T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/platform_check.py:241- Finding
Cloud Instance Metadata Endpoints Are Probed Without Separate Explicit Authorization
- Content
View full analysis
- Remediation
View remediation
Security audit
net-vuln-scan
Security checks for vulnerabilities and agentic risk
Overview
This is a security-scanning skill, but it includes under-scoped cloud metadata probing and a report-generation bug that users should review before installing.
Install only if you intend to run authorized security checks and are comfortable reviewing each command first. Do not run the all-platform scan on cloud-hosted systems unless metadata probing is explicitly authorized, and treat generated HTML reports as unsafe if the input JSON came from someone else. Review firewall, SSH, sudo, and package-management remediation commands before applying them to production systems.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/report_gen.py:138- Finding
Unescaped Scan Data Enables Stored HTML Injection in Generated Reports
- Content
View full analysis
{port.get('port')}/tcp {port.get('service')} {risk_class} {port.get('recommendation', '-')} """ # 生成问题列表 issues_html = "" for issue in results.get('issues', []): issue_class = 'high' if issue.get('risk') in ['极高', '高'] else ('medium' if issue.get('risk') == '中' else 'low') issues_html += f"""""" # 填充模板 html = html_template.format( timestamp=datetime.now().strftime('%Y-%m-%d %H:%M:%S'), target=results.get('target', 'localhost'), high_risk=high_risk, medium_risk=medium_risk, low_risk=low_risk, total_ports=total_ports, port_rows=port_rows, issues_html=issues_html if issues_html else '{issue.get('title')}{issue.get('description')}✅ 未发现严重安全问题
' ) ``` ### Technical Analysis The report generator loads values from a user-selected JSON file and interpolates them directly into an HTML document. It does not apply HTML escaping to fields including: - `target` - `port` - `service` - `risk_level` - `recommendation` - `title` - `description` An attacker-controlled value containing HTML event handlers, script-capable elements, or deceptive ...[truncated 1759 chars]- Remediation
View remediation
`, quotes, event handlers, and script-like payloads in every rendered field. 7. Ensure the final HTML contains escaped text such as `<img...>` rather than executable elements. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (63)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The reported implementation only probes a few fixed ports and does not perform the generic SSL/TLS, service-vulnerability, credential, or network-configuration checks described in the skill. In the context of an authorized security-audit tool, this mismatch increases danger because it can mislead users into underestimating exposure while the skill still requests or implies powerful scanning-related capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The reported implementation only probes a few fixed ports and does not perform the generic SSL/TLS, service-vulnerability, credential, or network-configuration checks described in the skill. In the context of an authorized security-audit tool, this mismatch increases danger because it can mislead users into underestimating exposure while the skill still requests or implies powerful scanning-related capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The reported implementation only probes a few fixed ports and does not perform the generic SSL/TLS, service-vulnerability, credential, or network-configuration checks described in the skill. In the context of an authorized security-audit tool, this mismatch increases danger because it can mislead users into underestimating exposure while the skill still requests or implies powerful scanning-related capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The reported implementation only probes a few fixed ports and does not perform the generic SSL/TLS, service-vulnerability, credential, or network-configuration checks described in the skill. In the context of an authorized security-audit tool, this mismatch increases danger because it can mislead users into underestimating exposure while the skill still requests or implies powerful scanning-related capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The reported implementation only probes a few fixed ports and does not perform the generic SSL/TLS, service-vulnerability, credential, or network-configuration checks described in the skill. In the context of an authorized security-audit tool, this mismatch increases danger because it can mislead users into underestimating exposure while the skill still requests or implies powerful scanning-related capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The reported implementation only probes a few fixed ports and does not perform the generic SSL/TLS, service-vulnerability, credential, or network-configuration checks described in the skill. In the context of an authorized security-audit tool, this mismatch increases danger because it can mislead users into underestimating exposure while the skill still requests or implies powerful scanning-related capabilities.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
