T03 · Remote Payload Retrieval and Execution
Error
- Location
references/patchmon-setup.md:114- Finding
Unpinned Remote Installation Script Executed as Root and Installed Persistently
- Content
View full analysis
- Remediation
View remediation
Security audit
Linux Patcher
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real server-patching tool, but it asks for broad production access and contains unsafe update, credential, and remote-command handling that should be reviewed before installation.
Install only after reviewing the scripts and tightening controls: remove curl -k, avoid sourcing generated or user-supplied config files, validate hostnames/users/paths, avoid curl | sudo bash for PatchMon, keep Docker updates opt-in, and grant sudo through narrow audited wrappers rather than broad passwordless Docker commands.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/patchmon-query.sh:46- Finding
TLS Certificate Verification Disabled for Credentials and Bearer Tokens
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/patchmon-query.sh:87- Finding
PatchMon API Data Is Converted into Executable Shell Configuration
- Content
View full analysis
"$OUTPUT_CONFIG" << 'EOF' #!/bin/bash # Auto-generated PatchMon host configuration # Generated: $(date) # Host definitions parsed from PatchMon HOSTS=( EOF # Parse each host and add to config echo "$NEEDS_UPDATE" | jq -r '"\(.hostname),\(.sshUser // ""),\(.dockerPath // "")"' | while read -r line; do echo " \"$line\"" >> "$OUTPUT_CONFIG" done cat >> "$OUTPUT_CONFIG" << 'EOF' ) ``` The generated file is subsequently executed through `source`: ```bash TEMP_CONFIG=$(mktemp) if ! "$SCRIPT_DIR/patchmon-query.sh" --output-config "$TEMP_CONFIG"; then echo "ERROR: Failed to query PatchMon" rm -f "$TEMP_CONFIG" exit 1 fi # ... source "$TEMP_CONFIG" ``` ### Technical Analysis The values of `.hostname`, `.sshUser`, and `.dockerPath` originate from the PatchMon API. They are inserted between double quotes in an executable Bash array without escaping embedded quotes, command substitutions, newlines, backticks, or other shell syntax. The resulting file is then loaded using `source`, which executes all shell syntax in that file. A malicious field can close the intended string and insert arbitrary commands. Using `mktemp` prevents a simple predictable-file race, but it does not make attacker-controlled file contents safe to execute. Disabled TLS verification makes it possible for a network attacker to forge the API response even without compromising PatchMon itself. ### Attack Path 1. An attacker compromises PatchMon, modifies a host record, or intercepts the API connection. 2. The attacker supplies a crafted `hostname`, `sshUser`, or `dockerPath` containing quotes and shell syntax. 3 ...[truncated 942 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/patch-host-full.sh:94- Finding
Untrusted Docker Path Is Interpolated into Remote Shell Commands
- Content
View full analysis
' | xargs -r -L1 sudo docker pull" || { echo "WARNING: Some image pulls failed (continuing anyway)" } echo "Step 4/5: Pulling compose images..." ssh "$HOST" "cd $DOCKER_PATH && sudo docker compose pull" || { echo "ERROR: Docker compose pull failed on $HOST" exit 1 } echo "Step 5/5: Recreating containers..." ssh "$HOST" "cd $DOCKER_PATH && sudo docker compose up -d" || { echo "ERROR: Docker compose up failed on $HOST" exit 1 } ``` The value may originate from PatchMon: ```bash IFS=',' read -r hostname ssh_user docker_path <<< "$host_entry" # ... if DRY_RUN="$DRY_RUN" "$SCRIPT_DIR/patch-host-full.sh" "$SSH_TARGET" "$docker_path"; then ``` ### Technical Analysis `DOCKER_PATH` is concatenated into a double-quoted SSH command and interpreted by the remote shell. The variable is not restricted to a canonical absolute path and is not quoted for the remote-shell parsing layer. Shell metacharacters, command substitutions, or separators in the path can therefore change the command executed on the target. The input can be supplied manually or obtained from PatchMon host metadata. Local quoting of `"$DOCKER_PATH"` when passing it to `patch-host-full.sh` does not protect the value after it ...[truncated 1025 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/patchmon-query.sh:7- Finding
Credential and Inventory Configuration Files Are Executed with Source
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SETUP.md:108- Finding
Passwordless Root Docker Permissions Break the Claimed Least-Privilege Boundary
