ClawHub
Back to skill

Security audit

TDengine Setup

Security checks for vulnerabilities and agentic risk

Overview

This skill is a TDengine database setup guide, but it asks users to run an unverified external installer, enable a persistent system service, and open database ports without enough safety controls.

Review this skill carefully before installing. Use it only on a host where you intend to run TDengine as a persistent database service. Verify the downloaded TDengine package with a trusted checksum or signature, inspect the installer before using elevated privileges, restrict ports 6030-6041 to trusted networks only, and know how to stop and disable the service before proceeding.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T06 · System Persistence

Error
Location
SKILL.md:39
Finding

Persistent TDengine Service Enabled Without Explicit Opt-In

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39–43
Vulnerability Type: System service persistence
Risk Level: High

bash
### 3. 启动服务
安装完成后，通过 systemd 管理服务：
```bash
systemctl start taosd
systemctl enable taosd

Technical Analysis

The instruction systemctl enable taosd registers the TDengine daemon with the system service manager so that it starts automatically during subsequent boots. This creates cross-session persistence and changes system-wide startup configuration, normally requiring elevated privileges.

Persistent startup is related to operating a database server, but it is not required to complete installation or perform the documented one-time database validation. Enabling the service by default therefore exceeds the minimum privileges and system modifications necessary for basic setup. The persistence also increases the consequences of a compromised or untrusted TDengine installation because any substituted daemon would execute automatically after reboot.

Attack Path

  1. The user follows the documented installation procedure, potentially with administrative privileges.
  2. The external TDengine installer installs the taosd executable and its systemd service definition.
  3. The user runs systemctl start taosd, launching the database daemon.
  4. The user runs systemctl enable taosd, registering the daemon for automatic execution at system startup.
  5. The daemon continues to execute after reboots. If the downloaded distribution or installed service has been compromised, attacker-controlled code receives persistent execution through the enabled service.

Impact Assessment

The change affects the host's system-wide service configuration and survives both the Skill run and system reboots. It requires administrative authorization in a typical Linux environment.

The persistent daemon expands the machine's network attack surface, particularly if TDengine listens on the ...[truncated 357 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not enable the service automatically as part of the default installation flow.
  • Start the service only for immediate validation with systemctl start taosd.
  • Present boot-time enablement as a separate, optional step that requires explicit user consent.
  • Explain that systemctl enable changes persistent, system-wide configuration and generally requires administrative privileges.
  • Run taosd under a dedicated, unprivileged service account with restrictive systemd hardening options.
  • Bind the service only to required trusted interfaces and restrict ports 6030–6041 with host and network firewalls.
  • Provide rollback commands such as systemctl disable --now taosd and documented uninstall procedures.
  • Verify the installed executable and service definition before enabling automatic startup.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:27
Finding

Execution of an Unverified Remotely Downloaded Installer

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–35
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

markdown
从 TDengine 官方地址下载 3.3.6.0 Server 版：
- **地址**: `https://www.taosdata.com/assets-download/TDengine-server-3.3.6.0-Linux-x64.tar.gz`

### 2. 解压与安装
```bash
tar -xzvf TDengine-server-3.3.6.0-Linux-x64.tar.gz
cd TDengine-server-3.3.6.0
./install.sh
text

### Technical Analysis

The Skill directs the user to retrieve an archive from an external URL and execute the archive's `install.sh` script without first validating a cryptographic checksum or digital signature. HTTPS protects the connection in transit but does not independently prove that the artifact is the intended vendor release or that the hosting infrastructure has not been compromised.

The effective installer payload is not included in the audited project and may change independently after review. Its behavior therefore cannot be determined from the Skill package. Because software installation and system service registration commonly require administrative privileges, a substituted installer could execute arbitrary commands with significant host access.

This behavior best matches remote payload retrieval and execution rather than embedded malicious code: the project contains only `SKILL.md`, and no local malicious script was found.

### Attack Path

1. An attacker compromises the remote hosting account, download infrastructure, vendor distribution process, or published archive.
2. The archive at the documented URL is replaced with or modified to contain attacker-controlled installation logic.
3. The user downloads the archive while following the Skill instructions.
4. The user extracts the archive and executes `./install.sh` without checking a trusted checksum or signature.
5. The substituted installer executes commands with the user's installation privileges.
6. The attack can become persistent 
...[truncated 836 chars]
Remediation
View remediation

Remediation Suggestions

  • Publish and pin an expected SHA-256 or stronger digest for the exact TDengine 3.3.6.0 archive.
  • Verify the digest before extraction and abort installation on any mismatch.
  • Prefer a vendor-provided cryptographic signature verified against a trusted, documented signing key.
  • Obtain checksums or signatures through an independently authenticated channel rather than from the same mutable download location.
  • Prefer a signed official operating-system package repository where available.
  • Pin the release artifact and avoid mutable URLs.
  • Inspect the archive contents and installer before granting elevated privileges.
  • Separate download, verification, extraction, installation, service startup, and persistence into explicit steps.
  • Do not enable the installed service until the executable and systemd unit have been validated.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs users to run an installation script and start a system service, but it does not clearly warn that these actions will modify the host, install software, and create a persistent background service. This is dangerous because users may execute the skill without informed consent about system-level changes, increasing the risk of unintended configuration drift or deployment on sensitive systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill directs users to download a package from an external website and notes that firewall ports 6030-6041 should be opened, but it provides no privacy or network exposure warning. This is risky because it normalizes outbound downloads and inbound service exposure without prompting users to validate the source, package integrity, or the security implications of opening network access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

systemctl enable taosd configures the database service to start automatically on reboot, creating persistence on the host. In an installation skill this may be operationally normal, but it is still security-relevant because it causes ongoing background execution and can expand the attack surface if the service is unintentionally exposed or left running on systems where it is not needed.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

安装完成后，通过 systemd 管理服务：

bash
systemctl start taosd
systemctl enable taosd

4. 基础验证