Security audit
Security checks for vulnerabilities and agentic risk
This is a real security scanning skill, but it needs review because it can scan the local root filesystem for secrets, run intrusive/evasive scans, and write reports to unsafe paths.
Install only if you are comfortable granting a scanner broad local and network authority. Run it as an unprivileged user, scan only systems you own or are explicitly authorized to test, avoid stealth mode and sqlmap on production without written approval, do not follow the curl | sh Trivy install line, and avoid using caller-supplied HTML report paths until report writing is constrained and escaped.
SKILL.md:240Mutable Remote Installation Script Is Executed Directly by a Shell
scripts/li_base_scan.py:703Full and Compliance Scans Inspect the Entire Root Filesystem for Secrets
scripts/entrypoint.py:132Caller-Controlled HTML Report Path Allows Arbitrary File Overwrite
scripts/html_reporter.py:229Unescaped Scan Results Permit Stored HTML Injection in Generated Reports
SKILL.md:511Documented Production Safety Option Is Not Implemented
The documentation claims hardened implementation, single-host enforcement, secure temp file handling, scan history, export, and real tool integrations, but the analyzed content does not substantiate those controls. This mismatch is dangerous because users and upstream agents may rely on non-existent safeguards, causing unsafe execution decisions, over-trust, or accidental misuse of a scanning skill that lacks the promised restrictions.
The pipe into sh is a classic command-chaining abuse pattern that collapses download and execution into one step, eliminating opportunities for validation. If a malicious or altered script is served, the command immediately executes arbitrary instructions, potentially compromising the scanner host and any data it can access.
apt-get install -y nmap lynis nikto sqlmap
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh
### 使用建议
The same download-to-shell chain is present in the English section, creating a repeat arbitrary-code-execution risk. Because this is guidance embedded in the skill, it may be copied verbatim by operators or downstream agents and lead to unsafe automated setup.
apt-get install -y nmap lynis nikto sqlmap
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh
### Usage Recommendations
The skill is described as SINGLE HOST ONLY, but in full/compliance flows it runs Trivy against '/', which scans the entire local filesystem, including secrets, configs, and software inventory unrelated to the requested host. In an agent context this broadens scope from remote host assessment to host-wide local data access, increasing privacy and data-exposure risk far beyond the declared purpose.
The skill advertises and documents capabilities that imply shell execution, network scanning, file reads/writes, and logging/export, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope declarations can let a broadly-triggered skill access powerful capabilities without clear operator review, increasing the chance of unauthorized scanning, filesystem access, or command execution.
The skill explicitly markets a stealth/slow mode as a way to avoid IDS/IPS detection, which is evasive operational guidance rather than neutral defensive scanning language. This makes the skill more dangerous because it normalizes attacker-useful behavior and could facilitate covert reconnaissance if the skill is exposed in a multi-user or weakly governed environment.
Overly broad trigger phrases like generic system-check or baseline-scan requests can cause the skill to activate without a clearly specified target, mode, or authorization context. In a security-scanning skill with shell and network capabilities, ambiguous invocation increases the risk of accidental scans, unintended local probing, or unsafe default behavior.
Generic follow-up phrases such as asking what vulnerabilities were found or requesting repair advice can let the skill continue or steer a scanning workflow without a fresh, explicit scan context. In conversational agent systems this can lead to context confusion, reuse of stale targets, or unintended continuation of sensitive security operations.
The English section repeats commands and descriptions centered on avoiding IDS/IPS detection, reinforcing evasive use across audiences. Duplicating this framing increases the chance of misuse and suggests the capability is intentionally designed for operational stealth rather than purely defensive assessment.
This file emits user-facing error text in Chinese, and the same pattern continues throughout the script. Because the skill does not provide a language-selection mechanism or document a justified locale restriction, it violates the language/locale policy for natural-language behavior.
The skill advertises SINGLE HOST ONLY, but the entrypoint forwards the target string without enforcing that constraint. In a security-scanning tool context, an attacker or careless user could supply ranges, CIDR blocks, multiple hosts, or scanner-specific target expressions, causing broader-than-intended scanning and potentially unauthorized network activity.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
# Execute scan
try:
result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout + 60)
if result.returncode == 0:
if output_format == "html":
When html_report is not provided, the code writes to a predictable filename under /tmp derived from user-controlled target data. Predictable paths in a world-writable directory can enable symlink or race-condition attacks, allowing overwrite of unintended files or disclosure/corruption of report data if the process runs with elevated privileges.
The generated HTML explicitly sets the document language to zh-CN and uses Chinese-only titles and labels throughout the report, effectively forcing a specific language/locale. The policy allows locale constraints only when users can opt in or when the constraint is clearly documented and justified, neither of which appears in this file.
The module branding says 'Linux Security Baseline Scanner', but the implementation also performs web scanning, SQL injection testing, and full local filesystem secret/vulnerability scanning. This scope mismatch is dangerous because users and higher-level agents may grant broader capabilities than they realize, undermining informed consent and least-privilege assumptions.
Many user-facing strings, scan mode descriptions, progress messages, errors, and reports are hardcoded in Chinese, while the CLI and skill do not provide any language-selection mechanism. This forces a specific language/locale on users without opt-in, which matches the stated natural-language policy violation criteria.
The stealth profile enables SYN scan fragmentation and host randomization behaviors associated with evasion rather than ordinary baseline assessment. This makes the skill more dangerous in context because it introduces concealment-oriented scanning features not justified by the stated defensive purpose.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run(cmd: List[str], timeout: int = 300, capture_output: bool = True) -> Tuple[int, str, str]:
"""Run command with secure timeout handling."""
try:
proc = subprocess.Popen(
cmd,
stdout=subprocess.PIPE if capture_output else None,
stderr=subprocess.PIPE if capture_output else None,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def check_tool(tool: str) -> Tuple[bool, str]:
"""Check if tool is installed and return full path."""
result = subprocess.run(["which", tool], capture_output=True, text=True)
if result.returncode == 0:
return True, result.stdout.strip()
Including sqlmap adds active SQL injection testing capability, which goes beyond passive baseline assessment and can send intrusive payloads to web applications. In an agent skill marketed as a Linux base scanner, this mismatch can lead to unexpected offensive probing of targets without clear operator intent or authorization boundaries.
The scan workflow launches active network probing and SQL injection testing immediately, without a user-facing confirmation that intrusive requests will be sent to the target. In agent-driven use, this increases the chance of unauthorized scanning, service disruption, or policy violations due to ambiguous user intent.
The module description states in Chinese that users interact with the scanner via natural language, and all user-facing responses/help text throughout the file are exclusively in Chinese. This imposes a specific language/locale on users without any opt-in, fallback, or explanation that the skill is intentionally region-specific.
The interface claims to begin a scan and present progress, but it never calls the supplied scan_function and never updates results from a real scan. In a security-scanning skill, this is dangerous because operators may falsely believe a target was assessed and make security decisions based on nonexistent coverage.
The help and export responses assert that reports can be generated and downloaded, yet the code only formats text and does not create any file. This can mislead users into trusting an audit trail or report artifact that does not exist, undermining security workflows and incident documentation.
The documentation instructs users to fetch and execute a remote script directly with curl piped into sh. This is dangerous because any compromise of the remote source, transport, or repository content results in immediate arbitrary code execution on the host, often with elevated privileges during package installation.
apt-get install -y nmap lynis nikto sqlmap
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh
### 使用建议