T03 · Remote Payload Retrieval and Execution
Error
- Location
install.sh:20- Finding
Unverified Remote Installer Is Executed with Root Privileges
- Content
View full analysis
- Remediation
View remediation
Security audit
1panel-install
Security checks for vulnerabilities and agentic risk
Overview
This skill is a real 1Panel installer, but it performs root-level system changes, runs an unverified downloaded installer, exposes admin credentials, and includes a dangerous test script that can disrupt an existing installation.
Review before installing. Use this only on a server where root-level 1Panel installation is intended, verify the downloaded package independently, avoid running test.sh on a production machine, and treat any displayed panel password as sensitive; rotate it immediately after installation.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
test.sh:39- Finding
Destructive Root Test Can Leave the Production Installation Disabled or Partially Removed
- Content
View full analysis
/dev/null; then echo "测试 2：模拟未安装状态（临时备份 1Panel）..." echo "备份目录：$BACKUP_DIR" # 备份已安装的文件 mkdir -p "$BACKUP_DIR" if [[ -d "/opt/1panel" ]]; then mv /opt/1panel "$BACKUP_DIR/" fi if command -v 1pctl &> /dev/null; then mv /usr/bin/1pctl "$BACKUP_DIR/" fi # 停止服务 systemctl stop 1panel-core 2>/dev/null || true systemctl stop 1panel-agent 2>/dev/null || true systemctl disable 1panel-core 2>/dev/null || true systemctl disable 1panel-agent 2>/dev/null || true echo "已临时移除 1Panel" echo "" else echo "测试 2：跳过（1Panel 未安装）" echo "" fi ``` Restoration is optional and defaults to not restoring the original installation: ```bash if [[ -d "$BACKUP_DIR" ]]; then echo "" read -p "是否恢复之前的 1Panel 备份？(y/N): " -n 1 -r echo "" if [[ $REPLY =~ ^[Yy]$ ]]; then echo "恢复备份..." # 停止新安装的服务 systemctl stop 1panel-core 2>/dev/null || true systemctl stop 1panel-agent 2>/dev/null || true systemctl disable 1panel-core 2>/dev/null || true systemctl disable 1panel-agent 2>/dev/null || true # 清理新安装的文件 rm -rf /opt/1panel rm -f /usr/bin/1pctl rm -f /etc/systemd/system/1panel-*.service # 恢复备份 if [[ -f "$BACKUP_DIR/1pctl" ]]; then cp "$BACKUP_DIR/1pctl" /usr/bin/ chmod +x /usr/bin/1pctl fi if [[ -d "$BACKUP_DIR/1panel" ]]; then cp -r "$BACKUP_DIR/1panel" /opt/ fi # 重新加载 systemd systemctl daemo ...[truncated 3684 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code does relate to 1Panel installation, but it does not primarily implement the declared end-user skill behavior. Instead of being the one-click installer that automatically detects installation state and installs or returns access info, this chunk is a testing script for such an installer. It performs additional destructive/admin actions not stated in the description, including backing up and temporarily removing an existing installation, stopping/disabling services, and restoring backups. It also requires root and interactive prompts, which differs from the described automatic installation flow. Therefore the supplied code chunk does not accurately represent the declared purpose.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The installed-instance flow tells the assistant to fetch and disclose existing panel access information, which may include active administrative credentials. Retrieving and echoing pre-existing secrets is especially dangerous because it can expose long-lived access to an already deployed management plane.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the assistant to return newly generated admin access URLs, usernames, and passwords in plain-language output. Exposing credentials in chat or logs can leak administrative access to anyone with transcript access, creating immediate account and server compromise risk.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 100% confidence
- Finding
The script recursively deletes /opt/1panel as root during restoration cleanup. In the context of an installation test script, deleting application directories on the host is dangerous because it can destroy user data or a valid installation, especially if the backup/restore flow fails or if the host was not meant to be modified.
- Content
sh systemctl disable 1panel-agent 2>/dev/null || true # 清理新安装的文件 rm -rf /opt/1panel rm -f /usr/bin/1pctl rm -f /etc/systemd/system/1panel-*.service
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 100% confidence
- Finding
The script recursively deletes /opt/1panel as root during restoration cleanup. In the context of an installation test script, deleting application directories on the host is dangerous because it can destroy user data or a valid installation, especially if the backup/restore flow fails or if the host was not meant to be modified.
