ClawHub
Back to skill

Security audit

Nexus Cli

Security checks for vulnerabilities and agentic risk

Overview

This media-server skill matches its stated purpose, but its installer and credential handling need careful review before use.

Install only if you are comfortable letting this tool administer your media stack and Docker services. Avoid the pipe-to-shell installer; prefer a pinned release and verify integrity where possible. Treat generated config.yaml and .env files as secret files, restrict permissions, avoid cleartext remote service connections, and require explicit user approval before setup, doctor --fix, restarts, indexer removals, or any torrent deletion with --delete-files.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:35
Finding

Mutable Remote Installation Script Is Executed Directly by the Shell

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
install.sh:102
Finding

Downloaded Release Binary Is Installed and Executed Without Integrity Verification

Content
View full analysis
/dev/null) || fail "Cannot reach GitHub API. Set ADMIRARR_VERSION to install offline." VERSION=$(printf '%s' "$RELEASE_JSON" | grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"//;s/".*//') [ -z "$VERSION" ] && fail "Could not determine latest version" VERSION_NUM="${VERSION#v}" EXT="tar.gz" [ "$OS" = "windows" ] && EXT="zip" FILENAME="${BINARY}_${VERSION_NUM}_${OS}_${ARCH}.${EXT}" URL="https://github.com/${REPO}/releases/download/${VERSION}/${FILENAME}" TMPDIR=$(mktemp -d) trap 'rm -rf "$TMPDIR"' EXIT step "Downloading ${FILENAME}..." download "$URL" "${TMPDIR}/${FILENAME}" || fail "Download failed: ${URL}" step "Extracting..." cd "$TMPDIR" if [ "$EXT" = "zip" ]; then command -v unzip >/dev/null 2>&1 || fail "unzip is required for Windows archives" unzip -q "$FILENAME" else tar -xzf "$FILENAME" fi FOUND="" for candidate in \ "${BINARY}" \ "${BINARY}.exe" \ */"${BINARY}" \ */"${BINARY}.exe"; do if [ -f "$candidate" ]; then FOUND="$candidate" break fi done [ -z "$FOUND" ] && fail "Binary not found in archive" mkdir -p "$INSTALL_DIR" TARGET="${INSTALL_DIR}/${BINARY}" [ "$OS" = "windows" ] && TARGET="${TARGET}.exe" rm -f "$TARGET" cp "$FOUND" "$TARGET" chmod +x "$TARGET" if "$TARGET" --version >/dev/null 2>&1; then INSTALLED=$("$TARGET" --version 2>&1 | head -1) info "${INSTALLED}" fi ``` ### Technical Analysis The installer obtains mutable “latest release” metadata, downloads an archive, extracts a matching executable, installs it into a PATH directory, and invokes it with `--version`. No checksum, detached signature, transparency-log identity, or other independent artifact verification occurs before installation or execution. An optional `ADMIRARR ...[truncated 1486 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
internal/setup/writeconfig.go:22
Finding

Service API Keys Are Printed and Persisted in a World-Readable Configuration File

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
internal/setup/deploy.go:150
Finding

WireGuard and OpenVPN Credentials Are Written to World-Readable Environment Files

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
internal/setup/apikeys.go:116
Finding

Reusable Service Credentials Are Transmitted Over Cleartext HTTP

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (117)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The README tells users to pipe a remote script directly into sh via curl -fsSL https://get.admirarr.dev | sh. This is dangerous because it executes network-fetched code immediately without inspection, pinning, or integrity verification, creating a direct remote-code-execution and supply-chain compromise path.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

Quick Start

bash
curl -fsSL https://get.admirarr.dev | sh
admirarr setup      # deploy + wire the stack
admirarr status     # see everything at a glance

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Using a shell pipeline to feed remote content directly into sh is a classic command-chaining abuse pattern because it combines retrieval and execution in one step. In the context of an agent skill, this is more dangerous: an automated system may reproduce the command non-interactively, giving a compromised endpoint immediate code execution on the host.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

Quick Start

bash
curl -fsSL https://get.admirarr.dev | sh
admirarr setup      # deploy + wire the stack
admirarr status     # see everything at a glance

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The install section repeats the pattern of fetching a remote script and piping it directly to sh. Repetition in primary install documentation increases the likelihood that users and agents will adopt an unsafe execution path, magnifying supply-chain and man-in-the-middle consequences if the endpoint is compromised.

Content

Scanner excerpt · README.md (reported line 305)May include surrounding context.

Install

bash
curl -fsSL https://get.admirarr.dev | sh

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

This repeated pipeline executes downloaded shell content immediately, which removes review opportunities and makes compromise of the remote installer highly impactful. Because the skill is designed for agent use and server administration, the operational context makes such chaining more dangerous than in a low-privilege toy project.

