Li Base Scan

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:01 AM UTC
• Version: 0.0.2

Overview

This is a real security scanning skill, but it needs review because it can scan the local root filesystem for secrets, run intrusive/evasive scans, and write reports to unsafe paths.

Install only if you are comfortable granting a scanner broad local and network authority. Run it as an unprivileged user, scan only systems you own or are explicitly authorized to test, avoid stealth mode and sqlmap on production without written approval, do not follow the curl | sh Trivy install line, and avoid using caller-supplied HTML report paths until report writing is constrained and escaped.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:240
• Finding: Mutable Remote Installation Script Is Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:240` and `SKILL.md:481` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh ``` ### Technical Analysis The installation instructions download a shell script from the mutable `main` branch of an external GitHub repository and immediately execute it. The script is not pinned to a release or commit, saved for inspection, or validated using a cryptographic checksum or signature. Although the URL currently belongs to the official Aqua Security Trivy repository, the effective executable payload can change after this Skill has been reviewed. Compromise of the upstream repository, maintainer account, release process, or network trust chain could therefore convert this installation command into arbitrary local code execution. The `-s` option also suppresses normal curl output, reducing the visibility of retrieval failures or unexpected behavior. Piping directly to `sh` prevents the operator from reviewing the retrieved content before execution. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or another component of the script-delivery chain. 2. The attacker modifies `contrib/install.sh` on the referenced mutable branch. 3. A user or agent follows the Skill installation instructions. 4. `curl` retrieves the attacker-controlled script. 5. The pipe passes the content directly to `sh`. 6. The payload executes with all privileges held by the user running the installation command. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking account. Because the surrounding dependency installation instructions use system package-management commands and may be followed from an administrative shell, the payload could execute with root privileges. Potential consequences ...[truncated 177 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not pipe network responses directly into a shell. 2. Install Trivy through a trusted operating-system package repository where possible. 3. If a release artifact must be downloaded, pin it to a specific immutable version. 4. Download the artifact separately and verify its published SHA-256 checksum or cryptographic signature before execution. 5. Store the verified file locally so that operators can inspect it before running it. 6. Execute installation with the least-privileged account possible and elevate only the specific operation that requires administrative access. A safer workflow is: ```bash curl -fL -o trivy-install.sh "https://raw.githubusercontent.com/aquasecurity/trivy/<PINNED_COMMIT>/contrib/install.sh" printf '%s %s\n' '<EXPECTED_SHA256>' 'trivy-install.sh' | sha256sum --check - less trivy-install.sh sh trivy-install.sh ``` ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/li_base_scan.py:703
• Finding: Full and Compliance Scans Inspect the Entire Root Filesystem for Secrets<![CDATA[ ## Vulnerability Details **File Location**: `scripts/li_base_scan.py:578-579` and `scripts/li_base_scan.py:703` **Vulnerability Type**: Excessive filesystem access and secret discovery **Risk Level**: High ### Vulnerable Code ```python cmd = [tool_path, "fs", "--scanners", "vuln,secret,config,misconfig", "-f", "json", "-o", temp_file, target] ``` ```python if "trivy" in tools: if progress: progress.update(0, "trivy filesystem scan...") results["tools"]["trivy"] = run_trivy("/") if progress: progress.update(1) ``` ### Technical Analysis The `full` and `compliance` modes invoke Trivy against `/` and enable vulnerability, secret, configuration, and misconfiguration scanners. This recursively inspects every file accessible to the process, rather than limiting analysis to a user-selected project, image, or application directory. When the Skill runs with administrative privileges, the scan can access unrelated users' home directories, service configuration, application credentials, private deployment files, and other sensitive system locations. This exceeds the minimum access required for the declared dependency and container-security functionality. The implementation only includes secret rule identifiers and severities in its parsed result, rather than secret values. No code was found that exfiltrates those results to an external service. Nevertheless, the broad read scope exposes sensitive metadata to the Skill and creates unnecessary privacy, performance, and availability risks. ### Attack Path 1. A user requests a `full` or `compliance` scan. 2. The selected mode includes Trivy. 