Security audit

Owncloud Sync

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent sync-report purpose, but it ships exposed credentials, private file metadata, a hardcoded email recipient, and instructions for a persistent unpinned service.

Review this carefully before installing. Do not use the included credentials; assume they are exposed and rotate them if they are real. Replace the hardcoded Google account and email recipient, remove bundled generated reports/raw Drive outputs, pin or vendor the OwnCloud indexing service before enabling it, and run any service under a least-privileged account with explicit user approval.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:11
Finding: Persistent system service installed from mutable, unverified remote source
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: owncloud.json:1
Finding: Plaintext OwnCloud and indexing-service credentials committed to the project
Content: View full analysis
``` The active request is directed to this endpoint at line 33: ```sh ' https://qemu.ovh/remote.php/dav/files/TesLaMent963/Documents/ ``` ### Technical Analysis The project distributes two authentication credential sets in plaintext: - An `admin` username and password for the external indexing endpoint. - A separate OwnCloud DAV username and password used directly by `curl`. The second credential remains exposed even where duplicate commands are commented out, and it is also embedded in an active request. Anyone who can read the project, an archive of it, a clone, a backup, or repository history can recover the secrets without executing the Skill. The scripts pass credentials through `curl -u`. Depending on the operating system and process-monitoring configuration, command-line arguments may also be observable to other local users while the request is running. ### Attack Path 1. An attacker obtains the Skill package, repository clone, backup, or cached artifact. 2. The attacker reads `owncloud.json` ...[truncated 1022 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: raw_output_gdrive.txt:1
Finding: Sensitive Google Drive metadata and personal document names included in project artifacts
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: owncloud-sync.txt:26
Finding: Predictable debug files permit metadata disclosure and local symlink attacks
Content: View full analysis
/tmp/curl-debug.log) # echo "Basic Auth: ${ALLFILES_USER}:${ALLFILES_PASS}" CURL_EXIT=$? if [[ $CURL_EXIT -ne 0 ]]; then echo "ERREUR: curl a échoué (code = $CURL_EXIT) sur ${ALLFILES_URL}" >&2 echo "Utilisateur courant : $(whoami)" >&2 echo "=== Log curl (dernières lignes) ===" >&2 tail -n 30 /tmp/curl-debug.log >&2 ``` `owncloud-sync.sh:50-61`: ```sh WORK_DIR=$(mktemp -d "${TMPDIR:-/tmp}/owncloud_sync.XXXXXX") REPORT_FILE="${WORK_DIR}/report.txt" GD_RAW_FILE="${WORK_DIR}/gdrive_raw.txt" OC_RAW_FILE="${WORK_DIR}/owncloud_raw.txt" # DEBUG_LOG="${WORK_DIR}/debug.log" DEBUG_LOG="./debug.log" : > "$DEBUG_LOG" cleanup() { rm -rf "$WORK_DIR" } ``` ### Technical Analysis The older implementation writes verbose curl diagnostics to the fixed, shared path `/tmp/curl-debug.log`. The primary shell implementation creates a secure temporary working directory but deliberately places its debug log at the predictable path `./debug.log` and truncates it with: ```sh : > "$DEBUG_LOG" ``` Neither debug path is securely created with exclusive semantics. If another local user can prepare the relevant path, they may replace it with a symbolic link. When the script runs, shell redirection follows that link and writes to or truncates the linked target with the invoking user's permissions. The `/tmp/curl-debug.log` file is also not removed by the shown cleanup logic. Verbose curl output can disclose endpoint, connection, certificate, request, and response metadata. The primary debug log records private filenames and modification dates during comparisons. ### Attack Path 1. A local attacker predicts `/tmp/curl-debug.log`, or cont ...[truncated 1237 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (41)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: Using subprocess.run with shell=True on a composed command string is a classic tool-parameter abuse pattern because metacharacters in the command string can alter execution semantics. Even if the current query is internally built, this implementation is fragile and unsafe in a skill that may evolve to accept external input or reuse the helper for other commands.
