Security audit

Kefal Guard

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed security monitor, but it relies on a separate agent that can run with elevated access, continuously collect host and SSH identity metadata, and send telemetry to kefal.dev.

Install only if you are comfortable running a vendor agent on the monitored host, potentially with sudo during enrollment, and sending host inventory plus SSH authorized-key fingerprint telemetry to kefal.dev. Verify the agent binary independently, prefer least-privilege operation, and ask the publisher for exact telemetry schema, retention/deletion controls, update policy, and confinement guidance before using it on sensitive systems.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:53
Finding: Overprivileged Host and SSH Authorization Reconnaissance
Content: View full analysis
/stat` on Linux, equivalent APIs on macOS/Windows. The agent does not read process memory or open file descriptors.) - Listening ports — port number, protocol, owning process name. (Source: `/proc/net/tcp` and equivalents. The agent does not capture packets or read network traffic.) - User accounts with shell access — username and login state. (Source: `/etc/passwd` for the username list, `utmp` for active sessions. The agent reads these as a non-root user when possible; sudo is only needed for full process visibility.) - SSH authorized keys — public key fingerprints in `~/.ssh/authorized_keys`. (Source: the file is read line-by-line as text. The agent never touches private keys; private keys live in different files and are never read.) The agent does NOT read application data (databases, application config, business documents), does NOT capture network traffic, and does NOT modify any system file. All telemetry is transmitted over TLS 1.3 to kefal.dev. Each tenant's data is isolated; no data is shared with other customers. ``` From `README.md:45-51`: ```markdown ## Permissions Justification | Permission | Why | |---|---| | `exec` (shell commands) | The skill invokes `kefal-agent --status` / `--scan` to read the agent's output. The agent binary is installed and reviewed separately by the operator (this skill never downloads or executes remote code). | | Network (outbound to kefal.dev) | The agent — not the skill — reports scan telemetry to your dashboard over TLS 1.3. The skill only reads local agent output. | | sudo (o ...[truncated 2792 chars]
Remediation: View remediation

