1-SEC: All-in-One Cybersecurity for AI Agent Hosts

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:16 PM UTC
• Version: 0.4.15

Overview

The skill is transparent about installing a server-security agent, but it relies on a powerful unsigned downloaded binary that can run with root enforcement and self-update behavior.

Install only after reviewing the upstream project and release provenance. Prefer manual download and independent verification, keep dry-run enabled until tested, avoid the vps-agent live preset on important systems without monitoring, disable self-update checks in hardened environments, and run unprivileged if you only need log-only monitoring.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install-and-configure.sh:69
• Finding: Externally Hosted Unsigned Binary Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install-and-configure.sh:69-114` **Vulnerability Type**: Remote executable retrieval and insufficient supply-chain authentication **Risk Level**: High ### Vulnerable Code ```bash # Step 1: Install via verified download from GitHub Releases if command -v 1sec >/dev/null 2>&1; then ok "1sec already installed: $(1sec version 2>/dev/null | head -1)" else RELEASE_BASE="https://github.com/1sec-security/1sec/releases/download/v${VERSION}" info "Downloading 1-SEC v${VERSION} (${BINARY}) from GitHub Releases..." if command -v wget >/dev/null 2>&1; then wget -q "${RELEASE_BASE}/${BINARY}" -O /tmp/1sec-download wget -q "${RELEASE_BASE}/checksums.txt" -O /tmp/1sec-checksums.txt elif command -v curl >/dev/null 2>&1; then curl -fsSL "${RELEASE_BASE}/${BINARY}" -o /tmp/1sec-download curl -fsSL "${RELEASE_BASE}/checksums.txt" -o /tmp/1sec-checksums.txt else fail "Neither wget nor curl found. Install one and retry." fi info "Verifying SHA256 checksum..." EXPECTED_HASH="$(grep "${BINARY}" /tmp/1sec-checksums.txt | awk '{print $1}')" ACTUAL_HASH="$(sha256sum /tmp/1sec-download | awk '{print $1}')" if [ -z "$EXPECTED_HASH" ]; then rm -f /tmp/1sec-download /tmp/1sec-checksums.txt fail "Checksum for ${BINARY} not found in checksums.txt — aborting." fi if [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then rm -f /tmp/1sec-download /tmp/1sec-checksums.txt fail "Checksum mismatch! Expected: $EXPECTED_HASH Got: $ACTUAL_HASH — aborting." fi ok "Checksum verified: $ACTUAL_HASH" chmod +x /tmp/1sec-download if [ "$(id -u)" -eq 0 ]; then mv /tmp/1sec-download /usr/local/bin/1sec else mkdir -p "${HOME}/.local/bin" mv /tmp/1sec-download "${HOME}/.local/bin/1sec" warn "Installed to ~/.local/bin/1sec — ensure this is in your PATH." fi rm -f /tmp/1sec-checksums.txt command -v 1sec >/dev/null 2>&1 || fail "Installation failed — 1sec not foun ...[truncated 3372 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require detached cryptographic signatures for release artifacts and verify them with a publisher public key pinned inside the audited Skill package. 2. Do not download the public verification key from the same release location during installation. 3. Pin an independently reviewed executable digest in the Skill release when practical, rather than trusting a checksum downloaded alongside the binary. 4. Publish and verify reproducible-build attestations, SBOMs, and provenance generated by a hardened build pipeline. 5. Use immutable release references and protect the upstream release workflow with restricted permissions, mandatory review, hardware-backed authentication, and protected environments. 6. Separate installation from execution. Download and verify the artifact first, display its provenance and digest, and require explicit operator approval before running it. 7. Perform initial execution in an isolated environment with minimal filesystem and network permissions. 8. Run monitoring-only functionality under a dedicated unprivileged account. Grant narrowly scoped capabilities only to components that require firewall or process-control access. 9. Avoid enabling the live `vps-agent` preset until the binary has been independently validated in dry-run mode and its provenance has been verified. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/install-and-configure.sh:73
• Finding: Predictable Shared Temporary Files Permit Symlink and File-Clobber Attacks<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install-and-configure.sh:73-107` **Vulnerability Type**: Unsafe use of predictable files in a shared temporary directory **Risk Level**: Medium ### Vulnerable Code ```bash info "Downloading 1-SEC v${VERSION} (${BINARY}) from GitHub Releases..." if command -v wget >/dev/null 2>&1; then wget -q "${RELEASE_BASE}/${BINARY}" -O /tmp/1sec-download wget -q "${RELEASE_BASE}/checksums.txt" -O /tmp/1sec-checksums.txt elif command -v curl >/dev/null 2>&1; then curl -fsSL "${RELEASE_BASE}/${BINARY}" -o /tmp/1sec-download curl -fsSL "${RELEASE_BASE}/checksums.txt" -o /tmp/1sec-checksums.txt else fail "Neither wget nor curl found. Install one and retry." fi info "Verifying SHA256 checksum..." EXPECTED_HASH="$(grep "${BINARY}" /tmp/1sec-checksums.txt | awk '{print $1}')" ACTUAL_HASH="$(sha256sum /tmp/1sec-download | awk '{print $1}')" if [ -z "$EXPECTED_HASH" ]; then rm -f /tmp/1sec-download /tmp/1sec-checksums.txt fail "Checksum for ${BINARY} not found in checksums.txt — aborting." fi if [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then rm -f /tmp/1sec-download /tmp/1sec-checksums.txt fail "Checksum mismatch! Expected: $EXPECTED_HASH Got: $ACTUAL_HASH — aborting." fi ok "Checksum verified: $ACTUAL_HASH" chmod +x /tmp/1sec-download if [ "$(id -u)" -eq 0 ]; then mv /tmp/1sec-download /usr/local/bin/1sec else mkdir -p "${HOME}/.local/bin" mv /tmp/1sec-download "${HOME}/.local/bin/1sec" warn "Installed to ~/.local/bin/1sec — ensure this is in your PATH." fi rm -f /tmp/1sec-checksums.txt ``` ### Technical Analysis The script uses fixed paths, `/tmp/1sec-download` and `/tmp/1sec-checksums.txt`, inside a globally shared temporary directory. It does not create a private temporary directory, verify file ownership, reject symbolic links, or use exclusive file creation. On a multi-user system, another local user can predict these na ...[truncated 2501 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a private temporary directory with `mktemp -d` rather than using fixed files directly under `/tmp`. 2. Set `umask 077` before creating temporary files so only the installer user can access them. 3. Install a cleanup trap immediately after creating the directory: ```bash umask 077 TMP_DIR="$(mktemp -d)" || exit 1 trap 'rm -rf -- "$TMP_DIR"' EXIT INT TERM HUP DOWNLOAD_FILE="${TMP_DIR}/1sec-download" CHECKSUM_FILE="${TMP_DIR}/checksums.txt" ``` 4. Pass `"$DOWNLOAD_FILE"` and `"$CHECKSUM_FILE"` to the downloader, hash commands, and installation commands. 5. Verify that temporary files are regular files owned by the current user and are not symbolic links before hashing or moving them. 6. Keep verification and installation within the same private directory to reduce time-of-check/time-of-use exposure. 7. When installing as root, use a root-owned staging directory with restrictive permissions and perform the final move atomically. 8. Reject pre-existing destinations or validate the existing `/usr/local/bin/1sec` target before replacement. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (45)

