ClawHub
Back to skill

Security audit

Xunlei

Security checks for vulnerabilities and agentic risk

Overview

This Xunlei guide is mostly explanatory, but its NAS Docker command grants a third-party container broad host-level access without enough warning or scoping.

Review this skill carefully before installing or following its NAS setup. The general download guidance is ordinary, but do not run the provided Docker command as-is on a NAS. Prefer a pinned and verified image digest, bridge networking with only the needed port published, no privileged mode unless the image documents a specific requirement, a dedicated non-root user, narrowly scoped writable volumes, and explicit firewall/authentication controls for the web interface.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:79
Finding

Container Deployed with Excessive Host Privileges

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:79
Finding

Unpinned Third-Party Container Image Creates a Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

--net host places the container directly on the host network stack, bypassing normal network namespace isolation and increasing exposure of host services and ports. If the application is vulnerable or misconfigured, attackers may gain easier lateral visibility or access to services on the NAS and LAN.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

bash
docker run -d --name xunlei \
  --hostname mynas \
  --net host \
  -v /path/to/downloads:/xunlei/downloads \
  -v /path/to/data:/xunlei/data \
  --restart unless-stopped \

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

--privileged gives the container near-host-level capabilities, substantially weakening container isolation and making breakout or host tampering far easier if the image is compromised or the application is exploited. This is especially dangerous in a NAS environment where the container also has mounted storage and may handle untrusted content and network input.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

-v /path/to/downloads:/xunlei/downloads
-v /path/to/data:/xunlei/data
--restart unless-stopped
--privileged
cnk3x/xunlei:latest

text
- 访问 `http://NAS_IP:2345` 进入 Web 管理界面

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill provides copy-paste Docker deployment instructions that include high-risk options (--privileged and host networking) without clearly warning about the resulting host exposure. In a NAS/home-server context, users are likely to run this as-is, potentially granting a third-party container broad access to the host and adjacent services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.