- Content
sh systemctl disable 1panel-agent 2>/dev/null || true # 清理新安装的文件 rm -rf /opt/1panel rm -f /usr/bin/1pctl rm -f /etc/systemd/system/1panel-*.service
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Removing /usr/bin/1pctl as root directly alters a system executable outside package-management safeguards. If the restoration sequence fails or the binary belongs to a different installation source/version, the host can be left without a working management CLI.
- Content
sh # 清理新安装的文件 rm -rf /opt/1panel rm -f /usr/bin/1pctl rm -f /etc/systemd/system/1panel-*.service # 恢复备份
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Deleting /etc/systemd/system/1panel-*.service removes service definitions from the host. In a root-executed test script this can break service management or permanently alter system state if the units are not fully restored, making the install skill more dangerous because it targets persistent host configuration rather than a sandbox.
- Content
sh # 清理新安装的文件 rm -rf /opt/1panel rm -f /usr/bin/1pctl rm -f /etc/systemd/system/1panel-*.service # 恢复备份 if [[ -f "$BACKUP_DIR/1pctl" ]]; then
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README states that the skill will automatically install 1Panel and return the generated access URL, username, and password during normal use. That creates a real security risk because it performs privileged system changes and exposes fresh administrative credentials in chat/output without requiring an explicit confirmation or warning at the point of use.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash cd /root/.openclaw/workspace/skills/1panel-install chmod +x install.sh sudo ./install.sh预期输出：
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill declares shell-capable behavior but does not explicitly constrain tool scope with a permissions or allowed-tools policy. In a skill that performs installation, service management, and filesystem changes, missing tool scoping increases the chance of unintended or overly broad command execution.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation description is broad enough that normal discussion of installing, deploying, or configuring 1Panel could trigger privileged system actions. Because this skill installs software as root and changes system state, ambiguous activation materially raises the risk of accidental execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill does not prominently warn up front that it will execute a remote installation script with root privileges and alter the host system. Running network-fetched code as root is a high-risk action, and failing to disclose that deprives the user of informed consent and increases the chance of unsafe use.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger examples use catch-all wording that can cause over-activation for requests that may only seek advice rather than execution. In the context of a root-level installer, this can lead to unintended remote script execution and system modification.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The skill explicitly requires root or sudo execution to install services and modify the system. Privileged execution is not inherently malicious, but in this context it amplifies the risk of any mistake, overbroad trigger, or compromised remote installer into full-system impact.
- Content
md ### 2. 检查 root 权限 此脚本需要 root 权限安装系统服务。如果当前用户不是 root，提示用户使用 sudo 执行。 ## 安装流程
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script announces '语言: 中文' and then hard-codes menu option '2' into the installer input to select Chinese. This is a natural-language policy concern because it imposes a specific language choice on users without giving them a choice or requiring explicit consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script downloads an external tarball from the network and then executes its embedded install.sh as root with no integrity verification, no signature/hash check, and no user confirmation. In the context of an agent skill that may auto-run installation, this creates a supply-chain risk where a compromised download source, DNS/TLS interception, or replaced local archive could lead to full root remote code execution.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md #!/bin/bash # 测试脚本：验证 1panel-install skill 的功能 # 用法：sudo ./test.sh set -e
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md #!/bin/bash # 测试脚本：验证 1panel-install skill 的功能 # 用法：sudo ./test.sh set -e
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md #!/bin/bash # 测试脚本：验证 1panel-install skill 的功能 # 用法：sudo ./test.sh set -e
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh #!/bin/bash # 测试脚本：验证 1panel-install skill 的功能 # 用法：sudo ./test.sh set -e
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The test script, when run as root, intentionally moves an existing 1Panel installation out of place, stops services, and disables them to simulate an uninstalled state. Even though this is framed as testing, it performs destructive system changes beyond simple validation and can disrupt a production installation or leave the host in an inconsistent state if the script aborts mid-run.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The restoration path deletes system files and service units, then replaces binaries and application directories from a temporary backup. In a root-run script this is risky because any failure, stale backup, or path mismatch can remove working software or alter service state unexpectedly, which exceeds what a normal install-skill test should do.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh # 如果原服务存在，重新启用 if systemctl list-unit-files | grep -q 1panel-core; then systemctl enable 1panel-core 2>/dev/null || true systemctl start 1panel-core 2>/dev/null || true fi
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README includes a fixed language setting of '中文', which can constitute a language-policy issue when presented as a default constraint without offering alternatives. There is no nearby wording indicating that the user can choose another language or that the locale restriction is required for a region-specific purpose.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The installation flow explicitly says it will '自动选择中文语言', which imposes a language choice on the user. This is a locale/language policy issue because the skill does not offer a choice or document a justified region-specific requirement.
- Content