1-SEC: All-in-One Cybersecurity for AI Agent Hosts

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:16 PM UTC
• Version: 0.4.15

Overview

The skill is transparent about installing a server-security agent, but it relies on a powerful unsigned downloaded binary that can run with root enforcement and self-update behavior.

Install only after reviewing the upstream project and release provenance. Prefer manual download and independent verification, keep dry-run enabled until tested, avoid the vps-agent live preset on important systems without monitoring, disable self-update checks in hardened environments, and run unprivileged if you only need log-only monitoring.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install-and-configure.sh:69

Finding

Externally Hosted Unsigned Binary Is Downloaded and Executed

Content

View full analysis

/dev/null 2>&1; then ok "1sec already installed: $(1sec version 2>/dev/null | head -1)" else RELEASE_BASE="https://github.com/1sec-security/1sec/releases/download/v${VERSION}" info "Downloading 1-SEC v${VERSION} (${BINARY}) from GitHub Releases..." if command -v wget >/dev/null 2>&1; then wget -q "${RELEASE_BASE}/${BINARY}" -O /tmp/1sec-download wget -q "${RELEASE_BASE}/checksums.txt" -O /tmp/1sec-checksums.txt elif command -v curl >/dev/null 2>&1; then curl -fsSL "${RELEASE_BASE}/${BINARY}" -o /tmp/1sec-download curl -fsSL "${RELEASE_BASE}/checksums.txt" -o /tmp/1sec-checksums.txt else fail "Neither wget nor curl found. Install one and retry." fi info "Verifying SHA256 checksum..." EXPECTED_HASH="$(grep "${BINARY}" /tmp/1sec-checksums.txt | awk '{print $1}')" ACTUAL_HASH="$(sha256sum /tmp/1sec-download | awk '{print $1}')" if [ -z "$EXPECTED_HASH" ]; then rm -f /tmp/1sec-download /tmp/1sec-checksums.txt fail "Checksum for ${BINARY} not found in checksums.txt — aborting." fi if [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then rm -f /tmp/1sec-download /tmp/1sec-checksums.txt fail "Checksum mismatch! Expected: $EXPECTED_HASH Got: $ACTUAL_HASH — aborting." fi ok "Checksum verified: $ACTUAL_HASH" chmod +x /tmp/1sec-download if [ "$(id -u)" -eq 0 ]; then mv /tmp/1sec-download /usr/local/bin/1sec else mkdir -p "${HOME}/.local/bin" mv /tmp/1sec-download "${HOME}/.local/bin/1sec" warn "Installed to ~/.local/bin/1sec — ensure this is in your PATH." fi rm -f /tmp/1sec-checksums.txt command -v 1sec >/dev/null 2>&1 || fail "Installation failed — 1sec not foun ...[truncated 3372 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/install-and-configure.sh:73

Finding

Predictable Shared Temporary Files Permit Symlink and File-Clobber Attacks

Content

View full analysis

/dev/null 2>&1; then wget -q "${RELEASE_BASE}/${BINARY}" -O /tmp/1sec-download wget -q "${RELEASE_BASE}/checksums.txt" -O /tmp/1sec-checksums.txt elif command -v curl >/dev/null 2>&1; then curl -fsSL "${RELEASE_BASE}/${BINARY}" -o /tmp/1sec-download curl -fsSL "${RELEASE_BASE}/checksums.txt" -o /tmp/1sec-checksums.txt else fail "Neither wget nor curl found. Install one and retry." fi info "Verifying SHA256 checksum..." EXPECTED_HASH="$(grep "${BINARY}" /tmp/1sec-checksums.txt | awk '{print $1}')" ACTUAL_HASH="$(sha256sum /tmp/1sec-download | awk '{print $1}')" if [ -z "$EXPECTED_HASH" ]; then rm -f /tmp/1sec-download /tmp/1sec-checksums.txt fail "Checksum for ${BINARY} not found in checksums.txt — aborting." fi if [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then rm -f /tmp/1sec-download /tmp/1sec-checksums.txt fail "Checksum mismatch! Expected: $EXPECTED_HASH Got: $ACTUAL_HASH — aborting." fi ok "Checksum verified: $ACTUAL_HASH" chmod +x /tmp/1sec-download if [ "$(id -u)" -eq 0 ]; then mv /tmp/1sec-download /usr/local/bin/1sec else mkdir -p "${HOME}/.local/bin" mv /tmp/1sec-download "${HOME}/.local/bin/1sec" warn "Installed to ~/.local/bin/1sec — ensure this is in your PATH." fi rm -f /tmp/1sec-checksums.txt ``` ### Technical Analysis The script uses fixed paths, `/tmp/1sec-download` and `/tmp/1sec-checksums.txt`, inside a globally shared temporary directory. It does not create a private temporary directory, verify file ownership, reject symbolic links, or use exclusive file creation. On a multi-user system, another local user can predict these na ...[truncated 2501 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (45)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

