T03 · Remote Payload Retrieval and Execution
Error
- Location
references/container_management.md:30- Finding
Docker Installation Executes a Mutable Remote Script Directly
- Content
View full analysis
- Remediation
View remediation
Security audit
linux-sysadmin
Security checks for vulnerabilities and agentic risk
Overview
This is a real Linux sysadmin skill, but some copyable examples install unverified remote software and grant persistent high privileges, so it should be reviewed before use.
Install only if you are comfortable with a broad sysadmin assistant that may suggest root-level changes. Review commands before running them, avoid the remote-script and unverified-binary install snippets unless you add checksum or signature verification, and replace broad NOPASSWD/Docker-group examples with narrowly scoped privileges.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)
T08 · Insecure Dependencies
Error
- Location
references/monitoring_logging.md:108- Finding
Monitoring Binaries Are Installed and Persisted Without Integrity Verification
- Content
View full analysis
/etc/systemd/system/node_exporter.service << 'EOF' [Unit] Description=Prometheus Node Exporter After=network.target [Service] Type=simple User=node_exporter ExecStart=/usr/local/bin/node_exporter \ --collector.systemd \ --collector.processes \ --web.listen-address=:9100 Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target EOF systemctl daemon-reload systemctl enable --now node_exporter ``` ```bash PROMETHEUS_VERSION="2.53.0" wget https://github.com/prometheus/prometheus/releases/download/v${PROMETHEUS_VERSION}/prometheus-${PROMETHEUS_VERSION}.linux-amd64.tar.gz tar xzf prometheus-${PROMETHEUS_VERSION}.linux-amd64.tar.gz cp prometheus-${PROMETHEUS_VERSION}.linux-amd64/{prometheus,promtool} /usr/local/bin/ mkdir -p /etc/prometheus /var/lib/prometheus # Create system user and service useradd -r -s /usr/sbin/nologin prometheus chown -R prometheus:prometheus /etc/prometheus /var/lib/prometheus cat > /etc/systemd/system/prometheus.service << 'EOF' [Unit] Description=Prometheus Monitoring After=network.target [Service] Type=simple User=prometheus ExecStart=/usr/local/bin/prometheus \ --config.file=/etc/prometheus/prometheus.yml \ --storage.tsdb.path=/var/lib/prometheus \ --stor ...[truncated 2014 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
references/infrastructure_as_code.md:800- Finding
Cloud-Init Automatically Installs an Unverified Download as a Persistent Service
- Content
View full analysis
/etc/systemd/system/node_exporter.service << 'UNIT' [Unit] Description=Node Exporter After=network.target [Service] User=node_exporter ExecStart=/usr/local/bin/node_exporter [Install] WantedBy=multi-user.target UNIT systemctl daemon-reload systemctl enable --now node_exporter ``` ### Technical Analysis Cloud-init `runcmd` operations normally run as root during first-boot provisioning. This example downloads a release archive without validating a checksum or signature, extracts it, copies an executable into a privileged system path, and enables it as a persistent systemd service. Unlike an interactive installation, automated provisioning can deploy the same compromised artifact across an entire server fleet without an administrator inspecting the payload. The service account reduces the runtime privilege level, but it does not address artifact authenticity. ### Attack Path 1. An attacker compromises or replaces the referenced Node Exporter release asset. 2. New systems boot with the documented cloud-init configuration. 3. Cloud-init downloads the substituted archive as root. 4. The archive is extracted and its executable is copied into `/usr/local/bin`. 5. Cloud-init registers and enables the executable as a systemd service. 6. ...[truncated 453 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/infrastructure_as_code.md:749- Finding
Cloud-Init Deployment Account Receives Multiple Root-Equivalent Privileges
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/backup_recovery.md:145- Finding
Backup Documentation Uses a Static Plaintext Password in Files and Environment Variables
- Content
View full analysis
/etc/rsyncd.secrets chmod 600 /etc/rsyncd.secrets # Start systemctl enable --now rsync # Client usage export RSYNC_PASSWORD="strongpassword" rsync -avz /data/ backupuser@backup-server::backup/data/ ``` ### Technical Analysis The example uses the same static password on both the server and client. Restricting `/etc/rsyncd.secrets` to mode `600` protects the server-side file from ordinary local users, but it does not make the password unique or prevent leakage elsewhere. The client exports the password into its process environment. Depending on operating-system policy and execution context, environment values may be exposed through process inspection, diagnostic tools, shell state, automation logs, crash reports, or inherited child processes. Copying the example unchanged also creates a predictable credential. The affected rsync module is configured as writable, so credential compromise can affect backup integrity as well as confidentiality. ### Attack Path 1. An operator copies the example without replacing the placeholder password securely. 2. The password is retained in shell history, provisioning logs, source-controlled automation, or a process environment. 3. An attacker obtains the value through local inspection, log access, or predictable reuse. 4. The attacker authenticates to the rsync backup module as `backupuser`. 5. The attacker reads, replaces, or deletes backup data within the permissions of the writable module. ### Impact Assessment The attacker could gain access to the rsync backup repository and any data exposed by the configured module. Because the module is writable, exploitation could permit backup deletion, corruption, or replacement, undermining disas ...[truncated 69 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (385)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