3. `run_scan()` calls `run_trivy("/")` without requesting explicit authorization for a system-wide scan. 4. Trivy recursively reads files throughout the root filesystem that are accessible to the current process. 5. Secret locations, package information, and security configuration findings are written to a temporary JSON file and pars ...[truncated 655 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default Trivy scans to the current project or another explicitly supplied directory. 2. Add a required `--scan-path` argument for filesystem scans. 3. Reject `/`, `/home`, and other broad sensitive paths unless the user provides explicit confirmation. 4. Disable the secret scanner by default and require a separate opt-in option such as `--scan-secrets`. 5. Add exclusions for virtual and sensitive filesystems, including `/proc`, `/sys`, `/dev`, `/run`, credential stores, and unrelated users' home directories. 6. Run Trivy under a dedicated unprivileged account. 7. Clearly disclose the exact filesystem scope before starting a scan. 8. Apply resource controls and limits to avoid production performance degradation. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/entrypoint.py:132
• Finding: Caller-Controlled HTML Report Path Allows Arbitrary File Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `scripts/entrypoint.py:132-138` and `scripts/html_reporter.py:465-469` **Vulnerability Type**: Arbitrary file overwrite **Risk Level**: High ### Vulnerable Code ```python if html_report: report_path = html_report else: safe_target = target.replace('/', '_').replace(':', '_') report_path = f"/tmp/scan_report_{safe_target}.html" reporter = HTMLReporter(scan_results) reporter.save(report_path) ``` ```python def save(self, output_path: str) -> str: """Save report to file.""" html = self.generate() with open(output_path, 'w', encoding='utf-8') as f: f.write(html) return output_path ``` ### Technical Analysis The entrypoint accepts `html_report` directly from caller-supplied JSON and passes it to `HTMLReporter.save()`. The path is not confined to a report directory and is not checked for absolute paths, parent-directory traversal, symbolic links, or existing files. Python's `open(..., 'w')` truncates an existing file before writing. Consequently, any file writable by the Skill process can be replaced with generated HTML. Symbolic links are followed normally, so an attacker may also target a protected destination indirectly when process permissions allow it. The subprocess command itself is constructed as an argument list, so this issue is not shell command injection. It is a filesystem authorization and path-validation flaw. ### Attack Path 1. An attacker or untrusted caller invokes `entrypoint.py` with valid JSON. 2. The JSON contains `"format": "html"` and an attacker-selected `"html_report"` path. 3. The scan completes successfully. 4. The entrypoint passes the unvalidated path to `HTMLReporter.save()`. 5. `open(path, "w")` follows any symbolic link and truncates the destination. 6. Generated HTML replaces the targeted writable file. ### Impact Assessment The attacker can overwrite any file writable by the process. Under a normal account, this can corrupt user co ...[truncated 399 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store all reports in a dedicated application-controlled directory with mode `0700`. 2. Accept only a filename, not an arbitrary path. 3. Resolve the final path and verify that it remains inside the approved report directory. 4. Reject absolute paths, parent-directory traversal, path separators, and invalid extensions. 5. Create files using exclusive and symlink-resistant flags such as `O_CREAT | O_EXCL | O_NOFOLLOW`. 6. Create report files with mode `0600`. 7. Refuse to overwrite an existing report unless the user explicitly requests replacement. 8. Run the Skill without administrative privileges. Example containment logic: ```python base = Path.home() / ".openclaw" / "reports" base.mkdir(parents=True, mode=0o700, exist_ok=True) name = Path(requested_name).name if not name.endswith(".html"): raise ValueError("Only HTML report filenames are allowed") destination = (base / name).resolve() if destination.parent != base.resolve(): raise ValueError("Invalid report path") ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/html_reporter.py:229
• Finding: Unescaped Scan Results Permit Stored HTML Injection in Generated Reports<![CDATA[ ## Vulnerability Details **File Location**: `scripts/html_reporter.py:229`, `scripts/html_reporter.py:264`, `scripts/html_reporter.py:330`, and `scripts/html_reporter.py:356-361` **Vulnerability Type**: Stored HTML injection and cross-site scripting **Risk Level**: Medium ### Vulnerable Code ```python ports_rows += f"<tr><td>{port}</td><td>{service}</td><td>{version}</td></tr>" ``` ```python findings_html += f"<div class='finding'><div class='finding-title'>⚠️ {finding}</div></div>" ``` ```python vulns_rows += f"<tr><td><span class='severity-badge' style='background:{color}'>{severity}</span></td><td>{vid}</td><td>{title}</td><td>{pkg}</td></tr>" ``` ```python for w in warnings[:10]: warnings_html += f"<div class='finding vulnerability'><div class='finding-title'>⚠️ {w}</div></div>" suggestions_html = "" if suggestions: for s in suggestions[:10]: suggestions_html += f"<div class='finding'><div