宝塔面板

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:07 AM UTC
• Version: 1.0.5

Overview

This appears to be a real server-management skill, but some bundled troubleshooting instructions could change live website files and expose database passwords in unsafe shell commands.

Install only if you understand the Chinese instructions and are comfortable granting a tool ongoing administrative access to a Baota/aaPanel server. Before using the bundled website troubleshooting skill, require explicit confirmation for any write/delete, recursive permission change, service kill/restart, or database diagnostic, and avoid commands that place database passwords directly in shell arguments.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: assets/bt-skills/bt-website-troubleshoot/SKILL.md:116

Finding

Shell Command Injection and Credential Exposure in Database Diagnostics

Content

View full analysis

/wp-config.php` → extract `DB_NAME`, `DB_USER`, `DB_PASSWORD`, `DB_HOST`. - Other frameworks: search `.env`, `config/database.php`, `application/database.php`, etc. 2. `RunCommand/Bash: mysql -h -u -p -e "SELECT VERSION()"` → a successful connection returns the MySQL version; otherwise, inspect the error code in the next step. 3. If the connection fails, read the error code from the raw `mysql` client output and apply the following logic: - `2002` / `2003` → MySQL is not running. Proceed to service startup failure → MySQL. - `1045` → The password is incorrect. Compare `DB_PASSWORD` from the configuration with the `databases` table; report any discrepancy without automatically resetting the database password. - `1146` → A database table is missing. Use `RunCommand/Bash: mysql -h -u -p -e "SHOW TABLES"` / `DESC ` to confirm. - `1040` → Too many connections. Run `RunCommand/Bash: mysql -h -u -p -e "SHOW GLOBAL STATUS LIKE 'Threads_connected'; SHOW FULL PROCESSLIST"` to inspect connection counts and sources. ``` ### Technical Analysis The Skill directs the agent to read database connection fields from application-controlled files such as `wp-config.php` and `.env`, and then interpolate those values directly into a command executed through `RunCommand/Bash`. These fields are not guaranteed to be trustworthy. A compromised website, malicious repository, or attacker with write access ...[truncated 3067 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (25)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md

1. 阅读准备安装的每个 `SKILL.md`，展示技能名称和目标目录。

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 87% confidence

Finding

The skill chains pkill php-fpm with a delayed restart in one shell command, creating a brittle high-impact action that can terminate all php-fpm processes on the host. If run on a shared or production server, this can cause broad service disruption and makes it harder to safely inspect intermediate state or abort after the destructive first step.

Content

Scanner excerpt · assets/bt-skills/bt-website-troubleshoot/SKILL.md (reported line 186)May include surrounding context.

md

| 启动后立即显示 `active (exited)` | 被 OOM killer 终止 | `RunCommand/Bash: dmesg \| grep -E "php\|oom" \| tail -20` + `RunCommand/Bash: free -m` → 降低 `/www/server/php/<ver>/etc/php-fpm.conf` 中的 `pm.max_children`（高风险） |
| `bind() to /tmp/php-cgi-<ver>.sock failed: Address already in use` | 旧 php-fpm 进程仍在运行 | `RunCommand/Bash: pkill php-fpm && sleep 2 && /etc/init.d/php-fpm-<ver> start`（高风险） |
| `ERROR: [/www/server/php/<ver>/etc/php-fpm.conf:N] unknown parameter` | 手动编辑导致指令损坏 | 使用 `Read` 读取对应行，修复或通过面板应用商店 → PHP → 设置 → 配置 → 重置（高风险） |
| `Unable to access php-fpm.sock: Permission denied` | Socket 文件所有者错误 | `RunCommand/Bash: ls -la /tmp/php-cgi-<ver>.sock` → 如果不是 `www:www`，执行 `RunCommand/Bash: chown www:www /tmp/php-cgi-<ver>.sock && chown -R www:www /www/server/php/<ver>/var/log/`（低风险） |

---

Direct flow: pathlib.Path.read_bytes (file read) → subprocess.run (code execution)

High

• Category: Data Flow
• Confidence: 80% confidence

Finding

Data flows directly from a source (env vars, files, network) to a sink (network output, exec, file write) without intermediate validation.

