Security audit

file-sender

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to package and deliver workspace files, but it can trigger delivery without a direct user request and has path and temporary-file weaknesses that could send or affect more than intended.

Review this before installing. It is not artifact-backed malicious, but users should only use it when they are comfortable with generated files being zipped, retained in `.file-outbox/`, and delivered through the Manager service. The skill should require explicit confirmation of the exact path being sent, fix the workspace boundary check, and replace the predictable temporary response file before broad deployment.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/send-files.sh:34
Finding: Workspace Path Boundary Bypass Allows Packaging of Out-of-Scope Files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/send-files.sh:100
Finding: Predictable Shared Temporary File Permits Symlink and Concurrency Attacks
Content: View full analysis
/dev/null) if [ "$HTTP_CODE" = "200" ] || [ "$HTTP_CODE" = "201" ]; then echo "✅ 通知成功！文件将自动发送给用户。" elif [ "$HTTP_CODE" = "409" ]; then echo "✅ 文件已登记 (重复通知)，将自动发送给用户。" else if [ "$HTTP_CODE" = "000" ]; then echo "⚠️ 无法连接到 Manager，文件已安全保存在本地。" else RESP=$(cat /tmp/notify_resp.json 2>/dev/null || echo "无") echo "⚠️ 通知失败 (HTTP $HTTP_CODE): $RESP" fi echo " 系统会自动重试发送，用户最终一定会收到文件。" fi rm -f /tmp/notify_resp.json ``` ### Technical Analysis The script uses the fixed, globally predictable path `/tmp/notify_resp.json` for an HTTP response. Shared temporary directories are commonly writable by other local users and processes. An attacker may create this path as a symbolic link before the script runs. Depending on the behavior and permissions of `curl`, the response write may follow the symbolic link and overwrite or truncate another file writable by the script account. The final `rm -f` also operates on a shared pathname not uniquely owned by the current invocation. The fixed filename additionally creates a race condition between concurrent executions. One invocation may overwrite, read, or delete another invocation's response, causing misleading diagnostics or corrupted state. ### Attack Path 1. A local attacker predicts the fixed temporary path `/tmp/notify_resp.json`. 2. The attacker creates that path as a symbolic link to a file writable by the account running the Skill: ...[truncated 1044 chars]
Remediation: View remediation
/dev/null) RESP=$(cat "$RESP_FILE" 2>/dev/null || printf '%s' "No response") ``` Further hardening should include: 1. Avoid predictable filenames in shared writable directories. 2. Prefer a private runtime directory owned by the script account when available. 3. Retain `set -euo pipefail`, but ensure the cleanup trap is installed immediately after temporary-file creation. 4. Limit the amount of response content printed to prevent excessive or terminal-control output from an untrusted server. 5. Test simultaneous executions to verify that each process uses an independent response file. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill tells the agent to proactively trigger file delivery even when the user did not explicitly ask for delivery. In a file-transfer skill, that is dangerous because it can cause unsolicited packaging, persistence, and manager-mediated exfiltration of workspace artifacts that may contain sensitive data beyond what the user intended to receive.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/send-files.sh (reported line 118)May include surrounding context.
sh
echo " 系统会自动重试发送，用户最终一定会收到文件。" fi rm -f /tmp/notify_resp.json

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly instructs shell execution (bash scripts/send-files.sh, mkdir, cp) but does not declare an explicit tool scope such as allowed shell usage. That creates a governance gap: an agent may invoke powerful local execution without clear permission boundaries, reducing reviewability and increasing the chance of unintended file packaging or command execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Broad trigger phrases like 'export' and 'deliver the files' are ambiguous and can match ordinary requests that do not imply consent to package and transmit local workspace contents. In this context, ambiguity increases the risk of the agent invoking a transfer workflow for the wrong files or without sufficient user intent verification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill emphasizes convenience and automatic retries but does not prominently warn that invocation persists packaged data locally in .file-outbox/ and notifies a manager service to retrieve it. That lack of transparent consent is risky because users may believe this is a local-only packaging operation when it actually creates durable copies and initiates a mediated transfer pipeline.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script consumes injected credentials and uses them for authenticated communication with an external service, despite the skill being described as a local file-packaging utility. This makes the skill capable of acting with delegated service authority, so compromise or misuse of the script can trigger unauthorized notifications, metadata disclosure, or abuse of the file-push channel.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The curl call performs external transmission to a Manager endpoint with an authorization token and file metadata. In the context of a skill advertised as handling local workspace files, this outbound communication is security-relevant because it moves data and control outside the local environment and could be repurposed for covert exfiltration if the endpoint or payload were changed.
Content: Scanner excerpt · scripts/send-files.sh (reported line 95)May include surrounding context.
sh
echo "📤 正在通知 Manager..." # ── 发送轻量通知 (使用实例专属 Token, 非全局 Agent Key) ── HTTP_CODE=$(curl -s -o /tmp/notify_resp.json -w "%{http_code}" \ -X POST "${OPENCLAW_MANAGER_URL}/file-push/v1/instances/${OPENCLAW_INSTANCE_NAME}/file-ready" \ -H "Authorization: Bearer ${OPENCLAW_FILE_PUSH_TOKEN}" \ -H "Content-Type: application/json" \

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill manifest frames this as local file packaging/delivery, but the script also performs an outbound authenticated network notification to a Manager service. Even if no file bytes are sent in this request, it exfiltrates operational metadata and initiates a remote retrieval workflow, which expands the trust boundary beyond local packaging and creates a data-transfer side channel users may not expect.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Although the comments say only metadata is sent, the payload includes a container-internal absolute path to the generated archive. That path reveals internal filesystem structure and directly enables a subsequent pull operation against a specific file location, which is more sensitive than ordinary descriptive metadata.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.