A self-update mechanism in a security product introduces a meaningful supply-chain and integrity risk because the running tool can replace its own binary. Even though the text says checksums are verified, the same document notes artifact signing is only planned, so compromise of the release or checksum distribution channel could lead to trusted malicious updates.

Content

Scanner excerpt · SECURITY.md (reported line 83)May include surrounding context.

md

- No log file contents sent externally
- No automatic crash reports or error reporting

## Self-Update Mechanism

1-SEC includes a self-update feature that checks for new releases daily:

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The documented daily self-update check expands the attack surface for a tool likely to run with high privileges. In the context of a host security platform, any update channel weakness becomes especially dangerous because compromise could yield privileged code execution across protected systems.

Content

Scanner excerpt · SECURITY.md (reported line 85)May include surrounding context.

Self-Update Mechanism

1-SEC includes a self-update feature that checks for new releases daily:

bash

# Check for updates

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The explicit self-update command confirms the product can modify or replace its own executable. For a root-capable security agent, this is dangerous if update authenticity, transport, or release infrastructure is compromised, since it could transform a defender into a privileged payload delivery path.

Content

Scanner excerpt · SECURITY.md (reported line 89)May include surrounding context.

bash

# Check for updates
1sec selfupdate --check

# Update to latest version
1sec selfupdate

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Although this line shows auto-update checks can be disabled, it also implies update-related behavior is configurable and potentially active by default. In a security-sensitive skill, default-on update checking is still a risk multiplier because it normalizes remote maintenance behavior for a privileged binary.

Content

Scanner excerpt · SECURITY.md (reported line 92)May include surrounding context.

md

1sec selfupdate --check

# Update to latest version
1sec selfupdate

# Disable auto-update checks
1sec config set auto_update false

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The claim that the updater downloads and replaces the binary after checksum verification indicates active self-modification. Checksums alone are insufficient if the checksum file and binary originate from the same compromised source, making this a real supply-chain concern for a security agent with elevated capabilities.

Content

Scanner excerpt · SECURITY.md (reported line 98)May include surrounding context.

1sec config set auto_update false

text

The self-update mechanism:
- Downloads from GitHub releases (same source as manual install)
- Verifies checksums before applying updates
- Creates backup of current binary before updating

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SECURITY.md (reported line 132)May include surrounding context.

md

1sec enforce cleanup

# 3. Remove binary
sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 383)May include surrounding context.

md

1sec enforce cleanup

# 3. Remove binary
sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/vps-agent-guide.md (reported line 249)May include surrounding context.

md

1sec enforce cleanup

# 3. Remove binary
sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SECURITY.md (reported line 135)May include surrounding context.

md

sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

# 5. Remove config (if using system-wide config)
sudo rm -rf /etc/1sec

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 384)May include surrounding context.

md

sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

# 5. Remove config (if using system-wide config)
sudo rm -rf /etc/1sec

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/vps-agent-guide.md (reported line 250)May include surrounding context.

md

sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

# 5. Remove config (if using system-wide config)
sudo rm -rf /etc/1sec

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SECURITY.md (reported line 135)May include surrounding context.

md

sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

# 5. Remove config (if using system-wide config)
sudo rm -rf /etc/1sec

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 384)May include surrounding context.

md

sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

# 5. Remove config (if using system-wide config)
sudo rm -rf /etc/1sec

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/vps-agent-guide.md (reported line 250)May include surrounding context.

md

sudo rm /usr/local/bin/1sec

# 4. Remove data directory
rm -rf ~/.1sec

# 5. Remove config (if using system-wide config)
sudo rm -rf /etc/1sec

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SECURITY.md (reported line 138)May include surrounding context.

rm -rf ~/.1sec

5. Remove config (if using system-wide config)

sudo rm -rf /etc/1sec

text

## Security Audit History

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SECURITY.md (reported line 138)May include surrounding context.

rm -rf ~/.1sec

5. Remove config (if using system-wide config)

sudo rm -rf /etc/1sec

text

## Security Audit History

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

A self-update command causes the security tool to modify its own installed code, which is a sensitive operation with substantial trust implications. In an agent skill context, documenting unaudited self-modification increases the chance of unreviewed upgrades, supply-chain exposure, or unexpected behavior changes in a defensive tool running on production hosts.