Content

Scanner excerpt · README.md (reported line 305)May include surrounding context.

Install

bash
curl -fsSL https://get.admirarr.dev | sh

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill includes migration/setup semantics and references a broad service stack, while the description frames it mainly as media-server management. If infrastructure generation includes privileged options such as Docker socket access or elevated network capabilities, failing to disclose that materially underestimates risk and could lead users to authorize dangerous actions unintentionally.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill includes migration/setup semantics and references a broad service stack, while the description frames it mainly as media-server management. If infrastructure generation includes privileged options such as Docker socket access or elevated network capabilities, failing to disclose that materially underestimates risk and could lead users to authorize dangerous actions unintentionally.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill includes migration/setup semantics and references a broad service stack, while the description frames it mainly as media-server management. If infrastructure generation includes privileged options such as Docker socket access or elevated network capabilities, failing to disclose that materially underestimates risk and could lead users to authorize dangerous actions unintentionally.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill includes migration/setup semantics and references a broad service stack, while the description frames it mainly as media-server management. If infrastructure generation includes privileged options such as Docker socket access or elevated network capabilities, failing to disclose that materially underestimates risk and could lead users to authorize dangerous actions unintentionally.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill includes migration/setup semantics and references a broad service stack, while the description frames it mainly as media-server management. If infrastructure generation includes privileged options such as Docker socket access or elevated network capabilities, failing to disclose that materially underestimates risk and could lead users to authorize dangerous actions unintentionally.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill includes migration/setup semantics and references a broad service stack, while the description frames it mainly as media-server management. If infrastructure generation includes privileged options such as Docker socket access or elevated network capabilities, failing to disclose that materially underestimates risk and could lead users to authorize dangerous actions unintentionally.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill includes migration/setup semantics and references a broad service stack, while the description frames it mainly as media-server management. If infrastructure generation includes privileged options such as Docker socket access or elevated network capabilities, failing to disclose that materially underestimates risk and could lead users to authorize dangerous actions unintentionally.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill includes migration/setup semantics and references a broad service stack, while the description frames it mainly as media-server management. If infrastructure generation includes privileged options such as Docker socket access or elevated network capabilities, failing to disclose that materially underestimates risk and could lead users to authorize dangerous actions unintentionally.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill includes migration/setup semantics and references a broad service stack, while the description frames it mainly as media-server management. If infrastructure generation includes privileged options such as Docker socket access or elevated network capabilities, failing to disclose that materially underestimates risk and could lead users to authorize dangerous actions unintentionally.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill includes migration/setup semantics and references a broad service stack, while the description frames it mainly as media-server management. If infrastructure generation includes privileged options such as Docker socket access or elevated network capabilities, failing to disclose that materially underestimates risk and could lead users to authorize dangerous actions unintentionally.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill includes migration/setup semantics and references a broad service stack, while the description frames it mainly as media-server management. If infrastructure generation includes privileged options such as Docker socket access or elevated network capabilities, failing to disclose that materially underestimates risk and could lead users to authorize dangerous actions unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The downloads remove <hash> [--delete-files] command can permanently delete torrent data, yet the skill provides no explicit warning about data loss. An agent could invoke this during cleanup or troubleshooting and irreversibly remove downloaded content or in-progress data.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
78% confidence
Finding

Creating a .env file for configuration introduces credential-handling risk because such files commonly store secrets like VPN credentials, API keys, and service tokens in plaintext. In this skill context, the risk is elevated because the command also mentions harvesting keys and instructs the user to edit the env file with credentials, making accidental disclosure or insecure persistence more likely.

Content

Scanner excerpt · cmd/migrate.go (reported line 20)May include surrounding context.

go
Creates:
  - docker-compose.yml with selected services
  - .env file with configuration variables
  - TRaSH Guides directory structure (/data/torrents/, /data/media/)
  - Per-service config directories

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The command explicitly states it will detect running services and harvest API keys before generating files. Credential collection from existing services is highly sensitive and not necessary for ordinary media management; if misused or logged, it can enable unauthorized access to Radarr/Sonarr/Plex/Jellyfin and potentially downstream services.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The script explicitly instructs users to pipe remotely fetched content directly into sh, which removes the opportunity to inspect the installer before execution and makes any compromise of the hosting domain or transport path immediately exploitable. In an installer that downloads and installs executables, this significantly increases supply-chain risk.