Self-Modification

High

• Category: Rogue Agent

Content

- No log file contents sent externally
- No automatic crash reports or error reporting

## Self-Update Mechanism

1-SEC includes a self-update feature that checks for new releases daily:

• Confidence: 90% confidence
• Finding: A self-update mechanism in a security product introduces a meaningful supply-chain and integrity risk because the running tool can replace its own binary. Even though the text says checksums are verified, the same document notes artifact signing is only planned, so compromise of the release or checksum distribution channel could lead to trusted malicious updates.

Self-Modification

High

• Category: Rogue Agent

Content

## Self-Update Mechanism

1-SEC includes a self-update feature that checks for new releases daily:

```bash
# Check for updates

• Confidence: 90% confidence
• Finding: The documented daily self-update check expands the attack surface for a tool likely to run with high privileges. In the context of a host security platform, any update channel weakness becomes especially dangerous because compromise could yield privileged code execution across protected systems.

Self-Modification

High

• Category: Rogue Agent

Content

```bash
# Check for updates
1sec selfupdate --check

# Update to latest version
1sec selfupdate

• Confidence: 90% confidence
• Finding: The explicit self-update command confirms the product can modify or replace its own executable. For a root-capable security agent, this is dangerous if update authenticity, transport, or release infrastructure is compromised, since it could transform a defender into a privileged payload delivery path.

Self-Modification

High

• Category: Rogue Agent

Content

1sec selfupdate --check

# Update to latest version
1sec selfupdate

# Disable auto-update checks
1sec config set auto_update false

• Confidence: 90% confidence
• Finding: Although this line shows auto-update checks can be disabled, it also implies update-related behavior is configurable and potentially active by default. In a security-sensitive skill, default-on update checking is still a risk multiplier because it normalizes remote maintenance behavior for a privileged binary.

