T06 · System Persistence
Error
- Location
dlt_restore.py:61- Finding
Recurring Windows Scheduled Task Runs with SYSTEM Privileges
- Content
View full analysis
- Remediation
View remediation
Security audit
大乐透概率分析器 · 95%彩民都该看的真相
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed lottery-analysis tool, but it asks for and implements SYSTEM-level scheduling plus cross-user WorkBuddy access and file mirroring that are excessive for that purpose.
Install only if you are comfortable reviewing and disabling the Windows SYSTEM scheduler, cross-user WorkBuddy checks, and peer mirroring behavior. For normal use, prefer running python run_dlt.py manually as the current user, avoid administrator restore operations from untrusted backups, and do not rely on the ledger encryption for strong protection.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
dlt_restore.py:46- Finding
Untrusted Backup XML Can Replace a Privileged Scheduled Task
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
dlt_healthcheck_all.py:122- Finding
Health Check Enumerates User Profiles and Reads WorkBuddy Agent Databases
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
dlt_smart.py:364- Finding
Default Workflow Writes Reports into Other Users' Agent Skill Installations
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
dlt_ledger.py:48- Finding
Custom Ledger Encryption Does Not Authenticate Ciphertext
- Content
View full analysis
bytes: out = b'' counter = 0 while len(out) < length: h = hashlib.sha256( key + nonce + counter.to_bytes(8, 'big') ).digest() out += h counter += 1 return out[:length] def _encrypt_text(plaintext: str, passphrase: str) -> dict: salt = os.urandom(16) key = hashlib.pbkdf2_hmac( 'sha256', passphrase.encode('utf-8'), salt, 200_000 ) nonce = os.urandom(8) pt = plaintext.encode('utf-8') ks = _keystream(key, len(pt), nonce) ct = bytes(a ^ b for a, b in zip(pt, ks)) return { "v": 1, "algo": "pbkdf2-sha256+sha256-stream", "salt": base64.b64encode(salt).decode(), "nonce": base64.b64encode(nonce).decode(), "ct": base64.b64encode(ct).decode(), } def _decrypt_text(blob: dict, passphrase: str) -> str: salt = base64.b64decode(blob["salt"]) nonce = base64.b64decode(blob["nonce"]) ct = base64.b64decode(blob["ct"]) key = hashlib.pbkdf2_hmac( 'sha256', passphrase.encode('utf-8'), salt, 200_000 ) ks = _keystream(key, len(ct), nonce) pt = bytes(a ^ b for a, b in zip(ct, ks)) return pt.decode('utf-8') ``` ### Technical Analysis The implementation derives a key with PBKDF2 and constructs a SHA-256-based keystream that is XORed with the plaintext. However, it does not calculate or verify a MAC and does not use an authenticated-encryption mode. Stream-cipher ciphertext is malleable. Flipping a ciphertext bit flips the corresponding plaintext bit after decryption. The code has no integrity tag to distinguish an attacker-modified ledger from a valid one. UTF-8 and JSON parsing may reject some changes, but they are not cryptographic integrity contro ...[truncated 1059 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
dlt_outlet_map.py:33- Finding
TLS Certificate and Hostname Verification Disabled for IP Geolocation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (202)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Enforcing presence of 'prediction', 'expert recommendation', and 'machine learning prediction' report sections conflicts directly with the manifest's anti-prediction/no-edge positioning. This suggests the safety messaging is secondary to a prediction-oriented product, which is dangerous because it can misrepresent the true purpose to reviewers and users.
- Content
Static analysis
Detected: suspicious.insecure_tls_verification
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- dlt_outlet_map.py:37