obs

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:54 PM UTC
• Version: 1.0.1

Overview

This OBS management skill is broadly aligned with its purpose, but it needs Review because it handles credentials and remote destructive actions with unsafe shell implementation and limited warnings.

Install only if you are comfortable giving this skill OBS credentials that can alter your projects and packages. Use a least-privilege OBS token, avoid storing OBS_TOKEN in shell startup files, test against a sandbox project first, and review every delete, request accept/reject, rebuild, or file upload target before running it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: references/obs-lib.sh:36

Finding

Arbitrary Command Execution Through eval-Based curl Construction

Content

View full analysis

Remediation

View remediation

&2 return 2 ;; esac if [ -n "$OBS_USERNAME" ] && [ -n "$OBS_TOKEN" ]; then curl_args+=(-u "$OBS_USERNAME:$OBS_TOKEN") fi curl_args+=(-H "Content-Type: $content_type") if [ -n "$data" ]; then if [[ "$data" == @* ]]; then curl_args+=(--data-binary "$data") else curl_args+=(--data-binary "$data") fi fi curl "${curl_args[@]}" "$url" } ``` Additional hardening should include: 1. Validate `OBS_APIURL` with an allowlist of permitted schemes, preferably requiring HTTPS. 2. Validate HTTP methods against a fixed set. 3. Percent-encode each path and query component instead of interpolating raw object names into endpoints. 4. Avoid returning authentication options as shell-formatted text; add each option directly to an argument array. 5. Add tests using values containing spaces, quotes, semicolons, command substitutions, and newlines to verify that they are treated only as data. 6. Use `curl --fail-with-body --show-error` and handle non-success HTTP responses explicitly. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/obs-lib.sh:22

Finding

Predictable Temporary Cookie File Exposes Authentication State

Content

View full analysis

/dev/null && [ -f "$HOME/.config/osc/oscrc" ]; then echo "--cookie-jar /tmp/obs_cookie_$$ --cookie /tmp/obs_cookie_$$" else echo "" fi } ``` ### Technical Analysis When token environment variables are unavailable but an osc configuration exists, the library directs curl to use `/tmp/obs_cookie_$$` as both its cookie input and cookie jar. The path is derived only from the process ID and is therefore predictable. The implementation does not: - Create the file atomically with `mktemp`. - Establish a private temporary directory. - Verify file ownership or type. - Explicitly enforce restrictive permissions. - Remove the cookie file when execution ends. - Protect against pre-existing paths or symbolic links. Because `/tmp` is generally shared among local users, another local account may be able to predict or observe the filename. Depending on operating-system protections and curl's file replacement behavior, an attacker may obtain the session cookies, interfere with the cookie file, or redirect writes through filesystem links. The file may also remain after the process exits. The authentication options are returned as a whitespace-separated string and later expanded as shell arguments, compounding the unsafe argument-construction design. ### Attack Path 1. A user runs the library without `OBS_USERNAME` and `OBS_TOKEN`, while `osc` and `~/.config/osc/oscrc` are present. 2. A local attacker predicts or monitors the process ID and corresponding `/tmp/obs_cookie_` path. 3. The attacker creates or observes the path before or during the API request, or waits for the predictable cookie file to ...[truncated 920 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/obs-expert-setup.sh:132

Finding

Plaintext API Token Persistence and Unsafe Shell Startup File Generation

Content

View full analysis

/dev/null; then echo_warning "$env_file 中已存在 OBS 配置 | OBS config already exists in $env_file" read -p "是否覆盖？| Overwrite? (y/n): " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]]; then sed -i '/^export OBS_/d' "$env_file" else echo "跳过环境变量配置 | Skipping environment variable configuration" return fi fi # 添加环境变量 cat >> "$env_file" << EOF # OBS Expert Configuration (added by obs-expert-setup.sh) export OBS_APIURL=https://api.opensuse.org export OBS_USERNAME=$OBS_USERNAME_INPUT export OBS_TOKEN=$OBS_TOKEN_INPUT EOF echo_success "环境变量已添加到 $env_file | Environment variables added to $env_file" echo_warning "请运行 'source $env_file' 使配置生效 | Run 'source $env_file' to apply changes" fi } ``` The same insecure storage pattern is also recommended in `SETUP.md`, lines 32-43: ```bash export OBS_APIURL=https://api.opensuse.org export OBS_USERNAME=your_username export OBS_TOKEN=your_api_token ``` ### Technical Analysis The setup script offers to append the OBS API token directly to `.bashrc` or `.zshrc`. Shell startup files are long-lived plaintext files and are commonly read by backup systems, support tooling, shell plugins, diagnostic collection, and other local software. The script ...[truncated 2277 chars]