other

Warning

Location: SKILL.md:53
Finding: External Transmission of Sensitive Infrastructure Telemetry
Content: View full analysis
/stat` on Linux, equivalent APIs on macOS/Windows. The agent does not read process memory or open file descriptors.) - Listening ports — port number, protocol, owning process name. (Source: `/proc/net/tcp` and equivalents. The agent does not capture packets or read network traffic.) - User accounts with shell access — username and login state. (Source: `/etc/passwd` for the username list, `utmp` for active sessions. The agent reads these as a non-root user when possible; sudo is only needed for full process visibility.) - SSH authorized keys — public key fingerprints in `~/.ssh/authorized_keys`. (Source: the file is read line-by-line as text. The agent never touches private keys; private keys live in different files and are never read.) The agent does NOT read application data (databases, application config, business documents), does NOT capture network traffic, and does NOT modify any system file. All telemetry is transmitted over TLS 1.3 to kefal.dev. Each tenant's data is isolated; no data is shared with other customers. ``` ### Technical Analysis The agent sends process, service, account, session, and SSH public-key fingerprint telemetry to an external service. TLS 1.3 protects the transmission channel but does not reduce the sensitivity of the collected data or control how the receiving service stores and uses it. The audited documentation does not specify an exact payload schema, field-level redaction, server-side retention periods, deletion controls, regional storage, or a local-only operating mode. Public ke ...[truncated 1490 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:27
Finding: Unverifiable Externally Distributed Agent in the Trusted Execution Path
Content: View full analysis
`, `/kefal graph`. ``` ### Technical Analysis The audited package contains no agent source, executable, pinned release version, checksum, or signature. Instead, installation and verification are delegated to a mutable external website. The statement that downloaded hashes may be matched against a “future open-source release” means the current executable cannot be reproduced or compared wi ...[truncated 1863 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Reading ~/.ssh/authorized_keys is access to sensitive authentication metadata, and the same section states telemetry is reported to kefal.dev. Even if only public keys are collected, this exposes identity and account-mapping information that could aid reconnaissance or create privacy and trust concerns if transmitted or stored externally.
Content: Scanner excerpt · README.md (reported line 49)May include surrounding context.
md
|---|---| | `exec` (shell commands) | The skill invokes `kefal-agent --status` / `--scan` to read the agent's output. The agent binary is installed and reviewed separately by the operator (this skill never downloads or executes remote code). | | Network (outbound to kefal.dev) | The agent — not the skill — reports scan telemetry to your dashboard over TLS 1.3. The skill only reads local agent output. | | sudo (operator-side, one-time) | The operator runs the agent as root once during initial enrollment so it can read `/proc`, listening ports, and `~/.ssh/authorized_keys` for the system view. The skill itself does not request sudo. | What the agent reads: process list (name/PID/user), listening ports (port/proto/owner), user accounts (`/etc/passwd`), SSH authorized public keys. What it does NOT read: process memory, file contents (databases, configs, documents), network packets, or private keys. What it does NOT modify: nothing — the agent is read-only by design and never writes to your system.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 81% confidence
Finding: The documented design combines multiple sensitive elements: exec permission, a separately installed agent, root-level enrollment, access to host identity data, and outbound telemetry to a vendor service. This creates a meaningful chaining risk because a compromised skill, replaced binary, or weak trust boundary could turn a nominally read-only monitor into a privileged data-exfiltration path.
Content: Scanner excerpt · README.md (reported line 49)May include surrounding context.
md
|---|---| | `exec` (shell commands) | The skill invokes `kefal-agent --status` / `--scan` to read the agent's output. The agent binary is installed and reviewed separately by the operator (this skill never downloads or executes remote code). | | Network (outbound to kefal.dev) | The agent — not the skill — reports scan telemetry to your dashboard over TLS 1.3. The skill only reads local agent output. | | sudo (operator-side, one-time) | The operator runs the agent as root once during initial enrollment so it can read `/proc`, listening ports, and `~/.ssh/authorized_keys` for the system view. The skill itself does not request sudo. | What the agent reads: process list (name/PID/user), listening ports (port/proto/owner), user accounts (`/etc/passwd`), SSH authorized public keys. What it does NOT read: process memory, file contents (databases, configs, documents), network packets, or private keys. What it does NOT modify: nothing — the agent is read-only by design and never writes to your system.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 51)May include surrounding context.
md
| Network (outbound to kefal.dev) | The agent — not the skill — reports scan telemetry to your dashboard over TLS 1.3. The skill only reads local agent output. | | sudo (operator-side, one-time) | The operator runs the agent as root once during initial enrollment so it can read `/proc`, listening ports, and `~/.ssh/authorized_keys` for the system view. The skill itself does not request sudo. | What the agent reads: process list (name/PID/user), listening ports (port/proto/owner), user accounts (`/etc/passwd`), SSH authorized public keys. What it does NOT read: process memory, file contents (databases, configs, documents), network packets, or private keys. What it does NOT modify: nothing — the agent is read-only by design and never writes to your system. ## Troubleshooting

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
| Network (outbound to kefal.dev) | The agent — not the skill — reports scan telemetry to your dashboard over TLS 1.3. The skill only reads local agent output. | | sudo (operator-side, one-time) | The operator runs the agent as root once during initial enrollment so it can read `/proc`, listening ports, and `~/.ssh/authorized_keys` for the system view. The skill itself does not request sudo. | What the agent reads: process list (name/PID/user), listening ports (port/proto/owner), user accounts (`/etc/passwd`), SSH authorized public keys. What it does NOT read: process memory, file contents (databases, configs, documents), network packets, or private keys. What it does NOT modify: nothing — the agent is read-only by design and never writes to your system. ## Troubleshooting

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
- Running processes — name, PID, owning user, CPU usage. (Source: `/proc/<pid>/stat` on Linux, equivalent APIs on macOS/Windows. The agent does not read process memory or open file descriptors.) - Listening ports — port number, protocol, owning process name. (Source: `/proc/net/tcp` and equivalents. The agent does not capture packets or read network traffic.) - User accounts with shell access — username and login state. (Source: `/etc/passwd` for the username list, `utmp` for active sessions. The agent reads these as a non-root user when possible; sudo is only needed for full process visibility.) - SSH authorized keys — public key fingerprints in `~/.ssh/authorized_keys`. (Source: the file is read line-by-line as text. The agent never touches private keys; private keys live in different files and are never read.) The agent does NOT read application data (databases, application config, business documents), does NOT capture network traffic, and does NOT modify any system file. All telemetry is transmitted over TLS 1.3 to kefal.dev. Each tenant's data is isolated; no data is shared with other customers.

