NginxWebUI Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:01 AM UTC
• Version: 1.2.0

Overview

This is a real NginxWebUI admin helper, but it handles powerful credentials and live proxy changes too broadly for automatic installation.

Review before installing. Only use this in a tightly controlled workspace with trusted local users, rotate NginxWebUI credentials after testing, and avoid storing the admin token in a shared .env file. Treat delete and reload commands as live infrastructure changes that need backup or confirmation outside the skill.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/manage.py:11

Finding

Overbroad Access to a Shared Credential File and Insecure Plaintext Token Persistence

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/manage.py:65

Finding

Administrative Password and API Token Exposed Through Process Arguments

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Saving an API token to a .env file is a credential-handling weakness because .env files are commonly readable by local users, captured in backups, or accidentally committed to version control. In this skill's context, the stored token appears to authorize administrative NginxWebUI actions, so compromise of the file could directly enable unauthorized proxy reconfiguration or service disruption.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

Authentication

bash

# First time — get token and save to .env
python3 {{SKILL_DIR}}/scripts/manage.py --mode login

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The script automatically loads secrets from a hard-coded workspace .env file, which is a form of credential access and secret material handling inside a broadly callable agent skill. In this context, the skill manages infrastructure and runs with Docker access, so reading shared workspace secrets increases the blast radius if the skill is misused or the workspace is multi-tenant.

Content

Scanner excerpt · scripts/manage.py (reported line 10)May include surrounding context.

python

import json, os, re, subprocess, sys, urllib.parse
from datetime import datetime, timezone, timedelta

# Auto-load .env from workspace root
_env_path = '/home/node/.openclaw/workspace/liyj/.env'
if os.path.isfile(_env_path):
    with open(_env_path) as _f:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Opening and parsing the hard-coded .env file directly exposes the skill to credential harvesting from the workspace. Because this skill can modify and reload NginxWebUI configuration, coupling infrastructure control with direct secret-file access materially increases the impact of abuse.

Content

Scanner excerpt · scripts/manage.py (reported line 11)May include surrounding context.

python

from datetime import datetime, timezone, timedelta

# Auto-load .env from workspace root
_env_path = '/home/node/.openclaw/workspace/liyj/.env'
if os.path.isfile(_env_path):
    with open(_env_path) as _f:
        for _line in _f:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

Persisting the API token back into the shared .env file stores an active authentication token in plaintext on disk. This creates a durable secret that other processes, users, or tools with workspace access may read and reuse to manipulate NginxWebUI and reload production proxy configuration.

Content

Scanner excerpt · scripts/manage.py (reported line 44)May include surrounding context.

python

token, _ = raw_api("POST", "/token/getToken", data=f"name={USER}&pass={PASS}")
    if token:
        os.environ["NGINXWEBUI_TOKEN"] = token
        # Persist to .env
        env_file = "/home/node/.openclaw/workspace/liyj/.env"
        with open(env_file) as f:
            content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

Referencing the shared .env path as the sink for token persistence confirms that credentials are written into a common workspace file rather than a protected secret store. In an agent skill environment, this is especially dangerous because other skills or users in the workspace may gain access to reusable infrastructure credentials.

Content

Scanner excerpt · scripts/manage.py (reported line 45)May include surrounding context.

python

if token:
        os.environ["NGINXWEBUI_TOKEN"] = token
        # Persist to .env
        env_file = "/home/node/.openclaw/workspace/liyj/.env"
        with open(env_file) as f:
            content = f.read()
        if "NGINXWEBUI_TOKEN=" in content:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

This second login implementation also writes the authentication token into the same hard-coded .env file, reinforcing the plaintext credential storage issue. The duplication suggests the behavior is built into the normal workflow, making credential leakage likely rather than exceptional.

Content

Scanner excerpt · scripts/manage.py (reported line 112)May include surrounding context.

python

token = extract_token(resp)
    if token:
        os.environ["NGINXWEBUI_TOKEN"] = token
        env_file = "/home/node/.openclaw/workspace/liyj/.env"
        with open(env_file) as f:
            content = f.read()
        if "NGINXWEBUI_TOKEN=" in content:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill exposes sensitive capabilities including shell, network, environment-variable access, and file writes, yet declares no explicit tool scope or permission boundaries. In an agent setting, this increases the chance of overbroad execution and misuse, especially because the documented workflow includes Docker access and secret handling, which can enable host-level impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly describes storing authentication tokens in environment variables and a .env file without any security warning, which can lead to credential exposure through logs, process inspection, backups, or accidental commits. Since the token grants administrative API access to NginxWebUI, leakage could enable unauthorized configuration changes and service compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documents nginx validation and reload operations without warning about service disruption, invalid configuration rollout, or production impact. In practice, an operator or agent could trigger a reload at the wrong time or after unsafe changes, causing outages or failed deployments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Documenting delete-server and delete-location commands without emphasizing irreversibility or backup requirements creates a real risk of accidental destructive changes. Because these commands modify reverse proxy configuration, misuse can break routing, disable applications, or expose services unintentionally.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/manage.py (reported line 75)May include surrounding context.

python

cmd.extend(["-d", data])

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
        output = result.stdout.strip()
        if not output:
            return None, False

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

delete_server performs an irreversible destructive action immediately from a supplied ID with no confirmation prompt, dry-run mode, or safety flag. In an agent skill that can be triggered programmatically, this increases the chance of accidental or unauthorized deletion of reverse proxy configuration and service disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

delete_location deletes configuration objects with no confirmation or warning, making accidental execution easy in automation or agent-driven use. Removing a location can break routing or expose unintended backend behavior, resulting in outage or misconfiguration.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/manage.py (reported line 343)May include surrounding context.

python

def main():
    # Check docker & nginxwebui container
    ps = subprocess.run(["docker", "ps", "--format", "{{.Names}}"],
                        capture_output=True, text=True, timeout=5)
    if "nginxwebui" not in ps.stdout:
        log("❌ NginxWebUI container not found or Docker socket unavailable")

Static analysis

No suspicious patterns detected.