Security audit

Xdrop

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Xdrop file-transfer helper, but its downloader trusts server-controlled URLs and filesystem paths enough to create review-worthy network and overwrite risks.

Install only if you trust the Xdrop server or share links you will use, and choose fresh output directories that other local users or processes cannot pre-populate. This does not appear malicious, but the implementation should be reviewed before use in sensitive networks or shared workspaces.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/download.mjs:43
Finding: Unrestricted Server-Controlled URL Fetching Enables SSRF
Content: View full analysis
[item.chunkIndex, item.url])) const noncePrefix = fromBase64Url(file.noncePrefix) const fileHandle = await open(destination, 'w') try { for (let chunkIndex = 0; chunkIndex < file.totalChunks; chunkIndex += 1) { const url = urlMap.get(chunkIndex) if (!url) { throw new Error(`Missing download URL for ${file.relativePath} chunk ${chunkIndex}.`) } const response = await fetch(url) ``` ### Technical Analysis The downloader obtains `manifestUrl` and individual chunk URLs from the selected Xdrop API server and passes them directly to `fetch`. It does not constrain the URL scheme, hostname, port, resolved IP address, or redirect destination. Consequently, a malicious or compromised Xdrop server can cause the process to issue HTTP requests to destinations other than the server the user selected. Potential targets include loopback services, private network hosts, link-local endpoints, and cloud instance metadata services. The fetched content is subsequently treated as encrypted transfer data, and decryption should normally fail for unrelated responses. This limits direct ...[truncated 1561 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/download.mjs:56
Finding: Symlink-Following Output Writes Can Escape the Destination Directory
Content: View full analysis
[item.chunkIndex, item.url])) const noncePrefix = fromBase64Url(file.noncePrefix) const fileHandle = await open(destination, 'w') ``` ### Technical Analysis The downloader sanitizes lexical path components, removing `.` and `..`, but it does not verify the actual filesystem objects represented by those components. The calculated path can therefore remain lexically beneath `outputRoot` while resolving through an existing symbolic link to a location outside that directory. The call to `open(destination, 'w')` follows a symbolic link at the final path and truncates its target. Intermediate directories can also be symbolic links because neither `mkdir` nor `open` establishes that every existing path component is a real directory beneath the intended output root. This creates both a pre-positioned symlink attack and a time-of-check/time-of-use race if ...[truncated 1500 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.
md
- `scripts/upload.mjs` — Upload local files or directories to an Xdrop server and print the share link

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
md
- `scripts/upload.mjs` — Upload local files or directories to an Xdrop server and print the share link

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
- `scripts/upload.mjs` — Upload local files or directories to an Xdrop server and print the share link

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
- `scripts/upload.mjs` — Upload local files or directories to an Xdrop server and print the share link

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
- `scripts/upload.mjs` — Upload local files or directories to an Xdrop server and print the share link

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
- `scripts/download.mjs` — Download an Xdrop share link, decrypt it locally, and save the files

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
- `scripts/download.mjs` — Download an Xdrop share link, decrypt it locally, and save the files

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
- `scripts/download.mjs` — Download an Xdrop share link, decrypt it locally, and save the files

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
- `scripts/download.mjs` — Download an Xdrop share link, decrypt it locally, and save the files

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
md
- `scripts/download.mjs` — Download an Xdrop share link, decrypt it locally, and save the files

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/download.mjs:102

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/upload.mjs:191