Clamav

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:59 AM UTC
• Version: 1.0.0

Overview

This ClamAV reference skill is mostly coherent, but it includes unsafe system-administration guidance that users should review before following.

Review this skill before installing or using it operationally. Treat it as reference material, not a script to paste blindly: avoid LocalSocketMode 666, pin and isolate cvdupdate if used, prefer move/copy quarantine workflows before deletion, and confirm any systemctl, cron, or full-system scan commands are appropriate for the specific host.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/script.sh:228

Finding

Unpinned Third-Party Package Installation Guidance

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 228-230
Vulnerability Type: Unpinned and unverified third-party dependency
Risk Level: Medium

sh

# pip install cvdupdate
$ cvd update                       # Download databases
$ cvd serve                        # Start local HTTP mirror

Technical Analysis

The Skill recommends installing cvdupdate from the default Python package index without specifying a reviewed version, validating a cryptographic hash, selecting an explicit trusted index, or using an isolated environment.

Although these commands are static documentation printed by the script rather than commands automatically executed by the Skill, users following the guidance receive whichever package version the package index resolves at installation time. The effective dependency can therefore change after the Skill has been reviewed. A compromised maintainer account, malicious package release, or supply-chain compromise could introduce arbitrary code into package installation or runtime behavior.

Attack Path

1. An attacker compromises the relevant package distribution channel or publishes a malicious release through a compromised maintainer account.
2. A user follows the Skill's recommendation and runs pip install cvdupdate without a version or hash constraint.
3. The package manager retrieves the attacker-controlled release.
4. Malicious package code executes during installation or when the user invokes cvd update or cvd serve.
5. The payload gains the permissions of the account that installed or invoked the package. If the command is run by an administrator, the resulting scope may include privileged system access.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the privileges of the installing or invoking user. Potential consequences include modification or theft of accessible files, credential exposure, malicious net ...[truncated 259 chars]

Remediation

View remediation

Remediation Suggestions

• Pin cvdupdate to a specifically reviewed version.
• Require installation from an explicit trusted package index.
• Use hash verification through a requirements or lock file, for example with pip install --require-hashes.
• Recommend installing the package inside a dedicated virtual environment under an unprivileged service account.
• Review package release notes and integrity before updating the pinned version.
• Avoid running the package installation or mirror service as root.
• Document network binding and access-control requirements for cvd serve so the mirror is not unintentionally exposed.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:355

Finding

World-Accessible ClamAV Daemon Socket Recommendation

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 355-360
Vulnerability Type: Overly permissive local socket access control
Risk Level: Medium

text

## Socket Permissions

  For integration with other services (Postfix, vsftpd):
  LocalSocket /var/run/clamav/clamd.ctl
  LocalSocketGroup mail
  LocalSocketMode 666

  Add mail user to clamav group: # usermod -aG clamav postfix

Technical Analysis

The recommended LocalSocketMode 666 grants read and write access to the ClamAV daemon socket to every local user. This exceeds the permissions needed for the stated integration with selected services such as Postfix or vsftpd.

ClamAV daemon access should be restricted to explicitly authorized service accounts. A world-accessible socket allows any local account or compromised low-privilege process to communicate with clamd and submit operations. Because antivirus scans may consume substantial CPU, memory, and I/O resources—especially for large or deeply nested archives—unrestricted clients can abuse the daemon for resource exhaustion.

Adding a required service account to a dedicated group is sufficient; setting the socket to mode 666 is unnecessary and undermines that group-based boundary.

Attack Path

1. An attacker obtains access to any unprivileged local account or compromises a low-privilege process.
2. The attacker discovers /var/run/clamav/clamd.ctl, which is accessible because LocalSocketMode is set to 666.
3. The attacker connects directly to the socket using a compatible client or the ClamAV daemon protocol.
4. The attacker repeatedly submits expensive scan requests, including requests involving large files or complex archives.
5. The clamd process consumes CPU, memory, worker threads, and storage I/O, reducing antivirus availability and potentially degrading other services.

Impact Assessment

The primary impact is local denial of service against `clamd ...[truncated 425 chars]

Remediation

View remediation

Remediation Suggestions

• Replace LocalSocketMode 666 with LocalSocketMode 660.
• Assign the socket to a dedicated group such as clamav-scan rather than a broad shared group where practical.
• Add only the service accounts that require scanning access to that group.
• Run clamd under the dedicated, unprivileged clamav account.
• Configure scan-size, recursion, file-count, thread, queue, and timeout limits to reduce denial-of-service exposure.
• Verify the effective socket owner, group, and permissions after daemon startup.
• Document that mode 666 should not be used as a shortcut for resolving service-integration permission errors.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

YARA rule 'php_webshell_obfuscated': Obfuscated PHP webshell — eval(base64_decode/gzinflate/str_rot13) [webshells]

Critical

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a known webshell pattern (PHP, Python, JSP, or ASPX webshell).

