Expiring Local Fileshare

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:12 PM UTC
• Version: 1.0.2

Overview

This skill does what it says by creating temporary local-network file links, but it has enough scoping and token-handling weaknesses that users should review it carefully before installing.

Install only if you are comfortable exposing selected workspace files over plain HTTP to your local or VPN network. Do not use it for secrets, keys, credentials, regulated data, or highly sensitive files. Treat generated links as bearer credentials, check /tmp log exposure on multi-user systems, and stop background share processes when finished.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/share.sh:33

Finding

Predictable Shared Temporary Log Exposes the Bearer Token

Content

View full analysis

/tmp/share-$PORT.log 2>&1 & PID=$! # Wait for server to start sleep 1 # Extract link from log if [[ -f /tmp/share-$PORT.log ]]; then LINK=$(grep "Link:" /tmp/share-$PORT.log | sed -E 's/^.*Link:[[:space:]]*//') ``` ### Technical Analysis The server writes its output, including the complete token-bearing share URL, to a predictable file named `/tmp/share-.log`. The port defaults to `8888` and is incremented sequentially when occupied, making the resulting path easy to predict. The script does not create the file securely, enforce restrictive permissions, verify ownership, or reject symbolic links. Shell redirection follows an existing symbolic link. Consequently: - The share token can be exposed to other local users if the caller's umask creates a broadly readable file, as commonly occurs with a `022` umask. - A local attacker may pre-create a file at the predictable path and monitor it if the server process can write to it. - A local attacker may pre-create a symbolic link and cause the shell redirection to overwrite or append to another file writable by the invoking user. - Token-bearing logs remain in `/tmp` after the link is returned. The token is the primary authorization credential for accessing the shared file. Disclosure therefore allows an attacker who can reach the service from an accepted local or RFC1918 address to download the file. ### Attack Path 1. The attacker predicts that the script will use port `8888`, or identifies the sequentially selected port. 2. The attacker monitors or pre-creates `/tmp/share-8888.log`; alternatively, the attacker places a symbolic link at that path. 3. A user invokes `share.sh`. 4. The shell writes the server output, including `http://

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/share-file.js:36

Finding

Workspace Authorization Can Be Bypassed Through a Path Check-to-Use Race

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/share-file.js:100

Finding

One-Time Share Tokens Can Be Reused by Concurrent Requests

Content

View full analysis

{ if (oneTime) consumed = true; }); ``` ### Technical Analysis The server checks `consumed` before starting a transfer but sets it only when the file stream emits `end`. During the entire transfer window, `consumed` remains `false`. Node.js can accept additional requests while the first asynchronous stream is active. Multiple requests carrying the same token can therefore pass the check before the first request reaches the `end` handler. Every accepted request receives its own file stream, defeating the documented one-time-access guarantee. This is a logical race rather than a multi-threaded memory race. The event loop serializes individual callbacks, but the state transition is deliberately deferred across asynchronous I/O, leaving a reusable authorization window. ### Attack Path 1. The attacker obtains a valid one-time share URL. 2. The attacker opens multiple connections to the server. 3. The attacker sends several requests carrying the same token in rapid succession. 4. Each request reaches the authorization check before the first file stream emits `end`. 5. Every request observes `consumed === false`. 6. The server creates a separate stream for each request and returns the file multiple times. 7. Only after a stream finishes is `consumed` changed to `true`. ### Impact Assessment The ...[truncated 476 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The example explicitly demonstrates sharing '~/secrets.txt', normalizing the exfiltration of sensitive data through a temporary web server. In context, this is more dangerous than a generic example because the skill's purpose is to make local files remotely retrievable, so suggesting secret material directly encourages credential disclosure.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

{baseDir}/scripts/share.sh ~/image.png 9000 12

Share a file (one-time access, 1h)

{baseDir}/scripts/share.sh ~/secrets.txt 9001 1 once

text

## How It Works

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

Uninstall (ClawHub)

If installed into ~/.openclaw/skills:

bash

rm -rf ~/.openclaw/skills/expiring-local-fileshare

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

Uninstall (ClawHub)

If installed into ~/.openclaw/skills:

bash

rm -rf ~/.openclaw/skills/expiring-local-fileshare

---

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises executable behavior that depends on environment access and local scripts, but it does not declare any explicit tool scope or permissions. That increases the chance the agent will invoke it with broader-than-expected access, reducing auditability and weakening least-privilege controls around local file sharing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The read_when triggers use broad phrases like 'link' and 'open/view a file from browser', which can cause the skill to activate in normal conversation without a clear user intent to expose a local file over HTTP. In a sharing skill, unintended activation is risky because it may lead to accidental publication of sensitive workspace content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The usage and security sections describe mechanics and safeguards, but they do not prominently warn users that files are being served over plain HTTP and may contain sensitive information. Even on local/VPN networks, this can mislead users into sharing secrets or regulated data without understanding interception, replay, or endpoint-compromise risks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script accepts any existing file path and does not verify that the target resides under the OpenClaw workspace, despite the skill description claiming it only shares files from the local workspace. This mismatch can expose arbitrary local files such as SSH keys, configuration files, tokens, or other sensitive host data over HTTP if a user or upstream agent passes an unintended path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script launches the file-sharing server in the background immediately, with no explicit pre-start confirmation or strong warning that the file will become reachable over the network. In an agent/tooling context, this increases the chance of accidental exposure because the action is easy to trigger non-interactively and the user may only learn about the network share after it is already active.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The header comment says the share is "LAN-only (192.168.0.0/24)", which is a specific subnet restriction. In reality, the request filter accepts 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and localhost via isPrivateIPv4 and isLocalhost, so the inline documentation materially understates the allowed network scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.