Security audit

LAN Media Server

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real LAN file-sharing tool, but it installs a persistent unauthenticated server on all network interfaces with weak file-containment guarantees.

Install only if you intentionally want a persistent unauthenticated HTTP file share from this machine. Use a dedicated empty directory, do not place secrets there, avoid symlinks, restrict access with firewall or bind-address changes, and stop/disable the systemd user service when sharing is no longer needed.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

Location: scripts/setup.sh:23
Finding: Persistent Systemd User Service Installed and Enabled by Default
Content: View full analysis
"$SERVICE_FILE" <
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/server.js:37
Finding: Symbolic Link Escape Allows Files Outside MEDIA_ROOT to Be Served
Content: View full analysis
{ if (err || !stats.isFile()) { res.writeHead(404); res.end('Not found'); return; } ``` The file is subsequently opened at `scripts/server.js:63`: ```javascript fs.createReadStream(filePath).pipe(res); ``` ### Technical Analysis The containment validation checks only the lexical form of `filePath`. It verifies that the normalized path string begins with `MEDIA_ROOT`, but it does not resolve symbolic links before performing the check. Both `fs.stat()` and `fs.createReadStream()` follow symbolic links. Consequently, a symbolic link located lexically inside `MEDIA_ROOT` can point to a regular file outside that directory. The prefix check accepts the link path, while the filesystem operations access and serve the external target. This contradicts the documented assertion that files must remain under `MEDIA_ROOT`. ### Attack Path 1. A symbolic link is created inside the shared directory, for example: ```bash ln -s "$HOME/.ssh/id_rsa" "$HOME/projects/shared-media/leak.txt" ``` 2. A network client sends `GET /leak.txt` to the server. 3. The normalized path remains lexically beneath `MEDIA_ROOT`, so the prefix check succeeds. 4. `fs.stat()` follows the symbolic link and observes a regular file. 5. `fs.createReadStream()` follows the same link ...[truncated 759 chars]
Remediation: View remediation
{ if ( err || (!resolvedFile.startsWith(resolvedRoot + path.sep) && resolvedFile !== resolvedRoot) ) { res.writeHead(403); res.end('Forbidden'); return; } // Open and serve the validated canonical target. }); ``` ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/server.js:65
Finding: Unauthenticated File Server Listens on All Network Interfaces
Content: View full analysis
{ console.log(`LAN Media Server running on http://0.0.0.0:${PORT}`); console.log(`Serving: ${MEDIA_ROOT}`); }); ``` The absence of authentication is explicitly documented in `SKILL.md:65-68`: ```markdown ## Security Notes - Serves files only on LAN (0.0.0.0 but typically behind NAT) - No authentication — don't put sensitive files in the shared directory - Path traversal is blocked (files must be under MEDIA_ROOT) - No directory listing — must know the exact filename ``` ### Technical Analysis Binding to `0.0.0.0` exposes the service through every IPv4 interface available to the host. It does not technically enforce LAN-only access. Depending on firewall rules, cloud security groups, router port forwarding, VPN routing, container networking, or host placement, the service may be reachable from untrusted networks or the public Internet. The server does not authenticate requests or authorize access to individual files. The absence of directory listing only obscures filenames; it is not an access-control mechanism. Filenames can be guessed, disclosed through logs or messages, or discovered through predictable naming conventions. The server also uses plaintext HTTP, so file contents and requested paths can be observed or modified by an on-path network attacker. ### Attack Path 1. The setup script starts the server on TCP port `18801` or a configured alternative. 2. The listener accepts connections through all host IPv4 interfaces. 3. An attacker reaches the port through a local network, VPN, forwarded port, permissive firewall, or public interface. 4. The attacker obtains or guesses a shared filename. 5. The attacker requests `http://host:18801/`. 6. The server returns the file without reques ...[truncated 568 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup.sh:4
Finding: Unvalidated Environment Values Are Interpolated into a Systemd Unit
Content: View full analysis
/dev/null || echo '/usr/bin/node')" ``` ```bash # Create systemd user service mkdir -p "$SERVICE_DIR" cat > "$SERVICE_FILE" <
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs the agent to run setup and management commands, use environment-variable-controlled configuration, and operate a network-accessible file server, but it declares no explicit tool scope or permissions metadata. That mismatch can cause the platform to under-constrain what the skill is allowed to do, increasing the chance of unintended command execution, environment access, or network exposure without clear review boundaries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The server binds to 0.0.0.0, making all files under MEDIA_ROOT reachable by any host on the local network without authentication, authorization, or per-file access controls. In this skill’s context, that is the core feature, but it still creates a real exposure: screenshots, documents, and other workspace artifacts may be unintentionally disclosed to anyone on the LAN who can guess or obtain the URL.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 94% confidence
Finding: The script installs and enables a persistent systemd user service that automatically restarts and survives future sessions, which creates session persistence on the host. In the context of a LAN-accessible file server, this increases exposure because a network service continues running beyond the immediate task and may keep sharing workspace files until explicitly disabled.
Content: Scanner excerpt · scripts/setup.sh (reported line 46)May include surrounding context.
sh
# Enable and start systemctl --user daemon-reload systemctl --user enable media-server.service systemctl --user restart media-server.service echo ""

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.sh (reported line 65)May include surrounding context.
sh
if ! loginctl show-user "$(whoami)" 2>/dev/null | grep -q 'Linger=yes'; then echo "" echo "⚠️ User lingering not enabled. Run this to survive reboots:" echo " sudo loginctl enable-linger $(whoami)" fi

Static analysis

No suspicious patterns detected.