Content

Scanner excerpt · scripts/script.sh (reported line 413)May include surrounding context.

sh

set
              float means within first N bytes

  ### Examples:
  # Detect EICAR test string anywhere in file
  Custom.Test.EICAR:0:*:5835304f255041505b344c50585a35342850\
  5e2937434329377d2445494341522d5354414e444152442d414e544956495255\
  532d544553542d46494c452124482b482a

  # Detect specific PHP webshell pattern
  Custom.Webshell.PHPEval:0:*:6576616c28626173653634\
  5f6465636f646528    (eval(base64_decode()

  ### Convert ASCII to hex for signatures:
  $ echo -n 'eval(base64_decode(' | xxd -p
  6576616c28626173653634...

## Logical Signatures (.ldb)

  Combine multiple conditions with AND/OR logic.

  Format: SignatureName;TargetType;LogicalExpression;Subsig0;Subsig1;...

  ### Example (match if BOTH patterns present):
  Custom.Backdoor.Multi;Target:0;(0&1);\
  6576616c28;626173653634

  Operators: & (AND), | (OR), parentheses for grouping
  Quantifiers: 0=first subsig, 1=second, etc.

## YARA Rules

  ClamAV supports YARA rules natively:

  Save as /var/lib/clamav/custom.yar

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/script.sh (reported line 63)May include surrounding context.

sh

$ wget https://www.clamav.net/downloads/production/clamav-1.3.0.tar.gz
  $ tar xzf clamav-1.3.0.tar.gz && cd clamav-1.3.0
  $ cmake .. -D CMAKE_INSTALL_PREFIX=/usr/local
  $ cmake --build . && sudo cmake --install .

## Virus Database Files

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/script.sh (reported line 258)May include surrounding context.

sh

→ Rate limited. Reduce Checks value or use a private mirror.

  ERROR: Can't create freshclam.dat in /var/lib/clamav
  → Fix permissions: chown clamav:clamav /var/lib/clamav
EOF
}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/script.sh (reported line 484)May include surrounding context.

sh

## Remove Infected Files

  $ clamscan -r --remove /srv/uploads/

  WARNING: This permanently deletes infected files. No undo.
  Use --move or --copy first to preserve evidence.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/script.sh (reported line 63)May include surrounding context.

sh

$ wget https://www.clamav.net/downloads/production/clamav-1.3.0.tar.gz
  $ tar xzf clamav-1.3.0.tar.gz && cd clamav-1.3.0
  $ cmake .. -D CMAKE_INSTALL_PREFIX=/usr/local
  $ cmake --build . && sudo cmake --install .

## Virus Database Files

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/script.sh (reported line 220)May include surrounding context.

sh

## Running freshclam as a Daemon

  # freshclam -d                     # Run in background
  # systemctl enable --now clamav-freshclam   # Systemd service

  Check daemon status:
  $ systemctl status clamav-freshclam

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/script.sh (reported line 322)May include surrounding context.

sh

## Running freshclam as a Daemon

  # freshclam -d                     # Run in background
  # systemctl enable --now clamav-freshclam   # Systemd service

  Check daemon status:
  $ systemctl status clamav-freshclam

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/script.sh (reported line 323)May include surrounding context.

sh

## Running freshclam as a Daemon

  # freshclam -d                     # Run in background
  # systemctl enable --now clamav-freshclam   # Systemd service

  Check daemon status:
  $ systemctl status clamav-freshclam

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/script.sh (reported line 351)May include surrounding context.

sh

## Running freshclam as a Daemon

  # freshclam -d                     # Run in background
  # systemctl enable --now clamav-freshclam   # Systemd service

  Check daemon status:
  $ systemctl status clamav-freshclam

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/script.sh (reported line 631)May include surrounding context.

sh

## Running freshclam as a Daemon

  # freshclam -d                     # Run in background
  # systemctl enable --now clamav-freshclam   # Systemd service

  Check daemon status:
  $ systemctl status clamav-freshclam

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/script.sh (reported line 495)May include surrounding context.

sh

## Setting Up a Quarantine Directory

  # mkdir -p /var/quarantine
  # chmod 700 /var/quarantine
  # chown clamav:clamav /var/quarantine

  Recommended: Mount quarantine with noexec,nosuid

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/script.sh:413