Skill Trust Decision
perkoon-transfer
The perkoon-transfer skill enables third-party P2P file transfers through perkoon.com with declared but risky mechanisms: shell:WRITE (npx background processes), unverified network:READ (A2A to perkoon.com/a2a), and curl|node remote script execution for browser automation.
Most direct threat evidence
High Supply Chain
Remote script execution without integrity verification Browser automation method (Method 4) instructs agents to download and execute remote JavaScript files: curl https://perkoon.com/perkoon_send.mjs > send.mjs && node send.mjs and curl https://perkoon.com/perkoon_receive.mjs > receive.mjs && node receive.mjs. No checksums, hashes, or versioned content hashes are provided, allowing arbitrary code changes on perkoon.com at any time.
SKILL.md:315 Why this conclusion was reached
1/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Review
Hidden execution and egress
14 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 0 attack-chain steps and 1 severe findings.
Review
Dependencies and supply chain hygiene
4 dependency or supply-chain issues need attention.
What drove the risk score up
Remote script execution (curl|node) +25
Browser automation downloads perkoon_send.mjs and perkoon_receive.mjs via curl and pipes directly to node, with no integrity verification (checksums, signatures, or pinned content hashes). Warned in docs but still included as a supported method.
Supply chain: unpinned remote scripts +20
Remote .mjs files at perkoon.com/perkoon_send.mjs and perkoon.com/perkoon_receive.mjs can be updated at any time — no content pinning, no hash verification.
Doc-to-code mismatch on data privacy claim +15
SKILL.md states 'Files never touch our servers,' but WebRTC signaling requires session metadata to traverse perkoon.com infrastructure. This is a misleading claim about the actual data flow.
Missing capability declarations in metadata +10
No allowed-tools mapping declares network:READ for A2A HTTP requests to perkoon.com/a2a or filesystem:WRITE for saving received files. These are declared in prose but not formally mapped.
Most important evidence
High Supply Chain
Remote script execution without integrity verification
Browser automation method (Method 4) instructs agents to download and execute remote JavaScript files: curl https://perkoon.com/perkoon_send.mjs > send.mjs && node send.mjs and curl https://perkoon.com/perkoon_receive.mjs > receive.mjs && node receive.mjs. No checksums, hashes, or versioned content hashes are provided, allowing arbitrary code changes on perkoon.com at any time.
SKILL.md:315 Either pin the exact content hash of the .mjs files, provide the scripts inline, or remove the browser automation method entirely. The CLI and MCP methods are sufficient.
Medium Doc Mismatch
Misleading 'Files never touch our servers' claim
SKILL.md prominently claims 'Files never touch our servers' and 'No accounts. Files never touch our servers.' However, WebRTC P2P requires signaling servers — session metadata (offer/answer SDP, ICE candidates, session codes, sender keys) must traverse perkoon.com's infrastructure to establish the direct connection. While file content may be P2P-encrypted, the signaling data (including session codes and keys) does flow through perkoon.com servers.
SKILL.md:6 Clarify that while file content is P2P-encrypted, session signaling and metadata traverse perkoon.com infrastructure.
Medium Priv Escalation
Incomplete allowed-tools mapping
The skill's metadata declares no allowed-tools, but the implementation requires network:READ (A2A HTTP POSTs to perkoon.com), shell:WRITE (npx background processes, log file I/O), and filesystem:WRITE (save received files). These are documented in prose but not formally mapped as allowed-tools.
SKILL.md:1 Add explicit allowed-tools mapping: WebFetch→network:READ, Bash→shell:WRITE, Write→filesystem:WRITE, Read→filesystem:READ
Low Sensitive Access
Filesystem write to workspace without explicit path confirmation
The CLI receive method defaults to /home/openclaw/.openclaw/workspace/received/ as the save directory. While SKILL.md includes a rule to 'confirm the file path with the user before sending,' the receive path is hardcoded and not user-confirmed.
SKILL.md:149 Allow the user to specify the receive directory or confirm the default path before saving.
Declared capability vs actual capability
Network Pass
Declared NONE
→ Inferred READ
SKILL.md line 204: POST to https://perkoon.com/a2a (A2A method); SKILL.md line 315-316: GET for remote .mjs scripts (browser automation) Shell Pass
Declared NONE
→ Inferred WRITE
SKILL.md lines 91-162: background npx processes, log file polling, PID management Filesystem Pass
Declared NONE
→ Inferred WRITE
SKILL.md line 149: saves received files to /home/openclaw/.openclaw/workspace/received/ Skill Invoke Pass
Declared NONE
→ Inferred NONE
No cross-skill invocations found Suspicious artifacts and egress
Medium External URL
https://perkoon.com SKILL.md:10
Medium External URL
https://perkoon.com/K7MX4QPR9W2N SKILL.md:115
Medium External URL
https://perkoon.com/a2a SKILL.md:204
Medium External URL
https://perkoon.com/.well-known/agent.json SKILL.md:206
Medium External URL
https://perkoon.com/perkoon_send.mjs SKILL.md:315
Medium External URL
https://perkoon.com/perkoon_receive.mjs SKILL.md:316
Medium External URL
https://perkoon.com/create SKILL.md:321
Medium External URL
https://perkoon.com/ SKILL.md:332
Medium External URL
https://perkoon.com/llms.txt SKILL.md:428
Medium External URL
https://perkoon.com/automate SKILL.md:429
Medium External URL
https://www.npmjs.com/package/@perkoon/mcp SKILL.md:430
Medium External URL
https://www.npmjs.com/package/perkoon SKILL.md:431
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| perkoon | 0.4.6 | npm (npx) | No | Pinned. Used for CLI file transfer. |
| @perkoon/mcp | 0.2.2 | npm (npx) | No | Pinned. Used for MCP server tools. |
| perkoon_send.mjs | unversioned | remote URL (perkoon.com) | No | NOT pinned — fetched dynamically via curl. Remote content can change without notice. |
| perkoon_receive.mjs | unversioned | remote URL (perkoon.com) | No | NOT pinned — fetched dynamically via curl. Remote content can change without notice. |
File composition
3 files · 486 lines
Markdown 2 files · 481 linesJSON 1 files · 5 lines
Files of concern · 2
SKILL.md Remote script execution without integrity verification · Misleading 'Files never touch our servers' claim · Incomplete allowed-tools mapping · Filesystem write to workspace without explicit path confirmation · https://perkoon.com · https://perkoon.com/K7MX4QPR9W2N · https://perkoon.com/a2a · https://perkoon.com/.well-known/agent.json · https://perkoon.com/perkoon_send.mjs · https://perkoon.com/perkoon_receive.mjs · https://perkoon.com/create · https://perkoon.com/ · https://perkoon.com/llms.txt · https://perkoon.com/automate · https://www.npmjs.com/package/@perkoon/mcp · https://www.npmjs.com/package/perkoon
skill-card.md https://clawhub.ai/user/alex-vy · https://clawhub.ai/alex-vy/skills/perkoon-transfer
Other files · _meta.json
Security positives
Package versions are pinned: [email protected] and @perkoon/[email protected] — good supply chain hygiene
MCP Server method (Method 1) requires no shell access, no file writes — zero extra permissions
Sensitive directory rule: SKILL.md explicitly forbids sending ~/.ssh, ~/.gnupg, /etc without explicit approval
Password-protected transfers documented: --password flag for WebRTC-encrypted sessions
Rate limits are documented: 10 create/min, 30 join/min, 20 status/min
MIT-0 license — no usage restrictions
No obfuscated code, no base64 execution, no credential harvesting — the skill is pure documentation
Exit codes and JSON event schema are clearly documented