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (119)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The troubleshooting instruction to
cat ~/.ssh/authorized_keysexposes the complete list of trusted public keys for the account in terminal output. While public keys are not secret like private keys, disclosing account access configuration can aid reconnaissance and may leak comments, usernames, hostnames, or key management details in shared support sessions.- Content
Solutions:
bash # 1. Verify key is added to target host ssh admin@target "cat ~/.ssh/authorized_keys" # 2. Check SSH key permissions ls -la ~/.ssh/id_openclaw
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 93% confidence
- Finding
The troubleshooting block combines
curl -kwith manual authentication testing, weakening transport security for a privileged management system. Disabling certificate validation can let an attacker intercept or tamper with requests and capture PatchMon credentials, especially in enterprise environments using proxies or untrusted networks.- Content
Solutions:
bash # 1. Test PatchMon connectivity curl -k https://patchmon.example.com/api/health # 2. Verify credentials cat ~/.patchmon-credentials.conf
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The code substantially aligns with the core declared purpose of patching Linux packages and updating Docker containers on a remote server. However, parts of the description overstate what this code chunk actually does. Most notably, there is no PatchMon integration and no automatic host detection; instead, the caller must provide user@hostname manually. The script also handles only one host at a time, so the description's implication of multi-host maintenance orchestration is not represented in this chunk. Additionally, while the script includes OS detection and package-manager abstraction for several distributions, it explicitly warns that only Ubuntu has been tested, making the strong support claim somewhat overstated. Because these are material descriptive mismatches rather than mere implementation details, this should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The code’s core behavior is host-only Linux package patching via SSH, which partially matches the declared server patching purpose. However, the declared description explicitly includes Docker container updates and PatchMon-based automatic host detection, neither of which appear in this code chunk. The script also only operates on a single provided host argument rather than managing multiple hosts, and it notes that only Ubuntu has been fully tested despite the broad support claim. Because important declared capabilities are absent from the supplied code, the description does not accurately represent this chunk.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Install missing tools:
bash # Ubuntu/Debian sudo apt install curl jq # RHEL/CentOS/Rocky/Alma sudo dnf install curl jq
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - Use `/etc/sudoers.d/` files (easier to manage) - **SSH keys** should be protected - Use passphrase-protected keys when possible - Restrict key permissions: `chmod 600 ~/.ssh/id_rsa` - **Review updates** before applying in production - Use dry-run mode first - Test on staging environment
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This section explicitly states that broad chat requests default to Docker-changing behavior, including pulling images and recreating containers. Defaulting to the more destructive path without a narrow trigger or approval materially raises the risk of unintended outages, supply-chain exposure from image pulls, and unauthorized maintenance actions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow includes potentially disruptive and destructive actions such as package upgrades, 'docker system prune -af', image pulls, and 'docker compose up -d' without an explicit warning about service interruption, image/volume implications, rollback considerations, or approval gates. In a server-maintenance skill, omission of these warnings meaningfully raises the risk of production outages and unintended data or state loss.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The shell pipeline chains network retrieval directly into privileged execution, which is a classic abuse pattern because it converts any compromise of the fetched content into immediate root command execution. Given this skill patches Linux servers across multiple hosts, the context increases danger substantially by enabling rapid fleet-wide compromise.
