BOC部署工具

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:48 AM UTC
• Version: 1.0.0

Overview

This deployment skill is coherent with its purpose, but it asks for root infrastructure credentials and gives unsafe deployment commands that could expose secrets or damage systems if followed as written.

Review this skill carefully before installing or using it. Prefer SSH keys or a secret manager instead of root passwords, verify deployment archives with a trusted checksum or signature before execution, avoid unverified sshpass downloads, and do not run the rm -rf or tar commands until paths are canonicalized, quoted, and confirmed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:265

Finding

Unverified Executable Download and Unpinned SSH Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:265-267
Vulnerability Type: Supply-chain compromise through an unsafe executable source and unpinned dependency
Risk Level: High

Vulnerable Code

text

- Windows: Download sshpass.exe from:
  https://github.com/xhcoding/sshpass-win32/releases/download/v1.0.7/sshpass.exe
- Linux: Install it using:
  pip install sshpass -g

Technical Analysis

The Skill directs Windows users to download an executable from a personal GitHub repository. It provides no cryptographic checksum, signature, trusted publisher identity, or independent verification procedure. Although the URL identifies a release version, the remote account or hosted artifact could be compromised or replaced after the Skill has been reviewed.

The Linux instruction similarly installs an unpinned package from the active Python package index. It neither identifies an expected package hash nor constrains transitive dependencies. The -g argument is also not a standard pip install option and may cause the instruction to fail or behave inconsistently.

This dependency is particularly sensitive because sshpass receives plaintext SSH credentials and participates directly in privileged remote authentication.

Attack Path

1. An attacker compromises the referenced GitHub account, release artifact, package-index account, or dependency distribution channel.
2. The attacker publishes a modified sshpass binary or package under the expected location or name.
3. An operator follows the Skill instructions and installs the unverified component.
4. The operator invokes the component with SSH credentials.
5. The malicious component executes with the operator's local privileges and can capture passwords, alter SSH operations, or install additional payloads.

Impact Assessment

Successful exploitation can provide code execution with the privileges of the user running the SSH utility. It can al ...[truncated 314 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the recommendation to download an executable from a personal repository.
• Prefer the operating system's trusted package manager or built-in OpenSSH capabilities.
• Prefer SSH public-key authentication or short-lived certificates over sshpass.
• If an external artifact is unavoidable, pin an exact version and publish an expected SHA-256 digest obtained through a separate trusted channel.
• Require verification of a trusted maintainer signature before installation.
• Pin Python dependencies by version and hash using a reviewed lock file.
• Execute third-party authentication utilities in a constrained environment without unnecessary filesystem, network, or administrative privileges.
• Document the trusted publisher and fail closed if verification cannot be completed.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:67

Finding

Deployment Archive Integrity Check Does Not Validate the Archive

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:67-72
Related Execution Locations: SKILL.md:84, SKILL.md:111, and SKILL.md:162
Vulnerability Type: Ineffective integrity verification before privileged execution
Risk Level: High

Vulnerable Code

bash

nohup cd <deploy_pkg_dir> && sha256sum <deploy_pkg_file>.sha256 > /tmp/sha256sum-<deploy_pkg_file>.txt

bash

cat /tmp/sha256sum-<deploy_pkg_file>.txt

The package is subsequently extracted and its executable is invoked:

bash

nohup tar -xzf <deploy_pkg_file> > /tmp/unpack.log 2>&1 &
nohup ./bocctl init > /tmp/bocctl_init.log 2>&1 &
nohup ./bocctl run -a install -c /root/config.yaml > log/bocctl.log 2>&1 &

Technical Analysis

The displayed verification command calculates the SHA-256 digest of the checksum file itself. It does not compare the deployment archive against a trusted digest. A valid GNU checksum verification would normally use a trusted manifest with sha256sum -c.

The documented success condition is inconsistent with the shown command: plain sha256sum emits a digest and filename, not a verification result indicating success. In addition, the checksum file appears to be stored alongside the archive, so an attacker able to replace the archive may also be able to replace its checksum.

The use of nohup cd is also defective because cd is normally a shell built-in rather than an external executable. Unless wrapped in an explicit shell, this command may fail before any hash operation is performed.