class='finding-title'>💡 {s}</div></div>" ``` ### Technical Analysis The reporter interpolates dynamic values directly into HTML without escaping them. These values include service versions, Nikto findings, vulnerability titles, package names, Lynis warnings, and Lynis suggestions. Several of these values may originate from a scanned host. For example, a malicious network service can return a crafted service banner, and a web application can influence scanner findings. If such text contains HTML elements or event handlers, the reporter writes it verbatim into the generated document. When the report is opened in a browser, the injected markup can execute in the local report's browser context. The current entrypoint and reporter use partially inconsistent result schemas, which may prevent some fields from rendering through that specific path, but `HTMLReporter` is independently callable and the unsafe rendering logic remains exploitable when matching result data is supplied. ### Attack Path 1. An attacker controls a host or web service ...[truncated 980 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. HTML-escape every dynamic value before interpolation. 2. Use `html.escape(str(value), quote=True)` for targets, service data, findings, package names, warning text, and suggestion text. 3. Prefer a template engine with automatic escaping enabled. 4. Validate severity values against a strict allowlist before using them in classes or styles. 5. Add a restrictive Content Security Policy that disallows inline scripts and remote resources. 6. Add tests containing payloads such as `<script>`, `<img onerror>`, quotes, and malformed tags to verify safe encoding. 7. Keep report files local and avoid serving them from a privileged authenticated origin. Example: ```python from html import escape safe_port = escape(str(port), quote=True) safe_service = escape(str(service), quote=True) safe_version = escape(str(version), quote=True) ports_rows += ( f"<tr><td>{safe_port}</td>" f"<td>{safe_service}</td>" f"<td>{safe_version}</td></tr>" ) ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:511
• Finding: Documented Production Safety Option Is Not Implemented<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:511` and `scripts/li_base_scan.py:1095-1112` **Vulnerability Type**: Misleading or missing security control **Risk Level**: Medium ### Vulnerable Documentation ```text Use --safe-mode in production to avoid destructive testing ``` ### Implemented Argument Parser ```python parser.add_argument('target', nargs='?', help='Target IP, domain, or URL') parser.add_argument('--mode', '-m', default='standard', choices=list(SCAN_MODES.keys()), help='Scan mode') parser.add_argument('--conversation', '-c', help='Natural language input') parser.add_argument('--json', '-j', action='store_true', help='Output JSON') parser.add_argument('--timeout', '-t', type=int, default=300, help='Timeout per tool (seconds)') parser.add_argument('--export', '-e', choices=['markdown', 'json'], help='Export report to file') parser.add_argument('--history', action='store_true', help='Show scan history') parser.add_argument('--no-progress', action='store_true', help='Disable progress bar') ``` ### Technical Analysis The Skill documentation instructs production users to enable `--safe-mode` to avoid destructive testing, but the command-line parser contains no such option. Supplying the documented option therefore causes an argument-parsing error rather than enabling a restricted scan profile. This creates a false security assurance around active tools such as Nikto and SQLMap. Although SQLMap is configured with a low risk value, it still performs active HTTP tests and form discovery. The documented protection cannot be relied upon because it does not exist in the implementation. ### Attack Path 1. An operator plans a production scan and relies on the documented `--safe-mode` control. 2. The operator invokes the scanner with that option. 3. The argument parser rejects the unknown option. 4. To complete the s ...[truncated 491 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Implement a real `--safe-mode` option or remove the documentation claim. 2. In safe mode, disable SQLMap, aggressive Nikto tuning, operating-system detection, SYN fragmentation, and other intrusive probes. 3. Reduce request rates, thread counts, retries, and scan timeouts. 4. Require explicit confirmation before enabling SQL injection tests or stealth/evasion profiles. 5. Display the exact commands and tests that will run before starting a production scan. 6. Add automated tests confirming that `--safe-mode` is recognized and excludes all active or potentially state-changing operations. 7. Document that even a safe scan requires explicit authorization from the target owner. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documentation claims hardened implementation, single-host enforcement, secure temp file handling, scan history, export, and real tool integrations, but the analyzed content does not substantiate those controls. This mismatch is dangerous because users and upstream agents may rely on non-existent safeguards, causing unsafe execution decisions, over-trust, or accidental misuse of a scanning skill that lacks the promised restrictions.