- Content
Install PatchMon agent on each monitored host:
bash curl -sSL https://raw.githubusercontent.com/PatchMon/PatchMon/main/agent/install.sh | sudo bashConfigure agent (
/etc/patchmon/config.yml):
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This is a true vulnerability because the script sources a temporary config file generated from PatchMon output, which causes any shell code in that file to execute locally with the privileges of the patching process. In this skill’s context, PatchMon is only supposed to supply host metadata, but
source "$TEMP_CONFIG"turns a data channel into a code-execution channel, making compromise of PatchMon, its transport, or its output format highly dangerous.- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh echo "" echo "Step 1/5: Updating system packages..." ssh "$HOST" "sudo $UPDATE_CMD && sudo $UPGRADE_CMD && sudo $AUTOREMOVE_CMD" || { echo "ERROR: Failed to update packages on $HOST" exit 1 }
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh echo "" echo "Step 1/5: Updating system packages..." ssh "$HOST" "sudo $UPDATE_CMD && sudo $UPGRADE_CMD && sudo $AUTOREMOVE_CMD" || { echo "ERROR: Failed to update packages on $HOST" exit 1 }
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh echo "" echo "Step 1/5: Updating system packages..." ssh "$HOST" "sudo $UPDATE_CMD && sudo $UPGRADE_CMD && sudo $AUTOREMOVE_CMD" || { echo "ERROR: Failed to update packages on $HOST" exit 1 }
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh echo "" echo "Step 1/5: Updating system packages..." ssh "$HOST" "sudo $UPDATE_CMD && sudo $UPGRADE_CMD && sudo $AUTOREMOVE_CMD" || { echo "ERROR: Failed to update packages on $HOST" exit 1 }
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh } echo "Step 3/5: Pulling updated Docker images..." ssh "$HOST" "cd $DOCKER_PATH && sudo docker images --format '{{.Repository}}:{{.Tag}}' | grep -v '<none>' | xargs -r -L1 sudo docker pull" || { echo "WARNING: Some image pulls failed (continuing anyway)" }
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script directly executes the user-supplied configuration file with
source, which allows arbitrary shell commands in that file to run with the privileges of the patching process. In the context of a multi-host patching tool, operators may reasonably treat config files as data, so this creates a dangerous code-execution boundary that can lead to local compromise, credential theft, tampering with update targets, or malicious commands being run before patching begins.- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Using curl -k disables certificate verification for the login request that carries PatchMon credentials. In a server-patching skill, this is especially dangerous because it undermines trust in the update-management backend and enables credential theft or session hijacking through man-in-the-middle attacks.
- Content
sh # Authenticate with PatchMon echo "Authenticating with PatchMon..." TOKEN=$(curl -s -k -X POST "$PATCHMON_URL/api/auth/login" \ -H "Content-Type: application/json" \ -d "{\"username\":\"$PATCHMON_USERNAME\",\"password\":\"$PATCHMON_PASSWORD\"}" \ | jq -r '.token // .accessToken // empty')
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The host-query request also uses curl -k, so the script accepts unauthenticated TLS endpoints when retrieving the list of hosts needing updates. An attacker who can intercept traffic could tamper with the returned host inventory, causing the surrounding patching workflow to target attacker-chosen systems or generate a malicious configuration file from falsified data.
- Content
sh # Query hosts needing updates echo "Querying hosts from PatchMon..." HOSTS_JSON=$(curl -s -k "$PATCHMON_URL/api/v1/dashboard/hosts" \ -H "Authorization: Bearer $TOKEN") # Parse hosts needing updates
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The contribution instructions tell users to run scripts against a remote host and a host-only patching script without clearly warning that these commands may connect to real systems and alter their state. In a server patching skill, that omission is risky because contributors may test against production or otherwise sensitive hosts and trigger unintended maintenance actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The development setup section includes commands that probe or act on remote hosts but does not warn contributors that these scripts may affect the target machine. Because this skill is specifically designed for Linux patching and Docker updates, the lack of a safety notice increases the chance of accidental changes to live infrastructure during setup or testing.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README advertises a very broad chat trigger such as 'Update my servers' and says it 'just works', which creates weak activation boundaries for a high-impact skill. In an agent environment, ordinary conversational text can unintentionally invoke live patching across multiple hosts and container workloads, increasing the chance of accidental execution.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md # 3. Configure PatchMon credentials cp scripts/patchmon-credentials.example.conf ~/.patchmon-credentials.conf nano ~/.patchmon-credentials.conf chmod 600 ~/.patchmon-credentials.conf # 4. Test with dry-run scripts/patch-auto.sh --dry-run
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md # 3. Configure PatchMon credentials cp scripts/patchmon-credentials.example.conf ~/.patchmon-credentials.conf nano ~/.patchmon-credentials.conf chmod 600 ~/.patchmon-credentials.conf # 4. Test with dry-run scripts/patch-auto.sh --dry-run
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md # 3. Configure PatchMon credentials cp scripts/patchmon-credentials.example.conf ~/.patchmon-credentials.conf nano ~/.patchmon-credentials.conf chmod 600 ~/.patchmon-credentials.conf # 4. Test with dry-run scripts/patch-auto.sh --dry-run
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The usage section presents natural-language examples like 'Update my servers' and 'What servers need patching?' without clear activation boundaries or explicit confirmation requirements. Because this skill performs operational changes, ambiguous examples increase the risk that a user, another tool, or prompt-injected content triggers patching unintentionally.
- Content
Static analysis
No suspicious patterns detected.