LI Emergency Response MOD

• Outcome: Malicious
• Latest audit: Jul 24, 2026 · 2:10 PM UTC
• Version: 1.0.0

Overview

This is mostly an incident-response guide, but it bundles directly usable offensive persistence, payload, and tunnel instructions that warrant human review before installation.

Install only for trained, authorized incident responders and configure the agent to treat this skill as advisory unless a human approves each state-changing action. Before broad use, remove or gate the offensive NOPTrace appendix material, replace unsafe API wrapper examples with strict schemas, and require evidence capture, rollback planning, and HITL confirmation for deletion, killing processes, DNS/hosts changes, package removal, external uploads, and any privileged command.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (35)

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The suggested Flask API forwards request-derived data into command-line arguments for a local script without any visible validation, allowlisting, or schema enforcement. Even if `subprocess.run` is invoked without a shell, this still exposes a dangerous trust boundary: attackers can supply unexpected flags, oversized inputs, or parameters that alter script behavior, which is especially risky in an incident-response skill that may run with filesystem access and elevated operational trust.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The guide explicitly claims there is no personal information leakage risk while also publishing author-identifying information and an email address. Even if the email is intended for support, this is still contradictory and can expose contact data to scraping, spam, impersonation, or unwanted attribution.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Although the document presents itself as incident-response guidance, this section contains explicit offensive tradecraft including payload generation, covert tunnel setup, persistence, and C2 workflow examples. In a skill context, such content can be directly repurposed by an autonomous agent or user to perform attacker actions rather than defensive analysis.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The handbook is framed as responder-focused, but later sections provide actionable instructions for persistence, evasion, service hiding, covert tunnels, payload generation, and offensive tooling. That mismatch increases risk because consumers may trust the document as safe defensive content while it embeds attacker-enabling procedures.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The document asserts that no real personal data is present, yet it includes an email address and a user/account identifier from CLI output. Even if the email is an example address, publishing contact details and account identifiers inside a security attestation undermines the privacy claim and can enable unwanted contact, profiling, or correlation of the author's identity across systems.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The file claims there is no personal information leakage risk, but later exposes author contact information and an account identifier elsewhere in the same report. This inconsistency creates a genuine privacy disclosure issue and may mislead reviewers into trusting a document that has not actually been sanitized.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The file deletion section contains forceful removal workflows, including inode-based deletion and rm/find/xargs combinations, without a strong up-front warning about irreversible data loss and evidentiary impact. In an agent-assisted setting, that raises the risk of deleting the wrong file, destroying forensic artifacts, or damaging production systems.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document recommends uploading suspected malware samples to third-party online sandboxes and analysis portals but does not warn about legal, privacy, or data-handling risks. In real incident response, samples can contain proprietary code, credentials, customer data, or regulated information, so indiscriminate upload can cause secondary disclosure.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The handbook gives direct process-killing commands such as kill -9 and process-group termination guidance with only limited caveats. In an agent skill context, this can cause immediate service disruption, loss of forensic state, or accidental termination of legitimate workloads if applied too broadly or automatically.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The text recommends uploading suspicious samples to public or third-party analysis platforms without emphasizing potential disclosure of proprietary, regulated, or victim-sensitive data. In real incident response, samples may contain credentials, customer data, internal code, or other sensitive artifacts that should not be externally shared by default.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The hosts-file redirection and monitoring workflow modifies system name resolution and may alter live communications, create operational outages, or contaminate evidence if done on production assets without controls. The document does not clearly foreground those side effects or require change control and forensic caution.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Advising responders to modify malicious domain resolution records can disrupt legitimate traffic, interfere with investigations, or produce unintended network impact if indicators are inaccurate or shared infrastructure is involved. The procedure is not framed with sufficient caution about business, evidentiary, and containment tradeoffs.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README provides concrete setup and execution guidance for incident-response orchestration, including spawning multiple agents and running workflows, but does not warn that these actions may touch sensitive systems, evidence, logs, or production environments. In a security-response skill, omission of safety boundaries can lead users to run automations without approval gates, scoping limits, or forensic safeguards, increasing the chance of operational disruption or evidence contamination.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README includes incident-response workflow guidance and example orchestration code that could be copied into real environments, but it does not warn users that these actions may affect production systems, alter evidence, or impact system integrity. In a security-response skill, omission of operational safety boundaries increases the chance of unsafe execution during live incidents, especially when multi-agent automation is involved.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guide shows sending alert data and bearer-token credentials to an external system but does not warn users about data sensitivity, secret handling, or trust boundaries. In an incident-response context, alert payloads can contain sensitive internal details, and readers may copy this pattern into production without encryption, redaction, secret storage, or third-party review.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The troubleshooting guidance recommends forcefully terminating agents to resolve deadlocks without warning about loss of in-flight tasks, evidence integrity issues, or service disruption. In a multi-agent incident-response system, abrupt termination can discard context, interrupt containment workflows, or corrupt the incident record at a critical time.