Remediation

View remediation

> "$env_file" printf 'export OBS_USERNAME=%q\n' "$OBS_USERNAME_INPUT" >> "$env_file" ``` The token should instead be loaded at runtime from a protected source rather than written as an export statement. Additional controls should include: - Verify the destination is a regular file owned by the current user and is not a symbolic link. - Reject startup files with unsafe group or world permissions. - Use `umask 077` before creating credential files. - Write configuration atomically through a secure temporary file followed by `mv`. - Avoid displaying tokens in logs, process arguments, diagnostics, or error messages. - Update `SETUP.md` and other documentation so they no longer recommend persistent plaintext token exports. - Encourage least-privilege tokens and regular token rotation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · PUBLISHED.md (reported line 182)May include surrounding context.

md

| 类别 | Category | 端点 | Endpoints | 状态 | Status |
|------|----------|------|-----------|------|--------|
| 项目 | Projects | GET/PUT/DELETE /source/{project} | ✅ | 完成 |
| 项目元数据 | Project Meta | GET/PUT /meta/project/{project} | ✅ | 完成 |
| 包 | Packages | GET/PUT/DELETE /source/{project}/{package} | ✅ | 完成 |
| 包元数据 | Package Meta | GET/PUT /meta/package/{project}/{package} | ✅ | 完成 |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · PUBLISHED.md (reported line 184)May include surrounding context.

md

|------|----------|------|-----------|------|--------|
| 项目 | Projects | GET/PUT/DELETE /source/{project} | ✅ | 完成 |
| 项目元数据 | Project Meta | GET/PUT /meta/project/{project} | ✅ | 完成 |
| 包 | Packages | GET/PUT/DELETE /source/{project}/{package} | ✅ | 完成 |
| 包元数据 | Package Meta | GET/PUT /meta/package/{project}/{package} | ✅ | 完成 |
| 文件 | Files | GET/PUT/DELETE /source/{project}/{package}/{file} | ✅ | 完成 |
| 构建状态 | Build Status | GET /build/{project}/_result | ✅ | 完成 |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · PUBLISHED.md (reported line 186)May include surrounding context.

md

| 项目元数据 | Project Meta | GET/PUT /meta/project/{project} | ✅ | 完成 |
| 包 | Packages | GET/PUT/DELETE /source/{project}/{package} | ✅ | 完成 |
| 包元数据 | Package Meta | GET/PUT /meta/package/{project}/{package} | ✅ | 完成 |
| 文件 | Files | GET/PUT/DELETE /source/{project}/{package}/{file} | ✅ | 完成 |
| 构建状态 | Build Status | GET /build/{project}/_result | ✅ | 完成 |
| 构建日志 | Build Logs | GET /build/{project}/{repo}/{arch}/{package}/logs | ✅ | 完成 |
| 重建 | Rebuild | POST /build/{project}/{repo}/{arch}/{package}?cmd=rebuild | ✅ | 完成 |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation instructs users to place API tokens in environment variables and oscrc configuration without warning that these are sensitive secrets. This can lead to accidental exposure through shell history, process listings, overly permissive file permissions, screenshots, or checked-in dotfiles, increasing the risk of account compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown quick-start includes file upload, build rebuild, and submit-request creation commands, and the API coverage section also advertises DELETE and request accept/decline/revoke capabilities. The document does not provide any warning that these actions can modify remote projects, trigger builds, or delete resources, which could affect user data and system integrity.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · PUBLISHED.md (reported line 217)May include surrounding context.

md

## 🙏 致谢 | Credits

- **OBS API 文档** - https://api.opensuse.org/apidocs/index
- **openSUSE 社区** - https://opensuse.org
- **ClawHub** - https://clawhub.com
- **OpenClaw** - https://openclaw.ai

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 369)May include surrounding context.

md

## 🙏 致谢 | Credits

- **OBS API 文档** - https://api.opensuse.org/apidocs/index
- **openSUSE 社区** - https://opensuse.org
- **ClawHub** - https://clawhub.com
- **OpenClaw** - https://openclaw.ai

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SETUP.md (reported line 247)May include surrounding context.

md

## 🙏 致谢 | Credits

- **OBS API 文档** - https://api.opensuse.org/apidocs/index
- **openSUSE 社区** - https://opensuse.org
- **ClawHub** - https://clawhub.com
- **OpenClaw** - https://openclaw.ai

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 484)May include surrounding context.

md

## 🙏 致谢 | Credits

- **OBS API 文档** - https://api.opensuse.org/apidocs/index
- **openSUSE 社区** - https://opensuse.org
- **ClawHub** - https://clawhub.com
- **OpenClaw** - https://openclaw.ai

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file includes commands that create, accept, reject, revoke, delete, rebuild, and upload resources in OBS, which can affect project state and published packages. While the README documents how to use these commands, it does not provide an explicit caution that they modify remote server state or may be hard to undo, which is the kind of user-facing warning required for markdown descriptions of impactful behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup instructions tell users to export or embed long-lived API credentials directly in shell configuration and shell commands, but do not warn that those values can be captured in shell history, terminal scrollback, backups, or dotfile syncing. This creates a realistic secret-handling weakness even though the document is a legitimate configuration guide.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This is a duplicate instance of the same plaintext credential persistence pattern: the instructions create a reusable on-disk auth file holding the API token. The danger is not malicious behavior by the skill, but normalization of long-term secret storage without discussing safer alternatives or operational precautions.

