Security audit

NAS File Courier Skill

Security checks across malware telemetry and agentic risk

Overview

This skill has a coherent NAS file-delivery purpose, but it can access and transmit private NAS files and its triggers and temporary sharing fallback are broader than they should be.

Install only if you are comfortable giving the agent read access to the configured NAS remote and allowing selected files to be copied to local temp storage and sent through external messaging providers. Narrow activation to explicit NAS requests, prefer native MEDIA delivery with explicit confirmation, avoid the HTTP fallback for sensitive files unless it is isolated and authenticated, and replace the fixed temp directory and wildcard cleanup with per-transfer temporary directories.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The manifest advertises very broad trigger phrases such as 'find file', 'send file', and generic Chinese equivalents, which can match many ordinary user requests and cause the skill to activate in contexts the user did not intend. Because this skill can search a NAS and transmit files, over-broad invocation increases the chance of unintended data access or exfiltration through normal conversation flow.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This documentation explicitly describes reading a local file and uploading it to Feishu, which is a third-party messaging platform, but does not warn operators that this action transfers potentially sensitive NAS data off the local system. In the context of a file-courier skill, missing disclosure and consent guidance increases the risk of accidental exfiltration of confidential documents through normal use.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The Telegram section documents loading local files and sending them directly to a chat, and also references a temporary HTTP link fallback for oversized files, but provides no privacy or exfiltration warning. That is dangerous because users may not realize the skill can move NAS content to Telegram or expose it via temporary links, broadening disclosure beyond the local environment.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: This section describes reading local files into memory and uploading them to QQ endpoints without warning that the operation sends data to an external service. In a NAS search-and-send skill, that omission materially increases the chance of unintended disclosure of private files because the documented happy path is silent about the trust boundary crossing.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ```bash kill $SERVE_PID 2>/dev/null # 如果使用了 Step 4b rm -f /tmp/openclaw/nas-courier/* ls /tmp/openclaw/nas-courier/ # 验证为空 ```
Confidence: 88% confidence
Finding: rm -f /tmp/openclaw/nas-courier/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: 📤 投递: 回复中包含 MEDIA: /tmp/openclaw/nas-courier/<文件名> 📤 备用: rclone serve http ... (见 references/http-temp-link.md) ✅ 验证: 必须询问用户是否收到 🧹 清理: rm -f /tmp/openclaw/nas-courier/* ```
Confidence: 88% confidence
Finding: rm -f /tmp/openclaw/nas-courier/

VirusTotal

47/47 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: references/http-temp-link.md:26