Chaining Abuse

High

• Category: Tool Misuse

Content

apt-get install -y nmap lynis nikto sqlmap

# trivy安装
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh
```

### 使用建议

• Confidence: 98% confidence
• Finding: The pipe into sh is a classic command-chaining abuse pattern that collapses download and execution into one step, eliminating opportunities for validation. If a malicious or altered script is served, the command immediately executes arbitrary instructions, potentially compromising the scanner host and any data it can access.

Chaining Abuse

High

• Category: Tool Misuse

Content

apt-get install -y nmap lynis nikto sqlmap

# Install trivy
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh
```

### Usage Recommendations

• Confidence: 98% confidence
• Finding: The same download-to-shell chain is present in the English section, creating a repeat arbitrary-code-execution risk. Because this is guidance embedded in the skill, it may be copied verbatim by operators or downstream agents and lead to unsafe automated setup.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill is described as SINGLE HOST ONLY, but in full/compliance flows it runs Trivy against '/', which scans the entire local filesystem, including secrets, configs, and software inventory unrelated to the requested host. In an agent context this broadens scope from remote host assessment to host-wide local data access, increasing privacy and data-exposure risk far beyond the declared purpose.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and documents capabilities that imply shell execution, network scanning, file reads/writes, and logging/export, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope declarations can let a broadly-triggered skill access powerful capabilities without clear operator review, increasing the chance of unauthorized scanning, filesystem access, or command execution.

Ssd 2

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly markets a stealth/slow mode as a way to avoid IDS/IPS detection, which is evasive operational guidance rather than neutral defensive scanning language. This makes the skill more dangerous because it normalizes attacker-useful behavior and could facilitate covert reconnaissance if the skill is exposed in a multi-user or weakly governed environment.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: Overly broad trigger phrases like generic system-check or baseline-scan requests can cause the skill to activate without a clearly specified target, mode, or authorization context. In a security-scanning skill with shell and network capabilities, ambiguous invocation increases the risk of accidental scans, unintended local probing, or unsafe default behavior.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: Generic follow-up phrases such as asking what vulnerabilities were found or requesting repair advice can let the skill continue or steer a scanning workflow without a fresh, explicit scan context. In conversational agent systems this can lead to context confusion, reuse of stale targets, or unintended continuation of sensitive security operations.