Content: Scanner excerpt · owncloud-sync.py (reported line 32)May include surrounding context.
python
def run_cmd(cmd): try: result = subprocess.run(cmd, shell=True, capture_output=True, text=True, check=True) return result.stdout.strip() except subprocess.CalledProcessError as e: print(f'Error running command: {cmd}', file=sys.stderr)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script contains hard-coded ownCloud credentials and uses them to perform authenticated requests against a remote server. Embedding live secrets in a shell script is dangerous because anyone with access to the file, logs, shell history, process list, or repository can reuse the credentials to access or enumerate remote files and metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description states that it generates and emails a daily report listing new Google Drive files and whether corresponding files are missing or outdated on OwnCloud, but it does not clearly warn that this report contains file inventory and synchronization-status metadata. That metadata can reveal sensitive document names, activity timelines, and storage gaps, creating privacy and information-disclosure risk if users enable the skill without understanding what is transmitted by email.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill hard-codes a specific Gmail address for both the account context and the report recipient, which can cause reports or account-bound actions to target an unintended real user without consent. In this context, the script is designed to query cloud storage and email synchronization results, so embedding a personal address increases the risk of privacy leakage, misdelivery, and unauthorized use of a specific account identity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script loads and uses sensitive authentication data from configuration values, including the OwnCloud password. There is no visible warning, prompt, or explanatory documentation in this file informing the user that stored credentials will be accessed and used.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 98% confidence
Finding: This subprocess call uses shell=True with a command string that incorporates a query value. Although the current query is derived from internal constants, this pattern is dangerous because any future influence over the command string can lead to shell injection and arbitrary command execution. In a file-sync/reporting skill that handles external data and credentials, retaining this pattern increases risk substantially.
Content: Scanner excerpt · owncloud-sync.py (reported line 32)May include surrounding context.
python
def run_cmd(cmd): try: result = subprocess.run(cmd, shell=True, capture_output=True, text=True, check=True) return result.stdout.strip() except subprocess.CalledProcessError as e: print(f'Error running command: {cmd}', file=sys.stderr)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code performs a network request to OwnCloud using provided credentials and sends filename-derived search content in the XML body. There is no confirmation prompt, user-facing log/print, or explanatory docstring/comment warning that remote queries containing user file names will be sent.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · owncloud-sync.py (reported line 86)May include surrounding context.
python
] try: result = subprocess.run(curl_cmd, capture_output=True, text=True, check=True) except subprocess.CalledProcessError as e: print('Failed to query OwnCloud', file=sys.stderr) print(e, file=sys.stderr)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script automatically emails a generated report to a hardcoded recipient. That creates an unsolicited data exfiltration path because file names, sync status, and related metadata are sent off-host without runtime confirmation or clear operator consent. In an agent skill context, hidden outbound messaging is more dangerous because it can quietly leak operational information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Emailing the generated report creates a clear outbound disclosure channel for potentially sensitive file inventory and sync status data. Because this happens automatically and uses a fixed recipient, it can leak information without meaningful operator review, which is especially concerning in an agent skill.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · owncloud-sync.py (reported line 192)May include surrounding context.
python
] try: subprocess.run(mail_cmd, check=True) except subprocess.CalledProcessError as e: print('Failed to send email report', file=sys.stderr) print(e, file=sys.stderr)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The header documentation describes checking recently modified files, which implies a limited recent time range. In code, PERIOD_DAYS is hard-coded to 365, causing the script to examine a full year of Google Drive activity instead of a clearly recent subset, which materially diverges from the stated intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script loads ALLFILES_USER and ALLFILES_PASS from a local JSON config and then uses them for an authenticated curl request to an OwnCloud endpoint. While the header comment describes querying Google Drive and emailing a report, it does not clearly warn that stored credentials will be accessed and used for outbound authenticated network communication.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script automatically emails a synchronization report containing file inventory metadata, statuses, and the OwnCloud endpoint to an external address. This creates a real confidentiality risk because potentially sensitive operational data is exfiltrated over email without explicit consent, review, minimization, or transport/privacy guarantees in the script.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script loads sensitive credentials from a local JSON file and immediately uses them in an authenticated network request, with no disclosure, validation of trust boundaries, or safeguards around destination integrity. In this context, the risk is increased because the endpoint is configurable and the script also enables verbose curl logging, which can expose authentication details or sensitive operational data during failures.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script writes a report of Google Drive and OwnCloud file states to disk and then emails it out automatically, without any notice or approval step. That behavior can leak potentially sensitive filenames, timestamps, and sync gaps to local storage and an external mailbox, making the skill more dangerous in environments handling private documents.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script sends an email externally via gog mail send without any user prompt, consent flow, or clear disclosure in the skill context. Even though the content appears to be a sync report, outbound email can exfiltrate file names, timestamps, and operational details to a fixed recipient, which is risky when the skill metadata and purpose are unspecified.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · raw_output_gdrive.txt (reported line 1)May include surrounding context.
