linux-sysadmin

• Outcome: Review
• Latest audit: May 29, 2026 · 9:30 PM UTC
• Version: 3.0.2

Overview

This is a coherent Linux administration skill, but it includes high-impact commands and audit scripts with weak safeguards that users should review before running.

Install only if you need a powerful Linux sysadmin reference. Do not run its scripts with root privileges or apply generated commands on production systems until you have reviewed the exact command, confirmed targets, made backups, planned rollback, and protected any audit output as sensitive administrative data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (22)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The rsync mirror example uses --delete, which will remove files from the destination that do not exist in the source. In a backup/recovery guide, this can cause irreversible loss of historical or unrelated data if readers point the command at the wrong target or misunderstand that it is synchronization rather than versioned backup.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The cleanup example uses find ... -exec rm -rf {} + to delete old backup directories, which is irreversible and dangerous if BACKUP_DST is misconfigured or expanded unexpectedly. Because the script manipulates backup retention automatically, a path error could wipe large portions of backup storage and destroy recovery points.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide demonstrates storing rsync daemon credentials in plaintext and exporting RSYNC_PASSWORD in the shell, which can expose secrets through shell history, process environment inspection, or accidental reuse in shared sessions. In an admin skill, readers may copy this directly into production, normalizing weak credential handling.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Exporting BORG_PASSPHRASE in a script exposes a sensitive repository secret to process environments, logs, crash dumps, and potentially other local users depending on system configuration. Since backup repositories often contain all business data, compromise of the passphrase can materially weaken backup confidentiality.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The restic example exports cloud access keys directly in the shell without warning, which can leak via shell history, environment inspection, CI logs, or copied snippets. Because these credentials may grant access to remote backup buckets, exposure could lead to theft, deletion, or tampering of offsite backups.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Passing a database password on the command line exposes it to process listings, shell history, audit logs, and monitoring tools. In a backup workflow this can leak highly privileged database credentials, enabling unauthorized data access or destructive actions.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The dd restore commands can overwrite an entire block device with no recovery if the wrong disk is selected. In a disaster recovery guide, operators may be under pressure and more likely to make device-selection mistakes, turning a restore example into catastrophic data destruction.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Using e2fsck -y and xfs_repair -L automates destructive repair decisions and may discard metadata or journal contents, causing permanent data loss. These commands are legitimate recovery tools, but without prominent caution they encourage risky one-shot repair on potentially recoverable filesystems.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document contains many firewall, NAT, persistence, and system-hardening commands that can lock administrators out, disrupt network traffic, or alter system boot/runtime behavior, but it lacks a prominent up-front safety warning. In a sysadmin skill this content is expected, yet the absence of clear prerequisites, rollback guidance, and environment-scoping increases the chance of harmful misuse or accidental outage.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The troubleshooting section includes destructive log cleanup commands such as deleting old compressed logs and truncating a log file, but does not prominently warn that these actions permanently destroy forensic evidence and may hinder incident response. In a monitoring/logging guide, readers may copy-paste these commands during outages, causing avoidable loss of audit trails.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The documentation states Grafana is reachable with the default admin/admin credentials and does not place an immediate, prominent instruction to change them before exposure. Publishing default credentials in setup guidance materially increases the chance of insecure deployments, especially for internet-exposed dashboards.

Missing User Warnings

High

• Confidence: 85% confidence
• Finding: This section instructs users to overwrite /etc/resolv.conf and make it immutable with chattr +i, which can break DNS management by NetworkManager or systemd-resolved and complicate recovery. In a remote administration context, loss of name resolution can impair package installation, monitoring, automation, and incident response, especially because the guide does not warn about side effects or recovery steps.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The firewall section provides commands that immediately alter packet filtering behavior and can lock out remote administrators or unintentionally expose services, yet it lacks explicit warnings about connectivity loss and rollback steps. In a quick-reference format, omission of safety guidance increases the chance of operator error on production hosts.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The SSH hardening snippet disables password authentication and other access paths without warning that an operator can lose all remote access if key-based login is not already verified. Because this is a copy-pastable hardening block for sshd, the lack of prechecks and rollback guidance makes accidental lockout a realistic operational security risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The SMB client example includes `password=pass` directly on the mount command line, which can leak credentials via shell history, process listings, logs, or terminal capture. In a sysadmin skill, readers may copy-paste this pattern into production, making credential exposure more likely.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The NFS export example uses `no_root_squash`, which maps remote root to local root and allows a client-side root user to access exported files with full root privileges on the server. In a Linux sysadmin reference, this is especially dangerous because it presents an insecure configuration as a normal example without any warning or narrow-use justification.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script collects a broad set of sensitive administrative data, including user accounts, sudo policy, failed logins, listening ports, firewall state, and SSH settings, and can redirect the full report to an arbitrary file via --output. That creates a real confidentiality risk because the report may expose privileged system details or be written to an insecure location without warning, permission checks, or redaction.

