The Agent Skills Directory

[COMMAND_EXECUTION]: Shell command injection vulnerability in scripts/unraid-query.sh. The variables $QUERY, $URL, and $API_KEY are interpolated into a double-quoted string within a curl command inside a subshell. This allows the execution of arbitrary shell commands through shell expansion (e.g., using $(command) or backticks) if the input contains shell meta-characters.\n- [COMMAND_EXECUTION]: The script examples/read-logs.sh is vulnerable to command injection as it takes user-provided arguments and interpolates them directly into a query string that is subsequently passed to the vulnerable unraid-query.sh script.\n- [CREDENTIALS_UNSAFE]: The curl command in scripts/unraid-query.sh uses the -k (or --insecure) flag, which disables SSL/TLS certificate verification. This exposes the Unraid API key and server data to interception via man-in-the-middle (MITM) attacks.\n- [DATA_EXFILTRATION]: The scripts/dashboard.sh script reads sensitive server configuration and credentials from $HOME/.clawdbot/credentials/unraid/config.json and writes detailed system inventories to $HOME/clawd/memory/bank/unraid-inventory.md, posing a risk of unauthorized credential exposure and data collection.\n- [PROMPT_INJECTION]: Vulnerability to indirect prompt injection in examples/read-logs.sh. 1. Ingestion points: User-provided arguments $LOG_NAME and $LINES in examples/read-logs.sh. 2. Boundary markers: Absent. 3. Capability inventory: Shell subprocess execution and network requests via curl in scripts/unraid-query.sh. 4. Sanitization: Absent; input is directly interpolated into a shell-executed query string.

unraid