Content

Scanner excerpt · references/operations-runbook.md (reported line 182)May include surrounding context.

bash

# The binary checks for updates once per day on launch.
# To force an update check:
1sec selfupdate --check

# To update now:
1sec selfupdate

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The runbook directly instructs operators to run the self-update action, which can replace the executable without a clearly described approval or verification gate. For a security product, unguarded self-modification is particularly dangerous because compromise or mistakes affect the integrity of the tool relied upon for protection and response.

Content

Scanner excerpt · references/operations-runbook.md (reported line 185)May include surrounding context.

md

1sec selfupdate --check

# To update now:
1sec selfupdate

# Or download and verify manually from GitHub Releases:
VERSION="0.5.0"  # replace with target version

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/vps-agent-guide.md (reported line 13)May include surrounding context.

md

- **Exposed gateway port** — the agent's API/chat endpoint is internet-facing
- **Prompt injection** — #1 attack vector via chat channels, emails, PDFs, browsed pages
- **Malicious skill/plugin installs** — supply chain attacks via SKILL.md files
- **Credential exfiltration** — stealing API keys, tokens, .env files
- **Agent scope escalation** — agent spawning sub-agents with inherited permissions
- **Runtime file tampering** — SOUL.md, MEMORY.md, .env modification
- **C2 beaconing** — compromised agent phoning home to attacker infrastructure

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/vps-agent-guide.md (reported line 15)May include surrounding context.

md

- **Exposed gateway port** — the agent's API/chat endpoint is internet-facing
- **Prompt injection** — #1 attack vector via chat channels, emails, PDFs, browsed pages
- **Malicious skill/plugin installs** — supply chain attacks via SKILL.md files
- **Credential exfiltration** — stealing API keys, tokens, .env files
- **Agent scope escalation** — agent spawning sub-agents with inherited permissions
- **Runtime file tampering** — SOUL.md, MEMORY.md, .env modification
- **C2 beaconing** — compromised agent phoning home to attacker infrastructure

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

1sec selfupdate introduces self-modifying behavior by allowing the security tool to replace itself, which can be dangerous if update provenance, signature verification, rollback, or channel integrity are not clearly documented. On an autonomous AI host, automatic or operator-invoked self-update can silently change security behavior or install a compromised release if the update path is attacked.

Content

Scanner excerpt · references/vps-agent-guide.md (reported line 230)May include surrounding context.

bash

# The binary checks for updates once per day on launch.
# To force an update:
1sec selfupdate

# Or download and verify manually from GitHub Releases:
VERSION="0.5.0"  # replace with target version

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/install-and-configure.sh (reported line 89)May include surrounding context.

sh

ACTUAL_HASH="$(sha256sum /tmp/1sec-download | awk '{print $1}')"

  if [ -z "$EXPECTED_HASH" ]; then
    rm -f /tmp/1sec-download /tmp/1sec-checksums.txt
    fail "Checksum for ${BINARY} not found in checksums.txt — aborting."
  fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/install-and-configure.sh (reported line 94)May include surrounding context.

sh

ACTUAL_HASH="$(sha256sum /tmp/1sec-download | awk '{print $1}')"

  if [ -z "$EXPECTED_HASH" ]; then
    rm -f /tmp/1sec-download /tmp/1sec-checksums.txt
    fail "Checksum for ${BINARY} not found in checksums.txt — aborting."
  fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/install-and-configure.sh (reported line 108)May include surrounding context.

sh

mv /tmp/1sec-download "${HOME}/.local/bin/1sec"
    warn "Installed to ~/.local/bin/1sec — ensure this is in your PATH."
  fi
  rm -f /tmp/1sec-checksums.txt

  command -v 1sec >/dev/null 2>&1 || fail "Installation failed — 1sec not found in PATH"
  ok "1-SEC installed: $(1sec version 2>/dev/null | head -1)"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SECURITY.md (reported line 138)May include surrounding context.

rm -rf ~/.1sec

5. Remove config (if using system-wide config)

sudo rm -rf /etc/1sec

text

## Security Audit History

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SECURITY.md:138