The workflow later extracts the unverified archive and runs its bundled bocctl program in a root-oriented deployment process.

Attack Path

1. An attacker gains the ability to replace or modify the deployment archive before installation.
2. The attacker inserts a malicious bocctl, library, package, or playbook into ...[truncated 781 chars]

Remediation

View remediation

Remediation Suggestions

• Obtain the expected checksum or signing key through an authenticated channel independent of the archive.
• Verify the archive using a fail-closed command such as:

  bash

  cd -- "$deploy_pkg_dir" || exit 1
  sha256sum -c -- "$trusted_manifest" || exit 1
  

• Ensure the trusted manifest contains the digest of the archive, not a digest of the manifest itself.
• Prefer signed release metadata and verify the signature against a pinned vendor key.
• Abort extraction and execution on any verification failure or malformed manifest.
• Do not store the archive and its sole trust anchor in the same attacker-writable location.
• Record the verified archive digest in deployment logs without recording credentials.
• Inspect archive paths before extraction and execute bundled software only after successful integrity and authenticity checks.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:79

Finding

Unquoted User Inputs Permit Shell and Archive Command Injection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:79-88
Vulnerability Type: Shell command injection, option injection, and unsafe destructive operation
Risk Level: Critical

Vulnerable Code

bash

cd <deploy_pkg_dir>
test -d BOC_k8s_noarch && rm -rf BOC_k8s_noarch

nohup tar -xzf <deploy_pkg_file> > /tmp/unpack.log 2>&1 &

ps aux |grep 'tar -xzf <deploy_pkg_file>'

Related unquoted interpolation also appears in the checksum workflow:

bash

nohup cd <deploy_pkg_dir> && sha256sum <deploy_pkg_file>.sha256 > /tmp/sha256sum-<deploy_pkg_file>.txt

Technical Analysis

deploy_pkg_dir and deploy_pkg_file are user-supplied inputs, but the command templates insert them into shell commands without quoting or strict validation. Values containing shell metacharacters can change command structure when an agent substitutes the placeholders and executes the resulting command.

A filename beginning with an option prefix may also be interpreted as an argument to tar or another utility instead of as a filename. Whitespace and path traversal can produce unintended filesystem behavior.

The destructive removal command is especially hazardous because it is not conditionally chained to a successful directory change. If cd fails but command execution continues, rm -rf BOC_k8s_noarch runs relative to the previous working directory and can delete an unintended directory.

Attack Path

1. An attacker or untrusted user supplies a crafted deployment directory or package filename.
2. The agent substitutes that value into the documented command template.
3. The shell interprets embedded metacharacters, command substitutions, separators, redirections, or option-like filenames.
4. Injected commands execute with the deployment account's privileges.
5. Alternatively, a failed cd leaves the process in an unexpected directory, after wh ...[truncated 584 chars]

Remediation

View remediation

Remediation Suggestions

• Strictly validate directory and filename inputs against a conservative allowlist.
• Resolve the deployment directory to a canonical absolute path and require it to remain under an approved base directory.
• Quote all shell expansions and terminate option processing:

  bash

  cd -- "$deploy_pkg_dir" || exit 1
  test -d "./BOC_k8s_noarch" && rm -rf -- "./BOC_k8s_noarch"
  nohup tar -xzf "$deploy_pkg_file" -- > /tmp/unpack.log 2>&1 &
  

• Where supported, avoid shell interpolation entirely and invoke commands through structured argument arrays.
• Reject filenames containing control characters, separators, traversal components, or leading option prefixes.
• Confirm the exact canonical deletion target before calling rm -rf.
• Run extraction under a dedicated non-root account and elevate only narrowly scoped operations that require additional privileges.
• Use unique, securely created temporary files rather than constructing paths directly from user-controlled filenames.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:19

Finding

Plaintext Root Credentials Are Collected and Written to Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:19-23 and SKILL.md:139-156
Vulnerability Type: Insecure handling and storage of privileged credentials
Risk Level: High

Vulnerable Code

The input definition requires a privileged SSH username and password:

text

| ssh_host     | SSH host     | Required | 10.50.6.181 |
| ssh_port     | SSH port     | Optional | 22          |
| ssh_user     | SSH username | Required | root        |
| ssh_password | SSH password | Required | Password    |

The deployment procedure then instructs the agent to generate a configuration containing node usernames and passwords and upload it to a fixed location:

text

Generate config.yaml containing:
- Node configuration, including IP address, port, username, password, and role
...

