NAS Agent Sync

• Analyzed: May 12, 2026, 4:01 AM
• Findings: 1
• Version: 1.1.0
• Hash: 7d240b284b9afb28b26d92f99790681af4c3906d22cf21ba2af0ab064a44dcb7
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle describes a legitimate NAS integration via SSH, but the `SKILL.md` instructions for the 'File Master' agent involve constructing and executing `ssh` and `rsync` commands with user-provided or inter-agent parameters (e.g., `[file]`, `[subfolder]`). This pattern introduces a significant shell injection vulnerability on the remote NAS if these parameters are not rigorously sanitized by the OpenClaw agent's execution environment, potentially allowing arbitrary command execution on the NAS. While the stated purpose is benign, the direct execution of shell commands with templated inputs represents a high-risk capability without explicit safeguards described in the skill itself.