ClawHub
Back to skill

Security audit

Container Gaming — Podman, Distrobox, Flatpak, Sunshine

Security checks for vulnerabilities and agentic risk

Overview

This gaming skill is mostly a command reference, but it includes risky setup commands that can run changing internet scripts as administrator and expose game-streaming services without enough warning.

Read this skill as a review-required setup guide. Avoid running the curl | sudo sh command as written; prefer distro packages or pinned, verified installers. Use pinned and verified container images, mount only a dedicated game directory, avoid X11 sharing where possible, and expose Sunshine over Tailscale only after authentication is configured and limited to trusted devices.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:76
Finding

Privileged Execution of a Mutable Remote Installation Script

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:60
Finding

Unpinned and Inconsistent Bottles Container Image References

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:78
Finding

Mutable Ubuntu Image Used to Create a Host-Integrated Distrobox

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (9)

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

Granting a container access to /dev/dri and the host X11 socket weakens isolation and increases the consequences of a compromised containerized application. In this gaming context it may be functionally necessary for GPU acceleration and display, but it still exposes host resources and can facilitate data access or interaction with the host session.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
# Run a Windows game in Wine container
podman run --rm -it \
  --device /dev/dri \
  -e DISPLAY=:0 \
  -v /tmp/.X11-unix:/tmp/.X11-unix \
  -v ~/Games:/games \

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The curl ... | sudo sh pattern is a dangerous chained execution primitive because it combines network retrieval with immediate privileged execution in one step. This removes opportunities for inspection or validation and magnifies any compromise of the download source into full host takeover.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

bash
# Install Distrobox
curl -s https://raw.githubusercontent.com/89luca89/distrobox/main/install | sudo sh

# Create gaming container (Ubuntu)
distrobox create --name gaming-ubuntu --image ubuntu:latest

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
98% confidence
Finding

The command pipes a remotely fetched script directly into sudo sh, causing unreviewed network content to execute as root. This is dangerous because a compromised upstream repository, MITM, or unexpected script change would immediately gain full system privileges.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

bash
# Install Distrobox
curl -s https://raw.githubusercontent.com/89luca89/distrobox/main/install | sudo sh

# Create gaming container (Ubuntu)
distrobox create --name gaming-ubuntu --image ubuntu:latest

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
# Install Distrobox
curl -s https://raw.githubusercontent.com/89luca89/distrobox/main/install | sudo sh

# Create gaming container (Ubuntu)
distrobox create --name gaming-ubuntu --image ubuntu:latest

# Enter container

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
distrobox enter gaming-ubuntu

# Install gaming tools inside container
sudo apt install wine lutris steam

# Export Steam to host
distrobox export --app steam --extra-flags "gamescope -W 1280 -H 800 -f"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

toolbox enter gaming

Install tools

sudo dnf install steam lutris wine

text

### Flatpak Gaming

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill recommends exposing Sunshine ports via tailscale serve --bg 47989 and 47990 without any warning about authentication, access control, or the privacy implications of making a game-streaming service remotely reachable. In the context of Sunshine, this increases attack surface and may lead users to expose a sensitive interactive service to other devices or users without understanding the risks.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

md
export MANGOHUD=1

# Per-game config
mkdir -p ~/.config/MangoHud
cat > ~/.config/MangoHud/game-name.conf << 'EOF'
full
fps

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The skill fetches an installation script from a remote URL at runtime, creating a supply-chain risk because the content can change and is not verified before execution. This becomes especially dangerous here because the fetched script is immediately piped into a root shell.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

bash
# Install Distrobox
curl -s https://raw.githubusercontent.com/89luca89/distrobox/main/install | sudo sh

# Create gaming container (Ubuntu)
distrobox create --name gaming-ubuntu --image ubuntu:latest

Static analysis

No suspicious patterns detected.