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The skill describes reading users' '~/.ssh/authorized_keys' files to collect public key fingerprints. Although these are public keys rather than private keys, they are still sensitive identity and access metadata; centralizing them in a remote dashboard can reveal administrative access paths and materially assist targeting or lateral movement if exposed.
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
- Running processes — name, PID, owning user, CPU usage. (Source: `/proc/<pid>/stat` on Linux, equivalent APIs on macOS/Windows. The agent does not read process memory or open file descriptors.) - Listening ports — port number, protocol, owning process name. (Source: `/proc/net/tcp` and equivalents. The agent does not capture packets or read network traffic.) - User accounts with shell access — username and login state. (Source: `/etc/passwd` for the username list, `utmp` for active sessions. The agent reads these as a non-root user when possible; sudo is only needed for full process visibility.) - SSH authorized keys — public key fingerprints in `~/.ssh/authorized_keys`. (Source: the file is read line-by-line as text. The agent never touches private keys; private keys live in different files and are never read.) The agent does NOT read application data (databases, application config, business documents), does NOT capture network traffic, and does NOT modify any system file. All telemetry is transmitted over TLS 1.3 to kefal.dev. Each tenant's data is isolated; no data is shared with other customers.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 41)May include surrounding context.
md
- OpenClaw on Linux (x86_64, ARM64) or macOS (Intel, Apple Silicon) - Outbound HTTPS access to kefal.dev (for dashboard and incident reporting) - sudo access for initial agent installation (the agent scans system-level information) ## Permissions Justification

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 76% confidence
Finding: The skill explicitly depends on a separately installed binary that is run as root during enrollment and is then invoked via exec by the skill. Even if framed as read-only, combining agent execution with privileged data collection increases the attack surface: compromise or replacement of the binary could grant broad host visibility and privileged execution pathways.
Content: Scanner excerpt · README.md (reported line 49)May include surrounding context.
md
|---|---| | `exec` (shell commands) | The skill invokes `kefal-agent --status` / `--scan` to read the agent's output. The agent binary is installed and reviewed separately by the operator (this skill never downloads or executes remote code). | | Network (outbound to kefal.dev) | The agent — not the skill — reports scan telemetry to your dashboard over TLS 1.3. The skill only reads local agent output. | | sudo (operator-side, one-time) | The operator runs the agent as root once during initial enrollment so it can read `/proc`, listening ports, and `~/.ssh/authorized_keys` for the system view. The skill itself does not request sudo. | What the agent reads: process list (name/PID/user), listening ports (port/proto/owner), user accounts (`/etc/passwd`), SSH authorized public keys. What it does NOT read: process memory, file contents (databases, configs, documents), network packets, or private keys. What it does NOT modify: nothing — the agent is read-only by design and never writes to your system.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 55)May include surrounding context.
md
## Troubleshooting **Agent not running after install:** verify the binary is on `$PATH` (`kefal-agent --version`), check the systemd service status on Linux (`systemctl status kefal-agent`), or run with `--verbose` to see step-by-step traces. Full troubleshooting: https://kefal.dev/docs/installation.html#troubleshooting **macOS Gatekeeper rejection** ("cannot be opened because the developer cannot be verified"): the binaries are not yet notarized. The installation guide explains how to verify and approve them on a per-binary basis.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs the agent to invoke an external binary for broad, common security-related user prompts such as 'is my server secure?' or 'audit my setup'. This expansive activation scope can cause the agent to trigger host scanning and data disclosure more often than necessary, increasing the chance of unreviewed execution and transmission of sensitive telemetry to a third-party service.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 76% confidence
Finding: The skill explicitly states that sudo may be needed for full process visibility, which normalizes privilege escalation for a third-party monitoring binary. Even if framed as optional, encouraging elevated execution expands blast radius if the binary is compromised, misconfigured, or abused through the agent workflow.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
- Running processes — name, PID, owning user, CPU usage. (Source: `/proc/<pid>/stat` on Linux, equivalent APIs on macOS/Windows. The agent does not read process memory or open file descriptors.) - Listening ports — port number, protocol, owning process name. (Source: `/proc/net/tcp` and equivalents. The agent does not capture packets or read network traffic.) - User accounts with shell access — username and login state. (Source: `/etc/passwd` for the username list, `utmp` for active sessions. The agent reads these as a non-root user when possible; sudo is only needed for full process visibility.) - SSH authorized keys — public key fingerprints in `~/.ssh/authorized_keys`. (Source: the file is read line-by-line as text. The agent never touches private keys; private keys live in different files and are never read.) The agent does NOT read application data (databases, application config, business documents), does NOT capture network traffic, and does NOT modify any system file. All telemetry is transmitted over TLS 1.3 to kefal.dev. Each tenant's data is isolated; no data is shared with other customers.