ClawHub
Back to skill

Security audit

MUKI Asset Fingerprinting

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate dual-use security-scanning skill, but some default rules can actively touch sensitive services and record secrets more broadly than users may expect.

Install only for authorized security assessments with written scope. Review or disable active probes before use, especially SaltStack and Redis checks, and run passive-only mode when broad active probing is not approved. Treat reports as restricted evidence because they can contain credentials, personal data, and internal service details; prefer redaction or encryption before sharing.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
references/active_finger.json:2730
Finding

Fleet-Wide SaltStack Command Dispatched by an Active Fingerprint Probe

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
references/Rules.yml:87
Finding

Credential Extraction Rules Retain Plaintext Values Without Sensitive Classification

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (16)

YARA rule 'crypto_coinjacking': Browser-based cryptojacking scripts (CoinHive, CryptoLoot, etc.) [cryptominers]

Critical
Category
YARA Match
Confidence
90% confidence
Finding

YARA rule matched cryptocurrency mining indicators (stratum protocol, mining pools, miner binaries, or cryptojacking scripts).

Content

Scanner excerpt · references/finger.json (reported line 72870)May include surrounding context.

json
],
      "location": "header",
      "method": "keyword"
    },
    {
      "cms": "Solodev",
      "keyword": [
        "Solodev"
      ],
      "location": "header",
      "method": "keyword"
    },
    {
      "cms": "Amazon Cloudfront",
      "keyword": [
        "Amazon Cloudfront"
      ],
      "location": "header",
      "method": "keyword"
    },
    {
      "cms": "JSEcoin",
      "keyword": [
        "JSEcoin"
      ],
      "location": "header",
      "method": "keyword"
    },
    {
      "cms": "LiveJournal",
      "keyword": [
        "LiveJournal"
      ],
      "location": "header",
      "method": "keyword"
    },
    {
      "cms": "Mustache",
      "keyword": [
        "Mustache"
      ],
      "location": "header",
      "method": "keyword"
    },
    {
      "cms": "IBM WebSphere Portal",
      "keyword": [
        "IBM WebSphere Portal"
      ],
      "location": "header",
      "method": "keyword"
    },
    {

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
### 1. Active Fingerprinting (-A to disable)
Sends protocol-specific probes to identify services with high confidence.
- 300+ active fingerprint rules
- Covers SSH, RDP, web servers, databases
- Protocol-specific probes

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 258)May include surrounding context.

md
- Fingerprint Databases: See references/finger.json, active_finger.json

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This rule performs an active POST to SaltStack's /run endpoint with a functional payload invoking test.ping against tgt="*", which goes beyond passive identification and attempts to trigger server-side behavior. Even if intended for fingerprinting, it can interact with exposed orchestration infrastructure, create audit noise, and in misconfigured environments confirm or exercise dangerous control-plane access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This rule sends an INFO command payload to detect unauthenticated Redis access, which is an active unauthorized command probe rather than simple fingerprinting. Probing administrative/data-store protocols in this way can validate exploitable misconfiguration, may affect monitoring or logging, and is especially risky in a red-team reconnaissance skill because it normalizes checks against exposed services.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/finger.json (reported line 19360)May include surrounding context.

json
ch-routers",
      "keyword": [
        "cgi-bin/cgibox.cgi",
        "./img/logo.jpg"
      ],
      "location": "body",
      "method": "keyword"
    },
    {
      "cms": "Eudemon8000E-X8",
      "keyword": [
        "huawei eudemon8000e-x8"
      ],
      "location": "header",
      "method": "keyword"
    },
    {
      "cms": "EUESOFT-HR",
      "keyword": [
        "link.description = \"亿华软件\""
      ],
      "location": "body",
      "method": "keyword"
    },
    {
      "cms": "euseStudy",
      "keyword": [
        "userinfo/userfp.aspx"
      ],
      "location": "body",
      "method": "keyword"
    },
    {
      "cms": "evercookie",
      "keyword": [
        "evercookie.js",
        "var ec = new evercookie(;"
      ],
      "location": "body",
      "method": "keyword"
    },
    {
      "cms": "EverFocus-CCTV",
      "keyword": [
        "server: http server/everfocus",
        "realm=\"everfocus"
      ],
      "

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High
Category
YARA Match
Confidence
70% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/finger.json (reported line 112451)May include surrounding context.