Ssd 2

Medium

• Confidence: 93% confidence
• Finding: The English section repeats commands and descriptions centered on avoiding IDS/IPS detection, reinforcing evasive use across audiences. Duplicating this framing increases the chance of misuse and suggests the capability is intentionally designed for operational stealth rather than purely defensive assessment.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: This file emits user-facing error text in Chinese, and the same pattern continues throughout the script. Because the skill does not provide a language-selection mechanism or document a justified locale restriction, it violates the language/locale policy for natural-language behavior.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill advertises SINGLE HOST ONLY, but the entrypoint forwards the target string without enforcing that constraint. In a security-scanning tool context, an attacker or careless user could supply ranges, CIDR blocks, multiple hosts, or scanner-specific target expressions, causing broader-than-intended scanning and potentially unauthorized network activity.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Execute scan
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout + 60)
        
        if result.returncode == 0:
            if output_format == "html":

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: When html_report is not provided, the code writes to a predictable filename under /tmp derived from user-controlled target data. Predictable paths in a world-writable directory can enable symlink or race-condition attacks, allowing overwrite of unintended files or disclosure/corruption of report data if the process runs with elevated privileges.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The generated HTML explicitly sets the document language to zh-CN and uses Chinese-only titles and labels throughout the report, effectively forcing a specific language/locale. The policy allows locale constraints only when users can opt in or when the constraint is clearly documented and justified, neither of which appears in this file.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module branding says 'Linux Security Baseline Scanner', but the implementation also performs web scanning, SQL injection testing, and full local filesystem secret/vulnerability scanning. This scope mismatch is dangerous because users and higher-level agents may grant broader capabilities than they realize, undermining informed consent and least-privilege assumptions.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: Many user-facing strings, scan mode descriptions, progress messages, errors, and reports are hardcoded in Chinese, while the CLI and skill do not provide any language-selection mechanism. This forces a specific language/locale on users without opt-in, which matches the stated natural-language policy violation criteria.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The stealth profile enables SYN scan fragmentation and host randomization behaviors associated with evasion rather than ordinary baseline assessment. This makes the skill more dangerous in context because it introduces concealment-oriented scanning features not justified by the stated defensive purpose.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run(cmd: List[str], timeout: int = 300, capture_output: bool = True) -> Tuple[int, str, str]:
        """Run command with secure timeout handling."""
        try:
            proc = subprocess.Popen(
                cmd,
                stdout=subprocess.PIPE if capture_output else None,
                stderr=subprocess.PIPE if capture_output else None,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def check_tool(tool: str) -> Tuple[bool, str]:
    """Check if tool is installed and return full path."""
    result = subprocess.run(["which", tool], capture_output=True, text=True)
    if result.returncode == 0:
        return True, result.stdout.strip()

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: Including sqlmap adds active SQL injection testing capability, which goes beyond passive baseline assessment and can send intrusive payloads to web applications. In an agent skill marketed as a Linux base scanner, this mismatch can lead to unexpected offensive probing of targets without clear operator intent or authorization boundaries.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The scan workflow launches active network probing and SQL injection testing immediately, without a user-facing confirmation that intrusive requests will be sent to the target. In agent-driven use, this increases the chance of unauthorized scanning, service disruption, or policy violations due to ambiguous user intent.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The module description states in Chinese that users interact with the scanner via natural language, and all user-facing responses/help text throughout the file are exclusively in Chinese. This imposes a specific language/locale on users without any opt-in, fallback, or explanation that the skill is intentionally region-specific.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The interface claims to begin a scan and present progress, but it never calls the supplied scan_function and never updates results from a real scan. In a security-scanning skill, this is dangerous because operators may falsely believe a target was assessed and make security decisions based on nonexistent coverage.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The help and export responses assert that reports can be generated and downloaded, yet the code only formats text and does not create any file. This can mislead users into trusting an audit trail or report artifact that does not exist, undermining security workflows and incident documentation.

External Script Fetching

Low

• Category: Supply Chain

Content

apt-get install -y nmap lynis nikto sqlmap

# trivy安装
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh
```

### 使用建议

• Confidence: 98% confidence
• Finding: The documentation instructs users to fetch and execute a remote script directly with curl piped into sh. This is dangerous because any compromise of the remote source, transport, or repository content results in immediate arbitrary code execution on the host, often with elevated privileges during package installation.

Static analysis

No suspicious patterns detected.