text
ID NAME TYPE SIZE MODIFIED 1NNownVzkrO1B6Zqz2TMLzPV7_50x3cMiZJkuhof7ff4 Openclaw file 78.9 KB 2026-02-26 11:07 1RWV9Lx9Tun1LEmJRFHz--hYV-yiAWKNK facture internat Q4 2025.pdf file 49.0 KB 2026-02-24 21:27 11auIJkAqQXunYoHRKGbCcHXWyegkIqeX available_skills_list.txt file 1020 B 2026-02-24 17:51

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · raw_output_gdrive.txt (reported line 2)May include surrounding context.
text
ID NAME TYPE SIZE MODIFIED 1NNownVzkrO1B6Zqz2TMLzPV7_50x3cMiZJkuhof7ff4 Openclaw file 78.9 KB 2026-02-26 11:07 1RWV9Lx9Tun1LEmJRFHz--hYV-yiAWKNK facture internat Q4 2025.pdf file 49.0 KB 2026-02-24 21:27 11auIJkAqQXunYoHRKGbCcHXWyegkIqeX available_skills_list.txt file 1020 B 2026-02-24 17:51 1ap89ffL1pXhm5T_k75RP6IqgBFvrDcB7 [Inetum Luxembourg SA] - Fiches de salaire- ETIENNE Denis - 2026-02.pdf file 72.6 KB 2026-02-23 16:00

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · raw_output_gdrive.txt (reported line 3)May include surrounding context.
text
ID NAME TYPE SIZE MODIFIED 1NNownVzkrO1B6Zqz2TMLzPV7_50x3cMiZJkuhof7ff4 Openclaw file 78.9 KB 2026-02-26 11:07 1RWV9Lx9Tun1LEmJRFHz--hYV-yiAWKNK facture internat Q4 2025.pdf file 49.0 KB 2026-02-24 21:27 11auIJkAqQXunYoHRKGbCcHXWyegkIqeX available_skills_list.txt file 1020 B 2026-02-24 17:51 1ap89ffL1pXhm5T_k75RP6IqgBFvrDcB7 [Inetum Luxembourg SA] - Fiches de salaire- ETIENNE Denis - 2026-02.pdf file 72.6 KB 2026-02-23 16:00 19TB4ruY7jCu4oeSlj2jUSk0i_AHUgrvY facture internat Q1 2026.pdf file 49.0 KB 2026-02-23 08:01

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · raw_output_gdrive.txt (reported line 6)May include surrounding context.
text
ID NAME TYPE SIZE MODIFIED 1NNownVzkrO1B6Zqz2TMLzPV7_50x3cMiZJkuhof7ff4 Openclaw file 78.9 KB 2026-02-26 11:07 1RWV9Lx9Tun1LEmJRFHz--hYV-yiAWKNK facture internat Q4 2025.pdf file 49.0 KB 2026-02-24 21:27 11auIJkAqQXunYoHRKGbCcHXWyegkIqeX available_skills_list.txt file 1020 B 2026-02-24 17:51 1ap89ffL1pXhm5T_k75RP6IqgBFvrDcB7 [Inetum Luxembourg SA] - Fiches de salaire- ETIENNE Denis - 2026-02.pdf file 72.6 KB 2026-02-23 16:00 19TB4ruY7jCu4oeSlj2jUSk0i_AHUgrvY facture internat Q1 2026.pdf file 49.0 KB 2026-02-23 08:01

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · raw_output_gdrive.txt (reported line 4)May include surrounding context.
text
ID NAME TYPE SIZE MODIFIED 1NNownVzkrO1B6Zqz2TMLzPV7_50x3cMiZJkuhof7ff4 Openclaw file 78.9 KB 2026-02-26 11:07 1RWV9Lx9Tun1LEmJRFHz--hYV-yiAWKNK facture internat Q4 2025.pdf file 49.0 KB 2026-02-24 21:27 11auIJkAqQXunYoHRKGbCcHXWyegkIqeX available_skills_list.txt file 1020 B 2026-02-24 17:51 1ap89ffL1pXhm5T_k75RP6IqgBFvrDcB7 [Inetum Luxembourg SA] - Fiches de salaire- ETIENNE Denis - 2026-02.pdf file 72.6 KB 2026-02-23 16:00 19TB4ruY7jCu4oeSlj2jUSk0i_AHUgrvY facture internat Q1 2026.pdf file 49.0 KB 2026-02-23 08:01 1oEakhBdAWRipHrUnF1YLo2uq4Gd1yikp caf aide logement attestation-non-paiement.pdf file 3.4 MB 2026-02-23 08:00

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · raw_output_gdrive.txt (reported line 8)May include surrounding context.