Content

Scanner excerpt · SETUP.md (reported line 65)May include surrounding context.

bash

# 创建配置目录
mkdir -p ~/.config/osc

# 创建配置文件（替换 YOUR_USERNAME 和 YOUR_API_TOKEN）
cat > ~/.config/osc/oscrc << 'EOF'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This is a duplicate instance of the same plaintext credential persistence pattern: the instructions create a reusable on-disk auth file holding the API token. The danger is not malicious behavior by the skill, but normalization of long-term secret storage without discussing safer alternatives or operational precautions.

Content

Scanner excerpt · SETUP.md (reported line 65)May include surrounding context.

bash

# 创建配置目录
mkdir -p ~/.config/osc

# 创建配置文件(替换 YOUR_USERNAME 和 YOUR_API_TOKEN)
cat > ~/.config/osc/oscrc << 'EOF'

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SETUP.md (reported line 78)May include surrounding context.

EOF

设置文件权限（仅自己可读）

chmod 600 ~/.config/osc/oscrc

text

---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SETUP.md (reported line 226)May include surrounding context.

EOF

设置文件权限（仅自己可读）

chmod 600 ~/.config/osc/oscrc

text

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill prominently documents destructive and state-changing operations such as create/delete project, create/delete package, accept/reject requests, file deletion, and permission changes, but it does not include explicit safety guardrails such as confirmation requirements, scope validation, dry-run guidance, or warnings about irreversible effects. In an agent setting, this increases the risk that a model or user will invoke impactful OBS actions directly against real infrastructure, causing accidental deletion, unauthorized publication changes, or disruption of build and package workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The authentication helper uses OBS username/token credentials and cookie-based auth sourced from local configuration, but there is no user-facing notice or comment warning that credentials will be read and sent on outbound API requests. For code files, network operations transmitting authentication material should have some visible disclosure unless clearly covered by the skill description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The library exposes project deletion via a direct DELETE API call, and similar destructive operations appear elsewhere in the file, but there is no confirmation prompt, warning print, or inline comment specifically disclosing the destructive effect at the call sites. For a code file, irreversible deletion operations should have some visible user disclosure unless clearly warned elsewhere in the skill description, which is not present in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script writes the OBS username and API token in plaintext to ~/.config/osc/oscrc without clearly warning the user that a reusable secret is being stored unencrypted on disk. While this may be common for some CLI tools, the absence of an explicit warning and safer alternatives can lead users to underestimate the sensitivity of the stored token.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/obs-expert-setup.sh (reported line 132)May include surrounding context.

sh

EOF
    
    # 设置权限
    chmod 600 "$OBS_CONFIG_FILE"
    
    echo_success "配置文件已创建 | Configuration file created: $OBS_CONFIG_FILE"
    echo_success "文件权限已设置为 600（仅用户可读）| File permissions set to 600 (user read-only)"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script appends the OBS username and API token directly into ~/.bashrc or ~/.zshrc, creating long-lived plaintext secrets in a shell startup file. This increases exposure through backups, accidental disclosure, shell dotfile sharing, local file reads by other processes running as the same user, and operational leakage when users inspect or publish their shell config.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SETUP.md (reported line 224)May include surrounding context.

问题：权限错误 | Issue: Permission Error

确保配置文件权限正确 | Ensure config file permissions:

bash

chmod 600 ~/.config/osc/oscrc

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The inline documentation at L015 says the configuration is read from oscrc, and the surrounding authentication section suggests oscrc-based auth behavior. However, the actual auth logic at L025-L029 first supports direct credentials from OBS_USERNAME and OBS_TOKEN, which is a materially different authentication path than the nearby documentation implies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The checkout helper parses remote-controlled filenames and writes them directly under the chosen output directory using shell redirection. Because filenames are not validated or normalized, a malicious or compromised server response could include path traversal sequences or nested paths, causing writes outside the intended directory or overwriting local files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code sets the config file mode to 600 at L132, which allows the owner to both read and write the file. The success message at L135 states this means 'user read-only,' which contradicts the actual permission semantics and could mislead users about how the credential file is protected.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.