Self-Modification

High

• Category: Rogue Agent

Content

1sec config set auto_update false
```

The self-update mechanism:
- Downloads from GitHub releases (same source as manual install)
- Verifies checksums before applying updates
- Creates backup of current binary before updating

• Confidence: 90% confidence
• Finding: The claim that the updater downloads and replaces the binary after checksum verification indicates active self-modification. Checksums alone are insufficient if the checksum file and binary originate from the same compromised source, making this a real supply-chain concern for a security agent with elevated capabilities.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

1sec enforce cleanup

# 3. Remove binary
sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

1sec enforce cleanup

# 3. Remove binary
sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

1sec enforce cleanup

# 3. Remove binary
sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

# 5. Remove config (if using system-wide config)
sudo rm -rf /etc/1sec

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

# 5. Remove config (if using system-wide config)
sudo rm -rf /etc/1sec

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

# 5. Remove config (if using system-wide config)
sudo rm -rf /etc/1sec

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

# 5. Remove config (if using system-wide config)
sudo rm -rf /etc/1sec

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

# 5. Remove config (if using system-wide config)
sudo rm -rf /etc/1sec

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

# 5. Remove config (if using system-wide config)
sudo rm -rf /etc/1sec

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

rm -rf ~/.1sec

# 5. Remove config (if using system-wide config)
sudo rm -rf /etc/1sec
```

## Security Audit History

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

rm -rf ~/.1sec

# 5. Remove config (if using system-wide config)
sudo rm -rf /etc/1sec
```

## Security Audit History

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Self-Modification

High

• Category: Rogue Agent

Content

```bash
# The binary checks for updates once per day on launch.
# To force an update check:
1sec selfupdate --check

# To update now:
1sec selfupdate

• Confidence: 90% confidence
• Finding: A self-update command causes the security tool to modify its own installed code, which is a sensitive operation with substantial trust implications. In an agent skill context, documenting unaudited self-modification increases the chance of unreviewed upgrades, supply-chain exposure, or unexpected behavior changes in a defensive tool running on production hosts.

Self-Modification

High

• Category: Rogue Agent

Content

1sec selfupdate --check

# To update now:
1sec selfupdate

# Or download and verify manually from GitHub Releases:
VERSION="0.5.0"  # replace with target version

• Confidence: 90% confidence
• Finding: The runbook directly instructs operators to run the self-update action, which can replace the executable without a clearly described approval or verification gate. For a security product, unguarded self-modification is particularly dangerous because compromise or mistakes affect the integrity of the tool relied upon for protection and response.

Credential Access

High

• Category: Privilege Escalation

Content

- **Exposed gateway port** — the agent's API/chat endpoint is internet-facing
- **Prompt injection** — #1 attack vector via chat channels, emails, PDFs, browsed pages
- **Malicious skill/plugin installs** — supply chain attacks via SKILL.md files
- **Credential exfiltration** — stealing API keys, tokens, .env files
- **Agent scope escalation** — agent spawning sub-agents with inherited permissions
- **Runtime file tampering** — SOUL.md, MEMORY.md, .env modification
- **C2 beaconing** — compromised agent phoning home to attacker infrastructure

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- **Exposed gateway port** — the agent's API/chat endpoint is internet-facing
- **Prompt injection** — #1 attack vector via chat channels, emails, PDFs, browsed pages
- **Malicious skill/plugin installs** — supply chain attacks via SKILL.md files
- **Credential exfiltration** — stealing API keys, tokens, .env files
- **Agent scope escalation** — agent spawning sub-agents with inherited permissions
- **Runtime file tampering** — SOUL.md, MEMORY.md, .env modification
- **C2 beaconing** — compromised agent phoning home to attacker infrastructure

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Self-Modification

High

• Category: Rogue Agent

Content

```bash
# The binary checks for updates once per day on launch.
# To force an update:
1sec selfupdate

# Or download and verify manually from GitHub Releases:
VERSION="0.5.0"  # replace with target version

• Confidence: 90% confidence
• Finding: `1sec selfupdate` introduces self-modifying behavior by allowing the security tool to replace itself, which can be dangerous if update provenance, signature verification, rollback, or channel integrity are not clearly documented. On an autonomous AI host, automatic or operator-invoked self-update can silently change security behavior or install a compromised release if the update path is attacked.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

ACTUAL_HASH="$(sha256sum /tmp/1sec-download | awk '{print $1}')"

  if [ -z "$EXPECTED_HASH" ]; then
    rm -f /tmp/1sec-download /tmp/1sec-checksums.txt
    fail "Checksum for ${BINARY} not found in checksums.txt — aborting."
  fi

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

ACTUAL_HASH="$(sha256sum /tmp/1sec-download | awk '{print $1}')"

  if [ -z "$EXPECTED_HASH" ]; then
    rm -f /tmp/1sec-download /tmp/1sec-checksums.txt
    fail "Checksum for ${BINARY} not found in checksums.txt — aborting."
  fi

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

mv /tmp/1sec-download "${HOME}/.local/bin/1sec"
    warn "Installed to ~/.local/bin/1sec — ensure this is in your PATH."
  fi
  rm -f /tmp/1sec-checksums.txt

  command -v 1sec >/dev/null 2>&1 || fail "Installation failed — 1sec not found in PATH"
  ok "1-SEC installed: $(1sec version 2>/dev/null | head -1)"

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

rm -rf ~/.1sec

# 5. Remove config (if using system-wide config)
sudo rm -rf /etc/1sec
```

## Security Audit History

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SECURITY.md:138