Remote Disk Mount

远程磁盘挂载工具，支持 SMB/CIFS、FTP、SFTP、WebDAV 协议挂载远程共享到本地目录。当用户需要：(1) 挂载 Windows/Samba 共享，(2) 挂载 FTP/SFTP 服务器，(3) 挂载 WebDAV 存储，(4) 将远程存储映射为本地磁盘使用时触发此技能。

This skill appears to do what it says, but mounting remote storage requires root actions and careful handling of credentials. Before using: confirm you're on Debian/Ubuntu; prefer SSH keys for SFTP; avoid placing long-lived plaintext credential files under /root (delete immediately after use or store securely with strict permissions); prefer user-space FUSE mounts when possible to limit root exposure; verify the remote server is trusted (malicious servers can attack clients via filesystem content); double-check mount-point paths and uid/gid options; and do not paste plaintext passwords into the chat. If you need higher assurance, run these commands manually or in a sandboxed VM and inspect any credential files before deleting them.

Type: OpenClaw Skill Name: remote-disk-mount Version: 0.4.0 The skill aims to mount remote disks, which inherently involves privileged operations and handling user credentials. While the SKILL.md provides explicit security guidelines and a checklist for the agent to follow (e.g., user confirmation for sudo, deleting sensitive credential files), the SMB mounting method instructs the agent to write user-provided passwords to `/root/.smbcredentials` using `sudo tee`. Although `chmod 600` is applied and deletion is instructed, this temporary storage of credentials in a privileged location, combined with the use of `sudo apt install -y` and the general risks of mounting untrusted remote storage, presents a vulnerability if the agent fails to strictly adhere to the security instructions. There is no evidence of intentional malicious behavior like data exfiltration or backdoors, but the credential handling and privileged operations elevate it beyond benign.