json
"location": "body",
      "method": "keyword"
    },
    {
      "cms": "BugScan",
      "keyword": [
        "<title>bugscan memos</title>"
      ],
      "location": "body",
      "method": "keyword"
    },
    {
      "cms": "BugScan",
      "keyword": [
        "powered by bugscan"
      ],
      "location": "body",
      "method": "keyword"
    },
    {
      "cms": "BurpSuite",
      "keyword": [
        "<title>Burp Suite Professional</title>"
      ],
      "location": "body",
      "method": "keyword"
    },
    {
      "cms": "Business-System",
      "keyword": [
        "onsubmit=\"return checksubmit"
      ],
      "location": "body",
      "method": "keyword"
    },
    {
      "cms": "Business-System",
      "keyword": [
        "function hiddenpasse"
      ],
      "location": "body",
      "method": "keyword"
    },
    {
      "cms": "Business-System",
      "keyword": [
        "function omiga_windowurl"
      ],

Credential Access

High
Category
Privilege Escalation
Confidence
82% confidence
Finding

The reference explicitly highlights discovery of sensitive configuration paths such as /.env, which commonly expose credentials, API keys, and database secrets when misconfigured. In the context of a fingerprinting/recon tool, documenting these paths as scan targets facilitates credential harvesting and post-compromise escalation if used against unauthorized systems.

Content

Scanner excerpt · references/quick-reference.md (reported line 99)May include surrounding context.

Configuration

text
/.env
/config.php
/web.config
/settings.py

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High
Category
YARA Match
Confidence
91% confidence
Finding

The document includes workflow integrations with offensive security tools such as Nmap, Nuclei, and Metasploit, which increases operational capability for reconnaissance and follow-on exploitation. In this skill context, chaining fingerprinting output directly into CVE scanning or attack tooling makes the content more dangerous because it streamlines an end-to-end offensive pipeline.

Content

Scanner excerpt · references/quick-reference.md (reported line 173)May include surrounding context.

mory Usage

  • Default: ~500MB for 1000 targets
  • Reduce with: -t 10 and batch scanning

Network Bandwidth

  • Active scanning: ~50KB per target
  • Passive scanning: ~10KB per target

Scan Speed

  • Default threads (20): ~50 targets/minute
  • Max threads (100): ~200 targets/minute
  • Tor proxy: ~10 targets/minute

Integration Examples

With Nmap

bash
# Port scan first, then fingerprint
nmap -p- target.com -oG - | awk '/Up$/ {print $2}' > targets.txt
muki-fingerprint -l targets.txt

With Nuclei

bash
# Use MUKI to find targets, Nuclei for CVEs
muki-fingerprint -l targets.txt -o muki.json
cat muki.json | jq -r '.fingerprints[] | select(.service == "WordPress") | .target' | nuclei -t cves/

With Metasploit

bash
# Import services to Metasploit
muki-fingerprint -l targets.txt -o muki.json
cat muki.json | jq -r '.fingerprints[] | "\(.target) \(.service) \(.version)"' >> msf_targets.txt

Troubleshooting

"Connection refused"

  • Check if target is reac

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This YAML file defines rule groups and rule names entirely in Chinese, such as "疑似漏洞", "指纹信息", and multiple Chinese field labels. Because the file provides no indication that the skill is region-specific or that users can opt into this locale, it creates a language/locale policy concern for users expecting language choice.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
60% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/finger.json (reported line 17568)May include surrounding context.

json
{
      "cms": "DolphinScheduler",
      "keyword": [
        "let node_env = 'true'",
        "<title>dolphinscheduler</title>"
      ],
      "location": "body",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The quick reference provides concrete instructions for active scanning, directory probing, sensitive path discovery, and sensitive information extraction/export, but it does not repeat or foreground authorization, ownership, or privacy constraints in the operational examples. In a red-team reconnaissance tool, omission of these guardrails materially lowers friction for misuse and normalizes collection of potentially sensitive data from third-party systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The README is primarily in English, but the Rules.yml section switches to Chinese labels such as '疑似漏洞' and '敏感信息' without explaining that the skill is intended for Chinese-speaking users or providing an alternative. This can violate language/locale policy expectations when a skill implicitly forces part of the workflow into a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This JSON file contains multiple natural-language match strings in Chinese such as "管理登录" and similar localized terms, but the file provides no indication that locale-specific matching is optional or limited to Chinese-language targets. That can create a language/locale policy concern because the skill behavior implicitly bakes in a specific language without user choice or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This JSON contains multiple natural-language values in Chinese such as "监控面板", "任务调度", "监控系统", and "控制台" embedded as matching keywords and labels. Because the file does not indicate that it is intentionally China/Chinese-locale specific or provide an alternative locale option, it may violate the language/locale policy for skills that should not force a specific language implicitly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Several headings and labels are forced into Chinese while the rest of the quick reference is in English, which can create a language/locale policy issue if users are not given an explicit choice. The file does not explain that this is a region-specific document or provide an opt-in for Chinese terminology.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
references/finger.json:24112