修复方案:
bash # Ubuntu/Debian sudo apt update && sudo apt install mysql-server # RHEL/CentOS sudo yum update mysql-server
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
修复方案:
bash # Ubuntu/Debian sudo apt update && sudo apt install mysql-server # RHEL/CentOS sudo yum update mysql-server
YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]
High
- Category
- YARA Match
- Confidence
- 70% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
})
text --- ## 网络设备漏洞 ### 防火墙/VPN | CVE ID | 设备类型 | 漏洞描述 | 严重程度 | |--------|----------|----------|----------| | CVE-2026-21280 | FortiGate | FortiOS 远程代码执行 | CRITICAL | | CVE-2026-21281 | Palo Alto | PAN-OS 认证绕过 | HIGH | | CVE-2026-21430 | Cisco ASA | Cisco ASA 拒绝服务 | MEDIUM | **检测方法:** ```bash # 检查开放端口 nmap -sV -p 443,8443 <target> # 检查 SSL VPN curl -k https://<target>/sslvpn/修复方案:
bash # FortiGate execute firmware upgrade # Cisco ASA write mem reload路由器/交换机
CVE ID 设备类型 漏洞描述 严重程度 CVE-2026-21440 Cisco IOS XE 命令注入 CRITICAL CVE-2026-21441 Juniper JunOS 本地提权 HIGH CVE-2026-21442 HPE Aruba 认证绕过 HIGH 检测命令:
bash # Cisco show version show inventory # Juniper show versionIoT/摄像头
| CVE ID |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
curl -k disables TLS certificate validation, which trains users to bypass an important security control and can produce misleading results if a man-in-the-middle or invalid certificate is present. In a security scanning guide, normalizing insecure transport options is particularly risky because users may reuse the pattern elsewhere.
- Content
nmap -sV -p 443,8443
检查 SSL VPN
curl -k https:///sslvpn/
text **修复方案:**
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Using curl -k against Jenkins similarly disables TLS verification and encourages insecure operational habits. Although intended for discovery, it undermines authenticity checks and may conceal certificate misconfiguration that should itself be treated as a finding.
- Content
检测命令:
bash # Jenkins curl -k https://<jenkins>/api/json # Argo CD argocd version
Cloud Metadata Access
High
- Category
- Server-Side Request Forgery
- Confidence
- 98% confidence
- Finding
The script directly accesses the cloud instance metadata IP, which is a sensitive endpoint that can expose credentials, identity, and instance configuration in some environments. Embedding this in a general-purpose detection script without safeguards materially increases the chance of accidental secret exposure.
- Content
done
echo "=== 云服务元数据检测 ===" curl -s http://169.254.169.254/latest/meta-data/ && echo "⚠️ 元数据可访问"
text ---
Cloud Metadata Access
High
- Category
- Server-Side Request Forgery
- Confidence
- 92% confidence
- Finding
The skill is explicitly configured to target the cloud metadata IP 169.254.169.254. Access to metadata services is highly sensitive because successful requests may expose instance identity data and, depending on platform configuration, temporary credentials or other secrets; in a scanning skill, hardcoding this target increases risk beyond ordinary localhost checks.
- Content
python 'cloud': { 'name': '云服务', 'services': { 'aws_metadata': {'169.254.169.254': 'check_aws_metadata'}, 'azure_metadata': {'169.254.169.254': 'check_azure_metadata'}, } },
Cloud Metadata Access
High
- Category
- Server-Side Request Forgery
- Confidence
- 92% confidence
- Finding
This second metadata service entry also hardcodes 169.254.169.254 as a scan target. The context of a security-scanning skill makes this more dangerous because users may run it broadly without realizing it will probe privileged link-local cloud services rather than only local application ports.
- Content
python 'name': '云服务', 'services': { 'aws_metadata': {'169.254.169.254': 'check_aws_metadata'}, 'azure_metadata': {'169.254.169.254': 'check_azure_metadata'}, } }, 'container': {
Cloud Metadata Access
High
- Category
- Server-Side Request Forgery
- Confidence
- 95% confidence
- Finding
The AWS metadata check constructs a request to the link-local metadata endpoint. Direct requests to this endpoint can disclose sensitive cloud instance metadata and credentials if IMDS is accessible, making this dangerous in shared, production, or agent-executed environments.