Unvalidated Output Injection

High

• Category: Output Handling

Content

def note():
    data = request.json
    cmd = ["python3", "scripts/note.py"] + dict_to_args(data)
    result = subprocess.run(cmd, capture_output=True, text=True)
    return jsonify({"output": result.stdout})

# 其他API端点...

• Confidence: 87% confidence
• Finding: subprocess.run(cmd, capture_output

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

【Ubuntu】

 `sudo apt purge <package-name>
或
sudo dpkg -P  <package-name>

• Confidence: 78% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

通过 yum/dnf 安装的软件包

 `sudo dnf remove <package-name>
或
sudo rpm -e

• Confidence: 78% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Ubuntu Server 20.04修改方法如下

 `cp /etc/netplan/00-installer-config.yaml .
sudo vim /etc/netplan/00-installer-config.yaml

# 将下面的配置写入该文件中，如果该文件有过定制，需要按照合适的方式配置
# This file describes the network interfaces available on your system

• Confidence: 73% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

根据硬盘大小等信息，可以确定新系统的硬盘设备名称为 `/dev/sda`  数据盘的设备名称为 `/dev/sdb`数据盘有一个分区 `/dev/sdb1` 已经挂载在某一个路径下了，但是路径有点长，还是新建 `/data` 目录，挂载到其上

 `sudo umount /dev/sdb1
sudo mkdir /data
sudo mount /dev/sdb1 /data

• Confidence: 79% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

// 下载 LEAF
git clone https://github.com/alex-cart/LEAF.git

// 安装 python3 依赖库，记得用sudo
cd LEAF
sudo pip3 install -r requirements.txt

• Confidence: 85% confidence
• Finding: sudo

Session Persistence

Medium

• Category: Rogue Agent

Content

- 修改注册表

 `# msf.dll为msf生成的后门dll文件
REG ADD "HKEY_CURRENT_USER\Software\Classes\CLSID\{AABBCCDD-1234-1234-1234-AABBCCDDEEFF}\InProcServer32" /VE /T REG_SZ /D "C:\msf.dll" /F

# 设置ThreadingModel = Apartment
REG ADD "HKEY_CURRENT_USER\Software\Classes\CLSID\{AABBCCDD-1234-1234-1234-AABBCCDDEEFF}\InProcServer32" /V ThreadingModel /T REG_SZ /D Apartment /F

• Confidence: 99% confidence
• Finding: REG ADD

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 0x01 删除文件问题

默认情况下，`rm ./*` 是不会删除以 `.` 开头的文件和文件夹的

所以在删除恶意文件等场景时，需要注意删除方法

• Confidence: 83% confidence
• Finding: rm ./

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `find ./* -inum 12327526 -exec rm -i {} \;` (会有一步确认是否删除)
 - `find ./* -inum 12327526 -exec rm -f {} \;`(不进行确认直接强制删除)
 - `find ./* -inum 12327526 |xargs rm -f`
 - `rm `find ./* -inum 12327526`` 参考文章 https://www.cnblogs.com/starry-skys/p/12970463.html https://www.cnblogs.com/tssc/p/7574432.html

 - 目录挂载导致无法删除

• Confidence: 95% confidence
• Finding: rm `find ./* -inum 12327526`` 参考文章 https://www.cnblogs.com/starry-skys/p/

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: malicious.crypto_mining, suspicious.generated_source_template_injection

Possible crypto mining behavior detected.

Critical

• Code: malicious.crypto_mining
• Location: multi_agent/framework/agent_framework.py:549

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: NOPTrace-Linux-应急响应手册-整理版.md:3147