Content

Scanner excerpt · scripts/bt_mcp_setup.py (reported line 171)May include surrounding context.

python

args.target,
            remote_command,
        ]
        return subprocess.run(
            command,
            input=path.read_bytes(),
            stdout=subprocess.PIPE,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill description and usage guidance are written entirely in Chinese, and the README does not indicate that other languages are supported or that Chinese is required for a region-specific compliance reason. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill clearly expects powerful capabilities including shell execution, network access, and file read/write, but it does not declare any explicit tool scope or allowed-tools boundary. That omission increases the chance an agent will run the skill with broader privileges than necessary, which is especially risky here because the workflow includes root-level server administration, remote installation, firewall changes, and token handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The natural-language description and operational instructions are written entirely in Chinese and do not indicate that the skill can operate in other languages or that the Chinese-only requirement is optional. Under the policy rule for language/locale constraints, this is a violation unless the skill offers opt-in language choice or clearly justifies a region-specific limitation.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash

SKILL_DIR='<当前 SKILL.md 所在目录>'
BT_RESULT="$(mktemp -t btpanel-mcp-result.XXXXXX)"
chmod 600 "$BT_RESULT"
python3 "$SKILL_DIR/scripts/bt_mcp_setup.py" \
  --allow-ips '<最小白名单>' \
  --auto-upgrade \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

bash

SKILL_DIR='<当前 SKILL.md 所在目录>'
BT_RESULT="$(mktemp -t btpanel-mcp-result.XXXXXX)"
chmod 600 "$BT_RESULT"
python3 "$SKILL_DIR/scripts/bt_mcp_setup.py" \
  --allow-ips '<最小白名单>' \
  --auto-upgrade \

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s natural-language description, triggers, SOP steps, and reporting template are all presented only in Chinese. This can violate language/locale policy when the skill effectively forces one language without giving the user an explicit choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · assets/bt-skills/bt-go-project-deploy/SKILL.md (reported line 25)May include surrounding context.

md

1. **先只读侦察，再执行变更** —— 部署前先 `GoProjectInfo` 查是否已存在同名项目、`GoVersion(action=list)` 看 SDK；排错先读日志，不盲目重启。
2. **Go 是编译产物，无源码分析** —— `GoProjectCreate` 不需要分析步骤：给二进制绝对路径 + 端口 + 启动命令（缺省=二进制）直接注册。**不提供 analyze_only。**
3. **Go SDK 安装走 Bash 后台** —— btpygvm 装的是完整预编译包（快），但网络慢仍可能超时：`GoVersion(action=install, version=...)` 返回 `install_command` 后，必须用 `Bash(command=install_command, run_in_background=true)` 后台执行 + `BashStatus(task_id, wait=true)` 轮询；**一次只装一个版本**。
4. **创建即同步启动** —— `GoProjectCreate` 注册后面板同步启动（nohup 脚本 + pid，**无守护、崩了不自愈**）；创建成功 ≠ 进程一定活着，必须 `GoProjectInfo` 核验 `run=true` + 端口在 `listen`。
5. **Go 项目是编译二进制** —— 缺动态库/权限/端口占用是启动失败主因，排错按日志对号入座（场景二）。
6. **改配置即重启** —— `GoProjectModify(action='config')` 面板改完自动 stop+start；改端口后若绑了域名，nginx 反代按新端口重写。
7. **每个任务最多调用 15 次工具**，超出后汇总当前发现并停止。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill’s operational instructions are written entirely in Chinese with no language selection or alternate-language fallback, which can cause an agent or operator who is not fluent in Chinese to misunderstand safety constraints, destructive-action limits, or verification steps. In a high-privilege server administration skill, that ambiguity increases the chance of unsafe actions, skipped confirmations, or misconfiguration during deployment and incident response.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill description and operating instructions are written exclusively in Chinese, with no indication that the user may choose another language or that the skill is region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The main behavior description advertises management capabilities that include destructive actions such as deleting sites or bindings, but it does not clearly foreground that these actions are risky and require explicit confirmation. In a high-privilege server administration skill, understated destructive capability is dangerous because an agent may proceed from a loosely phrased request into irreversible infrastructure changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list contains broad operational phrases such as '反向代理', '反代', and '域名转发到端口' that are common in routine admin discussions, which increases the chance the skill is auto-invoked in contexts where the user did not intend to perform reverse-proxy management. Because this skill can create, modify, and delete live nginx proxy configurations and expose internal services, accidental invocation can lead to unintended infrastructure changes or service exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill declares file deletion as prohibited, yet later instructs deleting probe files with rm -f. Contradictory safety rules weaken policy enforcement and may train an agent to ignore hard prohibitions when later steps conflict with them.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill claims the probes are 'read-only' and have no persistent side effects, but it actually creates and deletes files in the web root. That mismatch can cause an agent or user to approve actions under false assumptions, especially in production sites where even temporary file creation may trigger monitoring, caching, or application behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description does not clearly disclose that troubleshooting may modify site contents by creating and deleting probe files. Hidden write behavior reduces informed consent and increases the chance that an agent performs filesystem changes on a live website without the user's awareness.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · assets/bt-skills/bt-website-troubleshoot/SKILL.md (reported line 58)May include surrounding context.

