T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SERVER_PROFILE.md:7- Finding
Shared Root SSH Key Creates Fleet-Wide Privilege Exposure
- Content
View full analysis
- Remediation
View remediation
Security audit
Linux Security Guardian
Security checks for vulnerabilities and agentic risk
Overview
The skill is not clearly malicious, but it requests broad scheduled root-level server control with weak scoping and approval safeguards.
Review before installing. Use isolated testing first, replace the shared root key with per-host or per-client least-privilege credentials, authenticate approval replies through a trusted channel, remove or heavily restrict APPROVE ALL, validate client/server identifiers before file writes, and disable local CVE inventory fallback unless explicitly intended. Also decide whether /etc/shadow-derived checks can be replaced with safer derived-only outputs and redaction controls.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
hooks/on-confirm-reply.md:6- Finding
Approval Hook Does Not Explicitly Authenticate the Authorizing Sender
- Content
View full analysis
/ DENY / SKIP ## Parse Reply ``` ```text Extract: action = APPROVE/DENY/SKIP Extract: ID = ACT-YYYYMMDD-NNN, FW-YYYYMMDD-NNN, or --- ID format: --- Example: client-1-server-01-ACT-20260529-001 Search: actions///pending-confirm/-*.md If not found → search all pending-confirm across all clients/servers → Still not found? "Action ID not found. Use STATUS to see all pending." ``` ```markdown ## On APPROVE ``` ```text 1. Read the full action spec from pending-confirm file (includes client + server) 2. Confirm safety: run pre-action.md checks with client/server context 3. Execute the action via SSH MCP (connect to the server from the action file) 4. Run post-action.md verification 5. Move file: actions///pending-confirm/ → actions///history/ 6. Reply: "✓ Action executed on /: | Result: " 7. Update soul [PENDING CONFIRMATIONS] — remove entry ``` ```markdown ## Bulk Operations Owner can send: "APPROVE ALL" → approve all pending (with safety checks on each) Owner can send: "STATUS" → list all pending confirmations with descriptions ``` ### Technical Analysis The hook defines authorization in terms of message contents but does not specify how the sender is authenticated as the owner. It lacks an explicit sender allowlist, trusted-channel binding, signature verification, nonce, approval expiry validation at execution time, and replay protection. The pre-action hook checks whether an operation is allowed or reversible, but it does not authenticate the party granting approval. Consequently, any integration that p ...[truncated 1396 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
cve/cve-scan.sh:29- Finding
Unvalidated Client and Server Identifiers Permit Filesystem Path Traversal
- Content
View full analysis
&2; exit 1 ;; esac done if [ -z "$CLIENT" ] || [ -z "$SERVER" ]; then echo "Usage: bash cve/cve-scan.sh --client --server " >&2 exit 1 fi SCAN_DATE=$(date +%F) BASE_DIR="$(cd "$(dirname "$0")/.." && pwd)" SCAN_DIR="$BASE_DIR/cve" # Per-client/per-server output RESULTS_DIR="$SCAN_DIR/$CLIENT/$SERVER/scan-results" ADVISORIES_DIR="$SCAN_DIR/$CLIENT/$SERVER/advisories" CACHE_DIR="$SCAN_DIR/.cache" mkdir -p "$RESULTS_DIR" "$ADVISORIES_DIR" "$CACHE_DIR" ``` ### Technical Analysis The script accepts arbitrary values for `--client` and `--server` and inserts them directly into output paths. Shell quoting prevents whitespace splitting and wildcard expansion, but it does not neutralize path components such as `..`. No identifier allowlist, canonicalization, or containment check confirms that the resulting paths remain beneath `$SCAN_DIR`. The script subsequently creates directories and writes predictable report, advisory, and JSON files through these derived paths. This issue is directly exploitable by any actor or compromised orchestration component able to control scanner arguments. The effective filesystem reach is limited by the operating-system permissions of the process running the scanner. ### Attack Path 1. An attacker invokes or influences invocation of the scanner with a traversal value, for example: ```bash bash cve/cve-scan.sh --client ../../target --server chosen ``` 2. The script constructs `RESULTS_DIR` and `ADVISORIES_DIR` using the unvalidated value. 3. Filesystem normalization resolves the `..` components outside the intended `cve//- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
cve/cve-scan.sh:292- Finding
Local Fallback Transmits Guardian-Host Package Inventory to OSV
- Content
View full analysis
/dev/null; then dpkg-query -W -f='${Package}\t${Version}\n' 2>/dev/null | head -100 > "$packages_file" info "OSV.dev: ran dpkg-query locally (fallback)" elif command -v rpm &>/dev/null; then rpm -qa --queryformat '%{NAME}\t%{VERSION}\n' 2>/dev/null | head -100 > "$packages_file" info "OSV.dev: ran rpm locally (fallback)" else skip "OSV.dev: no package manager found (dpkg/rpm)" return 1 fi ``` ```bash if ! safe_curl_post \ "https://api.osv.dev/v1/querybatch" \ "$batch_queries" \ "$osv_results" \ "OSV.dev" 60; then skip "OSV.dev: batch query failed" return 1 fi ``` ### Technical Analysis If the target server's package snapshot is absent, the script can inventory the local guardian host through `dpkg-query` or `rpm`. It then submits those package names and versions to the documented OSV API. OSV is a legitimate vulnerability service, and package/version information is relevant to CVE matching. The vulnerability is therefore not covert exfiltration. The problem is that the behavior silently changes the scan subject from the selected remote server to the guardian host, contrary to the remote-target workflow and stated ...[truncated 1387 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (126)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The profile specifies a single shared SSH private key path used across all servers and explicitly states that all servers use the same root key. In a multi-client security automation context, compromise of that one key would grant broad root access across the entire fleet, creating a high-value single point of failure and enabling cross-client compromise.