text
ID NAME TYPE SIZE MODIFIED 1NNownVzkrO1B6Zqz2TMLzPV7_50x3cMiZJkuhof7ff4 Openclaw file 78.9 KB 2026-02-26 11:07 1RWV9Lx9Tun1LEmJRFHz--hYV-yiAWKNK facture internat Q4 2025.pdf file 49.0 KB 2026-02-24 21:27 11auIJkAqQXunYoHRKGbCcHXWyegkIqeX available_skills_list.txt file 1020 B 2026-02-24 17:51 1ap89ffL1pXhm5T_k75RP6IqgBFvrDcB7 [Inetum Luxembourg SA] - Fiches de salaire- ETIENNE Denis - 2026-02.pdf file 72.6 KB 2026-02-23 16:00 19TB4ruY7jCu4oeSlj2jUSk0i_AHUgrvY facture internat Q1 2026.pdf file 49.0 KB 2026-02-23 08:01 1oEakhBdAWRipHrUnF1YLo2uq4Gd1yikp caf aide logement attestation-non-paiement.pdf file 3.4 MB 2026-02-23 08:00

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · raw_output_gdrive.txt (reported line 7)May include surrounding context.
text
11auIJkAqQXunYoHRKGbCcHXWyegkIqeX available_skills_list.txt file 1020 B 2026-02-24 17:51 1ap89ffL1pXhm5T_k75RP6IqgBFvrDcB7 [Inetum Luxembourg SA] - Fiches de salaire- ETIENNE Denis - 2026-02.pdf file 72.6 KB 2026-02-23 16:00 19TB4ruY7jCu4oeSlj2jUSk0i_AHUgrvY facture internat Q1 2026.pdf file 49.0 KB 2026-02-23 08:01 1oEakhBdAWRipHrUnF1YLo2uq4Gd1yikp caf aide logement attestation-non-paiement.pdf file 3.4 MB 2026-02-23 08:00 1FU4KZdT4EPa1KglkDqLIYZ00CH2f24r4 Arbres binaires-OCaml.pdf file 81.2 KB 2026-02-17 21:58 1CqPjjVfxFDfH8vmhZLX3UYPdJ6I-UvSr 2-option-informatique-devoir-en-tps-libre2.pdf file 112.3 KB 2026-02-17 21:46 1PC7Uu4oMbKM3avLpmT9zd9LMPYR2Df2W 1-option-informatique-mpsi-ocaml.pdf file 111.1 KB 2026-02-15 16:19

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · raw_output_gdrive.txt (reported line 9)May include surrounding context.
text
11auIJkAqQXunYoHRKGbCcHXWyegkIqeX available_skills_list.txt file 1020 B 2026-02-24 17:51 1ap89ffL1pXhm5T_k75RP6IqgBFvrDcB7 [Inetum Luxembourg SA] - Fiches de salaire- ETIENNE Denis - 2026-02.pdf file 72.6 KB 2026-02-23 16:00 19TB4ruY7jCu4oeSlj2jUSk0i_AHUgrvY facture internat Q1 2026.pdf file 49.0 KB 2026-02-23 08:01 1oEakhBdAWRipHrUnF1YLo2uq4Gd1yikp caf aide logement attestation-non-paiement.pdf file 3.4 MB 2026-02-23 08:00 1FU4KZdT4EPa1KglkDqLIYZ00CH2f24r4 Arbres binaires-OCaml.pdf file 81.2 KB 2026-02-17 21:58 1CqPjjVfxFDfH8vmhZLX3UYPdJ6I-UvSr 2-option-informatique-devoir-en-tps-libre2.pdf file 112.3 KB 2026-02-17 21:46 1PC7Uu4oMbKM3avLpmT9zd9LMPYR2Df2W 1-option-informatique-mpsi-ocaml.pdf file 111.1 KB 2026-02-15 16:19