- Content
python def check_aws_metadata(): """检测 AWS 元数据服务""" result = {'service': 'AWS Metadata', 'ip': '169.254.169.254', 'vulnerable': False, 'issues': []} try: import urllib.request req = urllib.request.Request('http://169.254.169.254/latest/meta-data/')
Cloud Metadata Access
High
- Category
- Server-Side Request Forgery
- Confidence
- 97% confidence
- Finding
The code actively performs urlopen() against AWS IMDS. Because this initiates a real request to a sensitive internal service, it crosses from static configuration into live internal-resource access, which can expose secrets and is a classic unsafe internal request pattern in automated tooling.
- Content
python result = {'service': 'AWS Metadata', 'ip': '169.254.169.254', 'vulnerable': False, 'issues': []} try: import urllib.request req = urllib.request.Request('http://169.254.169.254/latest/meta-data/') urllib.request.urlopen(req, timeout=2) result['status'] = '可访问' result['vulnerable'] = True
Cloud Metadata Access
High
- Category
- Server-Side Request Forgery
- Confidence
- 95% confidence
- Finding
The Azure metadata check similarly targets the privileged link-local metadata service. Even with the required Metadata header, this is still an intentional request to an internal cloud control surface and may reveal sensitive environment information when run in Azure-hosted contexts.
- Content
python def check_azure_metadata(): """检测 Azure 元数据服务""" result = {'service': 'Azure Metadata', 'ip': '169.254.169.254', 'vulnerable': False, 'issues': []} try: import urllib.request req = urllib.request.Request('http://169.254.169.254/metadata/instance', headers={'Metadata': 'true'})
Cloud Metadata Access
High
- Category
- Server-Side Request Forgery
- Confidence
- 97% confidence
- Finding
The code performs an actual urlopen() to the Azure metadata endpoint. In an agent skill context, this is more dangerous because the operator may think they are only doing benign local port checks, while the script is making sensitive internal HTTP requests that could leak cloud information or violate environment boundaries.
- Content
python result = {'service': 'Azure Metadata', 'ip': '169.254.169.254', 'vulnerable': False, 'issues': []} try: import urllib.request req = urllib.request.Request('http://169.254.169.254/metadata/instance', headers={'Metadata': 'true'}) urllib.request.urlopen(req, timeout=2) result['status'] = '可访问' result['vulnerable'] = True
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill advertises and references capabilities that imply shell, filesystem, and network access, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope declarations can lead to over-broad execution privileges and make misuse, unintended scanning, or unsafe file access harder to constrain or audit.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file uses Chinese throughout the description, usage instructions, and warnings, and does not indicate that users may choose another language. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The examples demonstrate network-range discovery and host scanning behavior but do not repeat or embed clear authorization, scope, and rate-limit warnings near the actionable commands. In a security scanning skill, this omission increases the chance that users copy the workflow for unauthorized or overly broad scans, causing legal, operational, or safety issues.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file provides direct firewall and SSH hardening commands that can immediately change connectivity and access controls, but it does not warn about lockout risk, service interruption, rollback, or testing requirements. Users may apply these commands blindly and accidentally block remote administration or disrupt production services.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ssh-keygen -t ed25519 # 禁用密码认证 sudo nano /etc/ssh/sshd_config # PasswordAuthentication no # PubkeyAuthentication yes sudo systemctl restart sshd
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ssh-keygen -t ed25519 # 禁用密码认证 sudo nano /etc/ssh/sshd_config # PasswordAuthentication no # PubkeyAuthentication yes sudo systemctl restart sshd
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document includes active scanning commands against arbitrary targets/domains without pairing them at the point of use with an authorization/impact warning. In a network vulnerability scanning skill, this materially increases misuse risk because users can directly copy commands to probe systems they do not own, potentially causing unauthorized scanning or operational impact.
- Content
Static analysis
No suspicious patterns detected.