md

### 探针 A —— 静态文件（验证域名绑定 + nginx + 根目录）

1. `RunCommand/Bash: echo 'bt Panel probe $(date)' > <site_path>/.probe_static.html`
2. `RunCommand/Bash: chown www:www <site_path>/.probe_static.html && chmod 644 <site_path>/.probe_static.html`
3. `RunCommand/Bash: curl --resolve <domain>:80:127.0.0.1 -sS http://<domain>/.probe_static.html`
4. **预期结果**：返回探针文本，HTTP 状态码为 200。
5. 清理：`RunCommand/Bash: rm -f <site_path>/.probe_static.html`

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · assets/bt-skills/bt-website-troubleshoot/SKILL.md (reported line 66)May include surrounding context.

md

### 探针 A —— 静态文件（验证域名绑定 + nginx + 根目录）

1. `RunCommand/Bash: echo 'bt Panel probe $(date)' > <site_path>/.probe_static.html`
2. `RunCommand/Bash: chown www:www <site_path>/.probe_static.html && chmod 644 <site_path>/.probe_static.html`
3. `RunCommand/Bash: curl --resolve <domain>:80:127.0.0.1 -sS http://<domain>/.probe_static.html`
4. **预期结果**：返回探针文本，HTTP 状态码为 200。
5. 清理：`RunCommand/Bash: rm -f <site_path>/.probe_static.html`

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The skill labels recursive ownership and permission changes as 'low risk' and recommends applying them automatically across the entire site root. Broad chown/chmod operations can break application behavior, alter security posture, and damage unrelated content if root is misidentified or symlinked.

Content

Scanner excerpt · assets/bt-skills/bt-website-troubleshoot/SKILL.md (reported line 89)May include surrounding context.

md

- 文件权限 = `644`
4. 如果任一项不正确（自动修复，低风险）：
   - `RunCommand/Bash: chown -R www:www <root>`
   - `RunCommand/Bash: find <root> -type d -exec chmod 755 {} \;`
   - `RunCommand/Bash: find <root> -type f -exec chmod 644 {} \;`
5. 使用预检查 curl 重新测试。如果仍然返回 403，检查 nginx 错误日志：
   - `Read: /www/wwwlogs/<domain>.error.log`（最后 50 行，查找 `directory index of "..." is forbidden` 或 `access denied`）。

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

Recursively forcing all files under the root to mode 644 is an overbroad privileged remediation that may remove required execute bits or special permissions from application files. In a production hosting context, such blanket normalization can cause outages or weaken intended security controls.

Content

Scanner excerpt · assets/bt-skills/bt-website-troubleshoot/SKILL.md (reported line 90)May include surrounding context.

md

4. 如果任一项不正确（自动修复，低风险）：
   - `RunCommand/Bash: chown -R www:www <root>`
   - `RunCommand/Bash: find <root> -type d -exec chmod 755 {} \;`
   - `RunCommand/Bash: find <root> -type f -exec chmod 644 {} \;`
5. 使用预检查 curl 重新测试。如果仍然返回 403，检查 nginx 错误日志：
   - `Read: /www/wwwlogs/<domain>.error.log`（最后 50 行，查找 `directory index of "..." is forbidden` 或 `access denied`）。

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs reading application configuration files to extract database credentials and then passing them on the command line to mysql. This exposes sensitive secrets to the agent workflow and potentially to shell history, process listings, logs, or audit trails without an upfront privacy warning.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 83% confidence

Finding

This subprocess call sends a downloaded shell script directly into a remote ssh ... bash -s -- session for execution as root. Although the script is hash-pinned and arguments are shell-quoted, the use of StrictHostKeyChecking=accept-new weakens SSH trust-on-first-use and can allow first-connection MITM host impersonation, leading to execution of the trusted installer on an attacker-controlled host and possible disclosure of installation results or unsafe provisioning.

Content

Scanner excerpt · scripts/bt_mcp_setup.py (reported line 171)May include surrounding context.

python

args.target,
            remote_command,
        ]
        return subprocess.run(
            command,
            input=path.read_bytes(),
            stdout=subprocess.PIPE,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/bt_mcp_setup.py (reported line 180)May include surrounding context.

python

)

    command = ["bash", str(path), *values]
    return subprocess.run(
        command,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,

Static analysis

No suspicious patterns detected.