20

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 408)May include surrounding context.

md

ps aux | grep rclone

# 3. 查看挂载点
ls -la ~/cloud-storage/onedrive/

# 4. 查看系统日志
dmesg | tail -20

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 514)May include surrounding context.

md

ps aux | grep rclone

# 3. 查看挂载点
ls -la ~/cloud-storage/onedrive/

# 4. 查看系统日志
dmesg | tail -20

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The README instructs users to run the project's enable-autostart.sh script with sudo, which means arbitrary project code executes with root privileges. Without showing or constraining that script here, this expands trust to the full script contents and makes any bug or hidden behavior in that script high-impact.

Content

Scanner excerpt · README.md (reported line 224)May include surrounding context.

MOUNT_OPTIONS="--daemon --vfs-cache-mode minimal --vfs-cache-max-size 256M"

重启服务

sudo ~/cloud-mount/scripts/enable-autostart.sh restart

text

### Q5: 开机自启失败？

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

The README directs users to execute enable-autostart.sh with sudo for re-enablement, again running repository-controlled script logic as root. This is dangerous because a single privileged wrapper script can modify system units, files, or other settings beyond what users may expect from a cloud-mount helper.

Content

Scanner excerpt · README.md (reported line 240)May include surrounding context.

cat ~/.config/cloud-mount/config.sh

重新启用服务

sudo ~/cloud-mount/scripts/enable-autostart.sh enable

text

---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The README explicitly states that enable-autostart.sh may create a service file under /etc/systemd/system and reload systemd using sudo. That means the skill's functionality includes root-level persistence mechanisms, which are legitimate in some admin tools but materially increase risk if the script is flawed, misleading, or later modified.

Content

Scanner excerpt · README.md (reported line 264)May include surrounding context.

md

本技能需要以下权限，均用于正常功能：

1. **sudo 权限**（仅 enable-autostart.sh）
   - 创建 `/etc/systemd/system/cloud-mount.service` 系统服务文件
   - 重新加载 systemd 配置
   - **用户完全可控**：可以选择不启用开机自启

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 283)May include surrounding context.

1. 保护敏感文件

   bash

   # 设置 rclone 配置文件权限（仅自己可读写）
   chmod 600 ~/.config/rclone/rclone.conf
   
   # 不要将 token 文件上传到 Git
   echo ".config/rclone/rclone.conf" >> ~/.gitignore
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 634)May include surrounding context.

1. 保护敏感文件

   bash

   # 设置 rclone 配置文件权限（仅自己可读写）
   chmod 600 ~/.config/rclone/rclone.conf
   
   # 不要将 token 文件上传到 Git
   echo ".config/rclone/rclone.conf" >> ~/.gitignore
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 234)May include surrounding context.

md

brew install rclone

# Ubuntu / Debian
sudo apt install rclone

# CentOS / RHEL
sudo dnf install rclone

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 307)May include surrounding context.

md

brew install rclone

# Ubuntu / Debian
sudo apt install rclone

# CentOS / RHEL
sudo dnf install rclone

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

brew install rclone

# Ubuntu / Debian
sudo apt install rclone

# CentOS / RHEL
sudo dnf install rclone

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

brew install rclone

# Ubuntu / Debian
sudo apt install rclone

# CentOS / RHEL
sudo dnf install rclone

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

brew install rclone

# Ubuntu / Debian
sudo apt install rclone

# CentOS / RHEL
sudo dnf install rclone

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 446)May include surrounding context.

md

brew install rclone

# Ubuntu / Debian
sudo apt install rclone

# CentOS / RHEL
sudo dnf install rclone

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 447)May include surrounding context.

md

brew install rclone

# Ubuntu / Debian
sudo apt install rclone

# CentOS / RHEL
sudo dnf install rclone

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 484)May include surrounding context.

md

brew install rclone

# Ubuntu / Debian
sudo apt install rclone

# CentOS / RHEL
sudo dnf install rclone

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 664)May include surrounding context.

md

brew install rclone

# Ubuntu / Debian
sudo apt install rclone

# CentOS / RHEL
sudo dnf install rclone

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/enable-autostart.sh (reported line 219)May include surrounding context.

sh

brew install rclone

# Ubuntu / Debian
sudo apt install rclone

# CentOS / RHEL
sudo dnf install rclone

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 203)May include surrounding context.

sudo apt install rclone

CentOS / RHEL

sudo dnf install rclone

其他系统：https://rclone.org/install/

text

Static analysis

No suspicious patterns detected.