- Content
md ## SSH MCP (REQUIRED — hard dependency) - ssh_mcp_version: v2 - shared_key: ~/.ssh/id_ed25519 # All servers use same root key ## Email Accounts - default: "" # The account used for ALL outgoing reports and alerts
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
This server entry shows root access configured with the same reusable SSH key path. Combined with the global shared_key setting, it reinforces that privileged access is centralized into one credential, magnifying blast radius if the key or agent environment is compromised.
- Content
md | Server Name | Host | Port | Username | Key Path | Connection ID | |-------------|------|------|----------|----------|---------------| | server-01 | | 22 | root | ~/.ssh/id_ed25519 | | | server-02 | | 22 | root | ~/.ssh/id_ed25519 | | | server-03 | | 22 | root | ~/.ssh/id_ed25519 | | | server-04 | | 22 | root | ~/.ssh/id_ed25519 | |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
This line repeats the pattern of direct root access using the same SSH key path for another server. Reuse of a privileged credential across multiple systems materially increases the chance of lateral movement and whole-fleet compromise.
- Content
md | Server Name | Host | Port | Username | Key Path | Connection ID | |-------------|------|------|----------|----------|---------------| | server-01 | | 22 | root | ~/.ssh/id_ed25519 | | | server-02 | | 22 | root | ~/.ssh/id_ed25519 | | | server-03 | | 22 | root | ~/.ssh/id_ed25519 | | | server-04 | | 22 | root | ~/.ssh/id_ed25519 | | | server-05 | | 22 | root | ~/.ssh/id_ed25519 | |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
Another server is configured for root login with the same key path, confirming a systemic credential-reuse issue rather than an isolated example. In a multi-client fleet-management skill, this design makes credential theft exceptionally damaging.
- Content
md |-------------|------|------|----------|----------|---------------| | server-01 | | 22 | root | ~/.ssh/id_ed25519 | | | server-02 | | 22 | root | ~/.ssh/id_ed25519 | | | server-03 | | 22 | root | ~/.ssh/id_ed25519 | | | server-04 | | 22 | root | ~/.ssh/id_ed25519 | | | server-05 | | 22 | root | ~/.ssh/id_ed25519 | | | server-06 | | 22 | root | ~/.ssh/id_ed25519 | |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
This line continues the same pattern of root plus shared key usage. Because the skill runs autonomous nightly audits, any compromise of the executing environment or its key store could repeatedly expose or misuse this credential at scale.
- Content
md | server-01 | | 22 | root | ~/.ssh/id_ed25519 | | | server-02 | | 22 | root | ~/.ssh/id_ed25519 | | | server-03 | | 22 | root | ~/.ssh/id_ed25519 | | | server-04 | | 22 | root | ~/.ssh/id_ed25519 | | | server-05 | | 22 | root | ~/.ssh/id_ed25519 | | | server-06 | | 22 | root | ~/.ssh/id_ed25519 | | | server-07 | | 22 | root | ~/.ssh/id_ed25519 | |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The configuration again ties privileged access for an additional server to the same SSH private key path. Repetition across fleet entries demonstrates insecure access architecture with substantial lateral-movement risk.