Credential Access

High

• Category: Privilege Escalation

Content

chmod 600 /etc/crontab
chmod 600 /etc/ssh/sshd_config
chmod 644 /etc/passwd
chmod 000 /etc/shadow
chmod 000 /etc/gshadow
chmod 644 /etc/group

• Confidence: 84% confidence
• Finding: The recommendation to set /etc/shadow and /etc/gshadow to mode 000 is unsafe and misleading in a hardening guide. While not credential theft, incorrect permissions on authentication databases can break PAM/authentication workflows, interfere with system tools, and create denial-of-service conditions for account management or logins.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo "ssh-ed25519 AAAA..." >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

# 配置 sudo 免密（详见 references/user_permission.md）
echo "username ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/username
chmod 440 /etc/sudoers.d/username
visudo -c  # 语法检查

• Confidence: 95% confidence
• Finding: The example creates a passwordless sudo rule granting ALL commands as ALL users, which removes an important security control and greatly increases the blast radius of account compromise. Combined with the nearby SSH key setup, this can convert a single account takeover into unrestricted root access.

Credential Access

High

• Category: Privilege Escalation

Content

user=$(basename "$home_dir")
    [ "$home_dir" = "/root" ] && user="root"

    auth_keys="$home_dir/.ssh/authorized_keys"
    if [ -f "$auth_keys" ]; then
        key_count=$(grep -c "^ssh-" "$auth_keys" 2>/dev/null || echo 0)
        perm=$(stat -c %a "$auth_keys" 2>/dev/null)

• Confidence: 79% confidence
• Finding: The script reads users’ authorized_keys files and prints SSH key fingerprints and comments to stdout. In an admin skill this is legitimate auditing behavior, but the output can still disclose sensitive identity metadata, account associations, and trust relationships if run in shared logs, chat transcripts, or other externally visible contexts.

Credential Access

High

• Category: Privilege Escalation

Content

# ==================== 3. 密码状态 ====================
echo "=== 3. 密码状态 ==="
echo ""
if [ -r /etc/shadow ]; then
    printf "  %-15s %-12s %-15s %-15s %s\n" "用户名" "状态" "最后修改" "过期日期" "备注"
    printf "  %-15s %-12s %-15s %-15s %s\n" "------" "----" "--------" "--------" "----"
    while IFS=: read -r user pw last_change min max warn inactive expire _; do

• Confidence: 90% confidence
• Finding: The script reads /etc/shadow and reports password status, last-change dates, and expiration details for accounts. While this supports legitimate auditing, /etc/shadow-derived information is highly sensitive and can aid attackers in identifying unlocked accounts, empty-password states, password rotation gaps, and privileged targets if the output is exposed beyond trusted administrators.

Credential Access

High

• Category: Privilege Escalation

Content

[ "$last_date" = "从未/需修改" ] && note="首次登录需改密"

        printf "  %-15s %-12s %-15s %-15s %s\n" "$user" "$status" "$last_date" "$exp_date" "$note"
    done < /etc/shadow
else
    echo "  ⚠️ 无法读取 /etc/shadow（需要 root 权限）"
    echo "  使用 passwd -S 逐用户检查："

• Confidence: 88% confidence
• Finding: This line is part of emitting parsed /etc/shadow-derived account status to output. The danger is not the read itself in an admin context, but the disclosure of sensitive authentication posture into terminals, logs, or agent responses where unauthorized parties may access it.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/ansible_automation.md:797

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/infrastructure_as_code.md:478