考研数学智慧课程制作

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:29 AM UTC
• Version: 4.0.0

Overview

The skill is mostly a coherent course-creation guide, but its deployment instructions normalize root SSH/SCP access to a live web directory without adequate safeguards.

Review the deployment instructions before installing or using this skill. Do not let an agent run the root SCP examples as written; replace them with a restricted deploy user, scoped destination paths, staging or dry-run checks, backups, and explicit user confirmation before any remote write.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:205

Finding

Root-Level SSH Deployment Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 205–207
Vulnerability Type: Direct privileged SSH deployment
Risk Level: Medium

Complete Code Snippet:

bash

scp -B -i ~/.ssh/deploy_ode_course player-data/eXX.js root@host:/www/wwwroot/moodle/ode-course/player-data/
scp -B -i ~/.ssh/deploy_ode_course podcast_video_v4.html root@host:/www/wwwroot/moodle/ode-course/
scp -B -i ~/.ssh/deploy_ode_course quiz-bank-expansion-3.js root@host:/www/wwwroot/moodle/

Technical Analysis

The documented deployment procedure authenticates directly to the destination host as root using a private SSH identity. Uploading static course assets only requires narrowly scoped write access to the relevant web directories; unrestricted superuser access is unnecessary.

The operation is consistent with the Skill's declared deployment functionality, and the document does not expose the private key itself. Nevertheless, using a root-capable key breaks the principle of least privilege and substantially increases the consequences of key theft, deployment-host compromise, operator error, or malicious modification of files supplied to the deployment workflow.

Attack Path

1. An attacker compromises the workstation, CI environment, agent context, or account that can read ~/.ssh/deploy_ode_course.
2. The attacker obtains the private key or causes the documented deployment command to run with attacker-controlled behavior.
3. If the destination accepts that key for unrestricted root authentication, the attacker connects as root.
4. The attacker modifies files outside the intended course directories, alters server configuration, installs persistent services, accesses hosted application data, or pivots to other resources available from the server.

This path depends on the referenced key actually being authorized for unrestricted root access; the repository does not contain enough evidence to confirm the destination's SS ...[truncated 614 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a dedicated, unprivileged deployment account with no interactive administrative rights.
2. Grant that account write access only to the required course deployment directories.
3. Disable direct root SSH login by setting PermitRootLogin no in the SSH server configuration.
4. Use a deployment-specific key that is not shared with administrative workflows and protect it with appropriate filesystem permissions and secret-management controls.
5. Restrict the public key in authorized_keys using applicable options such as a forced command, source-address restrictions, disabled port forwarding, disabled agent forwarding, disabled X11 forwarding, and disabled PTY allocation.
6. Prefer a controlled deployment service or CI/CD job that validates artifact paths and content before publication.
7. Log and monitor deployment authentication and file changes, and rotate the key immediately if exposure is suspected.
8. Update the documentation so all sample commands use the restricted deployment account rather than root.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill includes concrete production deployment commands that use SSH keys and a privileged remote account (root@host) to copy files into a live web directory. In an agent setting, this is dangerous because it normalizes high-privilege remote operations without safeguards, confirmation steps, environment scoping, or warnings about credential handling and overwrite risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The quick-start workflow tells the user to deploy with scp -B -i key as part of a streamlined sequence, but it omits warnings about overwriting remote files, validating the destination, or protecting private keys. In a skill consumed by an automation agent, terse deploy steps increase the chance of unsafe execution against the wrong host or environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.