KWDB Install Deploy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:13 AM UTC
• Version: 1.2.1

Overview

This skill is for legitimate KaiwuDB deployment, but it asks the agent to run a user-supplied installation archive with administrative cluster access without enough provenance or least-privilege safeguards.

Install only if you trust the KaiwuDB package source. Before letting an agent run this workflow, verify the archive with an official signature or checksum, inspect or stage the extracted files, use a dedicated least-privilege deployment account where possible, and understand that sudo, docker group access, passwordless SSH, and service auto-start can affect every node in the cluster.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:100

Finding

Unverified Installation Archive Is Extracted and Executed with Elevated Privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:100-120, 171-186; duplicated workflow in references/installation_guide.md:43-56, 105-120
Vulnerability Type: Untrusted software supply chain and unsafe privileged execution
Risk Level: High

Vulnerable Code

From SKILL.md:100-120:

bash

# Check if the installation package exists
if [ ! -f "$INSTALL_PACKAGE_PATH" ]; then
    echo "Error: Installation package does not exist, please check if the path is correct"
    exit 1
fi

# Check filename format
if [[ "$(basename $INSTALL_PACKAGE_PATH)" != KaiwuDB*.tar.gz ]]; then
    echo "Error: Installation package filename is incorrect. It should be a tar.gz file with KaiwuDB as the prefix"
    exit 1
fi

# Create installation directory
sudo mkdir -p /opt/kaiwudb

# Extract installation package
tar -xzf "$INSTALL_PACKAGE_PATH" -C /opt/kaiwudb

# Enter installation directory
cd /opt/kaiwudb/kaiwudb_install

From SKILL.md:171-186:

bash

# Single-node deployment
./deploy.sh install --single

# Single-replica cluster deployment
./deploy.sh install --single-replica

# Multi-replica cluster deployment
./deploy.sh install --multi-replica

The same unsafe trust model appears in references/installation_guide.md:43-56, 105-120:

bash

sudo mkdir -p /opt/kaiwudb
tar -xzf "$INSTALL_PACKAGE_PATH" -C /opt/kaiwudb
cd /opt/kaiwudb/$(basename "$INSTALL_PACKAGE_PATH" .tar.gz)

./deploy.sh install --single
./deploy.sh install --single-replica
./deploy.sh install --multi-replica

Technical Analysis

The workflow validates only that the supplied path exists and that its basename matches KaiwuDB*.tar.gz. A filename pattern does not establish the archive's authenticity, integrity, provenance, or safety.

The instructions do not require any of the following before execution:

• Verification of a vendor signature or trusted cryptographic digest.
• Confirmat ...[truncated 2519 chars]

Remediation

View remediation

Remediation Suggestions

1. Require authenticated package provenance

   • Accept packages only from an allowlisted official KaiwuDB source over authenticated HTTPS.
   • Do not treat a user-provided filename as proof of origin.

2. Verify package integrity and authenticity

   • Require a vendor-provided digital signature and verify it against a pinned trusted public key.
   • Alternatively, require an approved SHA-256 or stronger digest obtained through a separate trusted channel.
   • Abort deployment if verification fails or verification material is unavailable.

3. Validate archive contents before extraction

   • List and inspect all archive members first.
   • Reject absolute paths, .. traversal components, device files, unexpected hard links, and symbolic links escaping the staging directory.
   • Enforce an allowlist of expected top-level directories and installation files.

4. Use a restricted staging directory

   • Extract into a newly created directory owned by an unprivileged deployment account.
   • Apply restrictive permissions and ensure the destination is not shared or writable by other users.
   • Move only validated files into /opt/kaiwudb.

5. Review executable content

   • Confirm the digest or signature of deploy.sh independently.
   • Display the verified package version and publisher to the user before execution.
   • Refuse execution if the script or archive changes after verification.

6. Minimize privileges

   • Run validation and extraction without root privileges.
   • Elevate only individual operations that demonstrably require administrative access.
   • Avoid running the entire vendor deployment script as root when narrower sudo rules or a dedicated service account can satisfy the task.

7. Apply the same controls consistently

   • Update both SKILL.md and references/installation_guide.md so the secondary guide cannot bypass the hardened workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide requires SSH passwordless login across cluster nodes and sudo-capable access without explaining the security implications of lateral movement, key misuse, or over-broad remote trust. In a deployment skill, this is more dangerous because users may normalize insecure remote access patterns to make automation work, expanding the blast radius if one node or credential is compromised.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The documentation normalizes use of root, sudo privileges, and docker-group membership for deployment. While common operationally, these are privileged actions that materially reduce security boundaries, and adding a user to the docker group can effectively grant root-equivalent access on many systems.

Content

Scanner excerpt · references/installation_guide.md (reported line 20)May include surrounding context.

md

- SSH passwordless login is configured between the current node and other nodes in the cluster.
- The installation user is the `root` user or a regular user with `sudo` privileges.
- When deploying with the container installation package, if the installation user is a non-`root` user, add the user to the `docker` group by running `sudo usermod -aG docker $USER`.

## Deployment Steps

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The guide instructs users to create system directories, extract software into /opt, and run deployment scripts that modify the host, but it does not explicitly warn that these actions can change system state or affect existing services. In an agent skill context, omission of a clear confirmation/safety warning increases the chance of unintended privileged modifications, especially if the agent automates or strongly recommends execution.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

bash

# Create installation directory
sudo mkdir -p /opt/kaiwudb

# Extract installation package
tar -xzf "$INSTALL_PACKAGE_PATH" -C /opt/kaiwudb

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/installation_guide.md (reported line 49)May include surrounding context.

bash

# Create installation directory
sudo mkdir -p /opt/kaiwudb

# Extract installation package
tar -xzf "$INSTALL_PACKAGE_PATH" -C /opt/kaiwudb

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

Step 9: Configure Auto-start on Boot (Optional)

bash

systemctl enable kaiwudb

Status Check Description

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/installation_guide.md (reported line 169)May include surrounding context.

Step 9: Configure Auto-start on Boot (Optional)

bash

systemctl enable kaiwudb

Status Check Description

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/troubleshooting.md (reported line 21)May include surrounding context.

md

**Solution**:
- Check if system package manager is working normally (yum/apt)
- Try manually updating package manager:
  - CentOS: `sudo yum update -y`
  - Ubuntu: `sudo apt-get update -y`
- If network is slow, consider using domestic mirror sources

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/troubleshooting.md (reported line 22)May include surrounding context.

md

**Solution**:
- Check if system package manager is working normally (yum/apt)
- Try manually updating package manager:
  - CentOS: `sudo yum update -y`
  - Ubuntu: `sudo apt-get update -y`
- If network is slow, consider using domestic mirror sources

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file includes operational commands for dumping a database to backup.sql and restoring from that file, but it does not include any user-facing warning about the effects on local data or the target database. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or system integrity.

Content

No source excerpt is available for this finding.