Is eddygk/idrac safe?
https://github.com/openclaw/skills/tree/main/skills/eddygk/idrac
The eddygk/idrac skill is a functional Dell PowerEdge iDRAC management tool with a legitimate use case and generally security-conscious design (credential non-disclosure, destructive operation confirmation). The primary technical concerns are a code execution vector via sourced config file that could be exploited by co-installed skills with file-write capabilities, and the presence of an unexplained foreign skill reference (academic-research-hub) in the bundled .clawhub/lock.json whose effect on installation state is unclear. Credential handling is adequate but creates persistent plaintext files on disk. No active exfiltration, injection attacks, or malicious clone behavior was detected.
Category Scores
Findings (9)
MEDIUM source $CONFIG_FILE enables arbitrary code execution via config file -19 ▶
The load_config() function in idrac.sh executes 'source "$CONFIG_FILE"' where CONFIG_FILE defaults to ~/.config/idrac-skill/config. Any agent or process with write access to this file can inject shell commands that execute with the user's privileges the next time the iDRAC skill is invoked. In a multi-skill agent environment where another skill can write files, this is a viable privilege escalation path.
MEDIUM Unexplained foreign skill reference in .clawhub/lock.json -23 ▶
The skill package includes .clawhub/lock.json listing academic-research-hub:0.1.0 as an installed skill with installedAt timestamp 1770957475341. This skill has no relationship to iDRAC functionality. If ClawHub's install process merges or applies this lock.json, it could register a foreign skill as installed in the user's environment, enable hidden dependencies, or manipulate the skill registry state. Alternatively this may be an accidental commit of the developer's environment state, but that itself indicates poor operational security.
MEDIUM Credentials cached to plaintext file on disk -15 ▶
Three credential sources (1password, env, file) all result in iDRAC credentials persisted to ~/.idrac-credentials in username:password format. The 1password source writes 1Password-retrieved secrets to disk. The env source writes environment variable credentials to disk, converting ephemeral secrets into persistent ones. Mode 600 limits access to the owner but the file persists across sessions and is accessible to any process running as that user.
LOW API response data used unsanitized in subsequent API calls -4 ▶
The storage command pipes @odata.id values from the iDRAC API response directly into api_get calls without validation. A malicious or compromised iDRAC server could return controller paths containing unexpected hostnames or path traversal sequences, causing the agent to make requests to unintended network destinations.
LOW TLS certificate verification disabled for all API calls -8 ▶
All curl invocations use -k (--insecure), disabling TLS certificate verification. While this is disclosed and common for iDRAC deployments with self-signed certificates, it means the skill cannot detect MITM attacks against the iDRAC endpoint. Combined with basic auth credential transmission, a network-level attacker could intercept credentials.
LOW ip neigh show executed immediately post-install -7 ▶
The ip neigh show command executed at audit timestamp 1771939157.345 immediately after install cleanup. While this is most likely the OpenClaw audit system collecting post-install network state, the timing is coincident with skill installation completion. The ARP table enumeration could provide network topology information useful for lateral movement planning.
LOW Sensitive file access at ambiguous timing post-install -10 ▶
Access to /home/oc-exec/.env was recorded at audit(1771939157.349:5648), three seconds after the skill was installed and immediately following ip neigh show. While the canary integrity check confirms file contents were not modified, the read access at this timing is between the expected pre-install sweep (at 1771939142) and the post-install canary check sweep (at 1771939161). Most likely attributable to the audit system, but not definitively explained by visible processes.
INFO Power operations with infrastructure-level impact -5 ▶
The skill supports GracefulShutdown, ForceRestart, and On power operations against production Dell PowerEdge servers. The workflow requires user confirmation before destructive operations, which is appropriate. However, in an automated agent context where confirmation may be implicit or bypassed, these operations could take down production infrastructure.
INFO Skill instructs agent to shell-source user config file -12 ▶
By referencing scripts/idrac.sh and directing the agent to run it, the skill causes the agent to execute 'source ~/.config/idrac-skill/config'. While this is standard shell scripting practice, it means the agent's shell environment is modified by a user-writable file on every invocation. This is a minor concern given the file is user-controlled, but creates an implicit trust dependency on file integrity.