Upload the generated config.yaml to:
/root/config.yaml

Technical Analysis

The workflow explicitly requests root SSH passwords and places node credentials in a plaintext YAML configuration. It provides no requirement to use restrictive creation permissions, encrypted secret storage, output redaction, secure deletion, or short-lived credentials.

Secrets supplied through an AI-agent prompt may be retained in conversation records or execution logs. Generated configuration can additionally be exposed through default file permissions, backups, diagnostic collection, operator mistakes, or later reuse. A fixed path also increases the likelihood that credentials will remain on disk after deployment.

Root credentials exceed the minimum privilege required for many inspection, upload, and deployment operations. The Skill does not distinguish between tasks that require elevation and those that can run under an unprivileged deployment account.

Attack Path

1. An operator supplies root SSH passwords through the agent interface.
2. The agent processes the credentials and generates a plaintext config.yaml.
3. The file is upl ...[truncated 807 chars]

Remediation

View remediation

Remediation Suggestions

• Replace password-based root access with SSH keys, short-lived SSH certificates, or another centrally managed authentication method.
• Use a dedicated deployment account with narrowly scoped sudo permissions rather than direct root login.
• Store secrets in a secret manager or an encrypted mechanism such as Ansible Vault; do not embed plaintext passwords in ordinary YAML.
• Prevent credentials from appearing in prompts, logs, process arguments, generated output, or deployment status messages.
• Create configuration files with mode 0600 using a secure temporary file and an explicit restrictive umask.
• Transfer configuration only over authenticated and encrypted channels.
• Separate non-sensitive configuration from secret material.
• Rotate credentials immediately after deployment and securely delete temporary secret files.
• Document retention controls for agent conversations and deployment logs.
• Use distinct credentials for each host or role to prevent one disclosure from compromising the entire environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The command chain test -d BOC_k8s_noarch && rm -rf BOC_k8s_noarch performs destructive deletion based on a simple existence check, with no path canonicalization, confirmation, or guardrails. In a privileged deployment context, chaining destructive operations like this increases the chance of accidental or manipulated deletion of important files, especially if the working directory is not what the operator expects.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

bash

# 解压前先清理旧目录
cd <deploy_pkg_dir>
test -d BOC_k8s_noarch && rm -rf BOC_k8s_noarch

# 后台执行解压（30GB文件预计15-20分钟）
nohup tar -xzf <deploy_pkg_file> > /tmp/unpack.log 2>&1 &

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill requires raw SSH passwords as input and describes using password-based remote access without any credential-handling guidance. This increases the risk of exposing secrets in prompts, logs, process arguments, transcripts, or downstream tools, particularly because the workflow targets privileged root access to infrastructure hosts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

执行 SHA256 校验：

bash

nohup cd <deploy_pkg_dir> && sha256sum <deploy_pkg_file>.sha256 > /tmp/sha256sum-<deploy_pkg_file>.txt

定期检查校验结果

bash

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

执行 SHA256 校验：

bash

nohup cd <deploy_pkg_dir> && sha256sum <deploy_pkg_file>.sha256 > /tmp/sha256sum-<deploy_pkg_file>.txt

定期检查校验结果

bash

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

执行 SHA256 校验：

bash

nohup cd <deploy_pkg_dir> && sha256sum <deploy_pkg_file>.sha256 > /tmp/sha256sum-<deploy_pkg_file>.txt

定期检查校验结果

bash

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

执行 SHA256 校验：

bash

nohup cd <deploy_pkg_dir> && sha256sum <deploy_pkg_file>.sha256 > /tmp/sha256sum-<deploy_pkg_file>.txt

定期检查校验结果

bash

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to delete an existing deployment directory with rm -rf before extraction, but it does not explicitly warn about irreversible data loss or require confirmation. In a deployment tool, this can destroy prior installation state, logs, or customizations if the path is wrong or reused, especially because the directory is under a privileged deployment location.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.