该描述明显宽于代码实际行为，且不仅是轻微范围偏差，而是主目的不一致。代码的核心功能非常明确：读取本地证书、连接远程主机获取 TLS 证书、检查 Let's Encrypt/Certbot 状态、判断是否临近过期并输出报告。这属于“证书/TLS 检查工具”。虽然声明中包含“证书TLS”模块，与代码有局部重合，但整体描述把该技能包装成覆盖十二大模块的 Linux 系统管理专家，并承诺配置、验证、加固、监控、备份、自动化、排障、回滚完整闭环；这些大多数能力在代码中完全不存在。因此应判定为描述与实际行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
声明描述的是一个覆盖面很广的 Linux 系统管理专家型技能，重点强调多个系统管理模块以及完整运维闭环；而实际代码只是单个 shell 脚本，用于容器安全审计。它确实与声明中的“容器”模块有部分重叠，但这只是整体声明中的很小一部分。代码没有实现绝大多数已声明领域的功能，也没有进行配置、加固、备份、自动化或回滚等主动管理操作，主要是检查 Docker/Podman 运行时、容器、镜像、网络和存储并给出告警。因此，描述对技能范围和主要用途存在明显夸大，属于实质性不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
该描述明显夸大了技能范围。脚本的真实主用途是“安全基线检查/审计”，而不是通用 Linux 系统管理专家或十二大模块的全流程闭环工具。代码没有修改配置、部署服务、执行备份恢复、管理证书、操作容器或 IaC，也没有 systemd、存储、监控日志、Ansible、Docker、Terraform 等实现。虽然描述中提到 SSH、sudo、防火墙、SELinux 等与脚本部分重合，但整体主功能与覆盖面存在实质性不一致，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The description presents a comprehensive Linux system administration expert with wide operational coverage and active lifecycle capabilities. The supplied code is instead a system audit/reporting script. It mainly reads system configuration and status from standard files and commands, summarizes them, and optionally saves output to a file. While some declared topics partially overlap (users, SSH, storage, network, systemd, firewall), the primary purpose is materially narrower: auditing current state rather than managing, configuring, hardening, automating, restoring, or rolling back systems. No undeclared harmful behavior is evident, but the description significantly overstates breadth and operational capability relative to the actual code.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: linux-sysadmin version: "3.0.2" description: > Linux 系统管理专家 — 覆盖用户权限、SSH、存储、网络、systemd、防火墙、 监控日志、备份恢复、证书TLS、Ansible、容器、IaC 十二大模块。 提供配置→验证→加固→监控→备份→自动化→故障排查→回滚完整闭环。 触发关键词：useradd/sudo/sshd_config/chmod/SELinux/fdisk/LVM/fstab/RAID/nmcli/iptables/firewalld/systemd/Prometheus/logrotate/rsync/borgbackup/certbot/OpenSSL/Ansible/Docker/Terraform。 --- # Linux Sysadmin — Linux 系统管理专家 > 覆盖 Linux 系统管理十二大核心模块，
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md │ ├── Ansible 安装/配置 → references/ansible_automation.md § 基础
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md │ ├── Ansible 安装/配置 → references/ansible_automation.md § 基础
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md │ ├── Ansible 安装/配置 → references/ansible_automation.md § 基础
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md │ ├── Ansible 安装/配置 → references/ansible_automation.md § 基础
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md │ ├── Ansible 安装/配置 → references/ansible_automation.md § 基础
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md │ ├── Ansible 安装/配置 → references/ansible_automation.md § 基础
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md │ ├── Ansible 安装/配置 → references/ansible_automation.md § 基础
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md │ ├── Ansible 安装/配置 → references/ansible_automation.md § 基础
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md │ ├── Ansible 安装/配置 → references/ansible_automation.md § 基础
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ├── Terraform 基础 → references/infrastructure_as_code.md § Terraform 基础
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ├── Terraform 基础 → references/infrastructure_as_code.md § Terraform 基础
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ├── Terraform 基础 → references/infrastructure_as_code.md § Terraform 基础
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ├── Terraform 基础 → references/infrastructure_as_code.md § Terraform 基础
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ├── Terraform 基础 → references/infrastructure_as_code.md § Terraform 基础
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ├── Terraform 基础 → references/infrastructure_as_code.md § Terraform 基础
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ├── Terraform 基础 → references/infrastructure_as_code.md § Terraform 基础
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ├── Terraform 基础 → references/infrastructure_as_code.md § Terraform 基础
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ├── Terraform 基础 → references/infrastructure_as_code.md § Terraform 基础
Privileged Container / Container Escape
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Potential security issue detected. Manual review is recommended.
- Content
yaml - DNS - network create expected_not: - --net=host - name: private-registry input: 如何搭建私有 Docker Registry？需要支持认证和 TLS expected_keywords:
Untrusted Container Image
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
Code pulls a container image with signature or registry verification disabled (--disable-content-trust, DOCKER_CONTENT_TRUST=0, --insecure-registry). This accepts tampered or unverified images and is a container supply-chain risk.
- Content
yaml - TLS - Harbor expected_not: - --insecure-registry - name: terraform-basic input: Terraform 入门：如何用 Terraform 在腾讯云创建一台 CVM 实例？ expected_keywords:
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/ansible_automation.md:797
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/infrastructure_as_code.md:478