- Content
md | server-02 | | 22 | root | ~/.ssh/id_ed25519 | | | server-03 | | 22 | root | ~/.ssh/id_ed25519 | | | server-04 | | 22 | root | ~/.ssh/id_ed25519 | | | server-05 | | 22 | root | ~/.ssh/id_ed25519 | | | server-06 | | 22 | root | ~/.ssh/id_ed25519 | | | server-07 | | 22 | root | ~/.ssh/id_ed25519 | |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
This server record indicates direct root authentication through the same common key path. The danger is amplified because the skill spans multiple client environments, so one stolen key could collapse tenant separation and trust boundaries.
- Content
md | server-03 | | 22 | root | ~/.ssh/id_ed25519 | | | server-04 | | 22 | root | ~/.ssh/id_ed25519 | | | server-05 | | 22 | root | ~/.ssh/id_ed25519 | | | server-06 | | 22 | root | ~/.ssh/id_ed25519 | | | server-07 | | 22 | root | ~/.ssh/id_ed25519 | | ### Per-Server Config
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
This final listed server also uses the same root key path, confirming consistent insecure credential reuse across the fleet. A single exposed private key would enable unauthorized root-level access to many servers with minimal additional effort.
- Content
md | server-04 | | 22 | root | ~/.ssh/id_ed25519 | | | server-05 | | 22 | root | ~/.ssh/id_ed25519 | | | server-06 | | 22 | root | ~/.ssh/id_ed25519 | | | server-07 | | 22 | root | ~/.ssh/id_ed25519 | | ### Per-Server Config
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md ### Per-Server Config | Server | Expected Ports | Expected Services | Sudo Users | SSL Domains | |--------|---------------|-------------------|------------|-------------| | server-01 | 22, 80, 443 | sshd, nginx | | | | server-02 | 22, 80, 443 | sshd, nginx | | |
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md ### Per-Server Config | Server | Expected Ports | Expected Services | Sudo Users | SSL Domains | |--------|---------------|-------------------|------------|-------------| | server-01 | 22, 80, 443 | sshd, nginx | | | | server-02 | 22, 80, 443 | sshd, nginx | | |
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a comprehensive remote Linux security management skill with broad auditing and some controlled remediation across all clients and servers. The actual code chunk is much narrower: it only performs external CVE-source aggregation and report generation for one client/server at a time. It does include some declared sub-scope—specifically CISA KEV, OSV.dev, and NVD-based CVE scanning—but the overwhelming majority of the declared functionality is absent in this code. Additionally, the implementation includes local system inspection fallbacks (dpkg-query, rpm, /etc/os-release), which suggests local execution behavior rather than purely SSH-based remote fleet management. This is a material description/behavior mismatch, even if this file could be one component of a larger system, because the supplied chunk itself does not substantiate most of the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The supplied code does not implement the declared security-audit behavior. Instead, its primary purpose is maintaining backups of the skill's own files and restoring them locally. This is materially different from autonomous SSH-based Linux server security management, CVE scanning, hardening, reporting, or scheduled audit execution. The script also uses hardcoded local paths, which conflicts with the declaration that owner-specific configuration lives in config and that there are no hardcoded names/domains/emails; while not about emails/domains directly, it still shows undeclared, specific local resource usage. This is not merely a supporting implementation detail for auditing—it is a separate maintenance capability with distinct behavior and resources.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
Reading /etc/shadow specifically exposes password-hash data and account metadata from remote hosts. In a multi-client automation context, centralizing such material on the guardian host or including it in artifacts dramatically enlarges blast radius if the host, logs, or email channel are compromised.
- Content
md | Module | What it checks | SSH MCP Command | |--------|---------------|-----------------| | `01-system` | OS, kernel, uptime, last reboot, hardware | `ssh_exec(op="run", sessionId, command="uname -a; cat /etc/*release")` | | `02-users` | Accounts, root access, sudo, empty passwords, inactive | `ssh_exec(op="run", sessionId, command="cat /etc/passwd; cat /etc/shadow; ...")` | | `03-ssh` | sshd_config full audit — 20+ checks + weak ciphers/MACs/KexAlgorithms (CIS) | `ssh_exec(op="run", sessionId, command="cat /etc/ssh/sshd_config; sshd -T 2>/dev/null | grep -iE 'ciphers|macs|kex'")` | | `04-auth` | Login history, failed logins, PAM config, fail2ban auto-install + SSH jail config, password policy enforcement | `ssh_exec(op="run", sessionId, command="last; cat /var/log/auth.log")` | | `05-services` | Running services, unnecessary ones, failed units | `ssh_exec(op="run", sessionId, command="systemctl list-units ...")` |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
Reading /etc/shadow specifically exposes password-hash data and account metadata from remote hosts. In a multi-client automation context, centralizing such material on the guardian host or including it in artifacts dramatically enlarges blast radius if the host, logs, or email channel are compromised.