Content

Scanner excerpt · install.sh (reported line 5)May include surrounding context.

sh
# ─── Admirarr Installer ──────────────────────────────────────────────
# One command, any platform:
#
#   curl -fsSL https://get.admirarr.dev | sh
#
# Or with wget:
#   wget -qO- https://get.admirarr.dev | sh

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The | sh chaining pattern is a classic unsafe execution shortcut because it combines network retrieval and execution in one step without review or verification. In this skill's context, where the tool manages a media server stack and may be run on long-lived home servers, compromise could yield persistent host access and service manipulation.

Content

Scanner excerpt · install.sh (reported line 5)May include surrounding context.

sh
# ─── Admirarr Installer ──────────────────────────────────────────────
# One command, any platform:
#
#   curl -fsSL https://get.admirarr.dev | sh
#
# Or with wget:
#   wget -qO- https://get.admirarr.dev | sh

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The wget variant has the same security issue as the curl example: it encourages direct execution of unaudited remote script content. This pattern is especially risky for software-installation skills because compromise leads to arbitrary command execution on the host.

Content

Scanner excerpt · install.sh (reported line 8)May include surrounding context.

sh
#   curl -fsSL https://get.admirarr.dev | sh
#
# Or with wget:
#   wget -qO- https://get.admirarr.dev | sh
#
# Options (environment variables):
#   ADMIRARR_INSTALL_DIR  — install location (default: ~/.local/bin or /usr/local/bin)

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The wget example repeats the same chaining-abuse risk by turning a remote response into immediate shell input. This is dangerous because any upstream compromise or accidental content change can become direct code execution on the target machine.

Content

Scanner excerpt · install.sh (reported line 8)May include surrounding context.

sh
#   curl -fsSL https://get.admirarr.dev | sh
#
# Or with wget:
#   wget -qO- https://get.admirarr.dev | sh
#
# Options (environment variables):
#   ADMIRARR_INSTALL_DIR  — install location (default: ~/.local/bin or /usr/local/bin)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · install.sh (reported line 187)May include surrounding context.

sh
ARGET"
cp "$FOUND" "$TARGET"
chmod +x "$TARGET"

info "Installed to ${TARGET}"

# ── Verify ──

if "$TARGET" --version >/dev/null 2>&1; then
  INSTALLED=$("$TARGET" --version 2>&1 | head -1)
  info "${INSTALLED}"
fi

# ── PATH check ──

case ":${PATH}:" in
  *":${INSTALL_DIR}:"*) ;;
  *)
    printf "\n"
    warn "${INSTALL_DIR} is not in your PATH. Add it:\n"
    printf "    ${DIM}echo 'export PATH=\"%s:\$PATH\"' >> ~/.bashrc${RESET}\n" "$INSTALL_DIR"
    printf "    ${DIM}echo 'export PATH=\"%s:\$PATH\"' >> ~/.zshrc${RESET}\n" "$INSTALL_DIR"
    ;;
esac

# ── Done ──

printf "\n  ${GOLD}⚓${RESET} ${BOLD}Ready.${RESET} Run ${GOLD}admirarr setup${RESET} to deploy your stack.\n"
printf "  ${DIM}Or ${RESET}${GOLD}admirarr doctor${RESET}${DIM} if you already have one running.${RESET}\n\n"

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

This code constructs a shell command string passed to sh -c inside a Docker container using the container value without shell escaping. If service can be influenced by untrusted input and config.ContainerName(service) does not strictly sanitize metacharacters, an attacker could inject arbitrary shell commands that execute inside the helper container against the mounted host directory, potentially altering host files via the bind mount.

Content

Scanner excerpt · internal/deploy/deploy.go (reported line 82)May include surrounding context.

go
mkdirCmd := exec.Command("docker", "run", "--rm",
			"-v", filepath.Dir(configDir)+":/mnt",
			"alpine", "sh", "-c",
			fmt.Sprintf("mkdir -p /mnt/%s && chown -R %d:%d /mnt/%s", container, os.Getuid(), os.Getgid(), container))
		if mkdirErr := mkdirCmd.Run(); mkdirErr != nil {
			return Result{Error: fmt.Errorf("cannot create config dir %s: %v", configDir, err)}
		}

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The code writes a generated .env file using mode 0644, making it world-readable on typical Unix systems. If GenerateEnvFile includes API keys, tokens, or service credentials, any local user on the host could read them, which is a real confidentiality issue in a deployment component managing media-server services.

Content

Scanner excerpt · internal/deploy/deploy.go (reported line 98)May include surrounding context.

go
}

	// Also ensure .env exists
	envPath := filepath.Join(composeDir, ".env")
	if _, err := os.Stat(envPath); os.IsNotExist(err) {
		envContent := migrate.GenerateEnvFile(opts, envPath)
		_ = os.WriteFile(envPath, []byte(envContent), 0644)

Static analysis

No suspicious patterns detected.