- Content
md | Module | What it checks | SSH MCP Command | |--------|---------------|-----------------| | `01-system` | OS, kernel, uptime, last reboot, hardware | `ssh_exec(op="run", sessionId, command="uname -a; cat /etc/*release")` | | `02-users` | Accounts, root access, sudo, empty passwords, inactive | `ssh_exec(op="run", sessionId, command="cat /etc/passwd; cat /etc/shadow; ...")` | | `03-ssh` | sshd_config full audit — 20+ checks + weak ciphers/MACs/KexAlgorithms (CIS) | `ssh_exec(op="run", sessionId, command="cat /etc/ssh/sshd_config; sshd -T 2>/dev/null | grep -iE 'ciphers|macs|kex'")` | | `04-auth` | Login history, failed logins, PAM config, fail2ban auto-install + SSH jail config, password policy enforcement | `ssh_exec(op="run", sessionId, command="last; cat /var/log/auth.log")` | | `05-services` | Running services, unnecessary ones, failed units | `ssh_exec(op="run", sessionId, command="systemctl list-units ...")` |
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # Linux Security Guardian — Soul Context ## [WORKSPACE OWNER] <!-- Loaded from core-extra/config/profile.md at runtime --> - Owner: [core-extra/config/profile.md → Owner.name] - Server: linux-security-guardian - Initialized: [YYYY-MM-DD]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Commands
bash # All users with login shell grep -v "nologin\|false\|sync\|halt\|shutdown" /etc/passwd | cut -d: -f1,3,6,7 # UID 0 accounts (should only be root) awk -F: '($3 == 0) { print $1 }' /etc/passwd
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Commands
bash # All users with login shell grep -v "nologin\|false\|sync\|halt\|shutdown" /etc/passwd | cut -d: -f1,3,6,7 # UID 0 accounts (should only be root) awk -F: '($3 == 0) { print $1 }' /etc/passwd
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Commands
bash # All users with login shell grep -v "nologin\|false\|sync\|halt\|shutdown" /etc/passwd | cut -d: -f1,3,6,7 # UID 0 accounts (should only be root) awk -F: '($3 == 0) { print $1 }' /etc/passwd
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Commands
bash # All users with login shell grep -v "nologin\|false\|sync\|halt\|shutdown" /etc/passwd | cut -d: -f1,3,6,7 # UID 0 accounts (should only be root) awk -F: '($3 == 0) { print $1 }' /etc/passwd
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Commands
bash # All users with login shell grep -v "nologin\|false\|sync\|halt\|shutdown" /etc/passwd | cut -d: -f1,3,6,7 # UID 0 accounts (should only be root) awk -F: '($3 == 0) { print $1 }' /etc/passwd
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Commands
bash # All users with login shell grep -v "nologin\|false\|sync\|halt\|shutdown" /etc/passwd | cut -d: -f1,3,6,7 # UID 0 accounts (should only be root) awk -F: '($3 == 0) { print $1 }' /etc/passwd
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Commands
bash # All users with login shell grep -v "nologin\|false\|sync\|halt\|shutdown" /etc/passwd | cut -d: -f1,3,6,7 # UID 0 accounts (should only be root) awk -F: '($3 == 0) { print $1 }' /etc/passwd
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Commands
bash # All users with login shell grep -v "nologin\|false\|sync\|halt\|shutdown" /etc/passwd | cut -d: -f1,3,6,7 # UID 0 accounts (should only be root) awk -F: '($3 == 0) { print $1 }' /etc/passwd
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The module instructs reading
/etc/shadow, a highly sensitive credential store, to detect empty passwords. Although the intent is defensive, this increases exposure of credential material in an autonomous system that also sends reports externally; unsafe logging, transport, or reuse of raw command output could leak sensitive account data.- Content
md ls /etc/sudoers.d/ # Empty passwords (CRITICAL) awk -F: '($2 == "" || $2 == "!!" ) { print $1 }' /etc/shadow 2>/dev/null # Password age awk -F: '{print $1, $5}' /etc/shadow 2>/dev/null | grep "^[^:]*:[0-9]"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
This command again reads
/etc/shadowto inspect password age, which touches credential-adjacent sensitive data. In an autonomous multi-client audit pipeline, centralizing or exporting this information can expand blast radius if logs, reports, or the email plugin are compromised.- Content
md awk -F: '($2 == "" || $2 == "!!" ) { print $1 }' /etc/shadow 2>/dev/null # Password age awk -F: '{print $1, $5}' /etc/shadow 2>/dev/null | grep "^[^:]*:[0-9]" # Last login for all users lastlog | grep -v "Never\|Username"
Static analysis
No suspicious patterns detected.