Linux Security Scanner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:12 AM UTC
• Version: 1.0.0

Overview

This Linux audit skill mostly does what it says, but its script can turn crafted SSH configuration values into shell commands, which is risky if run as root.

Install only if you are comfortable reviewing and fixing the shell script first. The audit checks are coherent and local, but do not run this as sudo/root on systems where SSH configuration content might be attacker-controlled; replace the dynamic bash -c SSH summary with fixed printf-style handling before privileged use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/security-audit.sh:61

Finding

Command Injection Through Dynamically Constructed SSH Configuration Summary

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (26)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

`scripts/security-audit.sh` — the single entry point for all checks.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

`scripts/security-audit.sh` — the single entry point for all checks.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

`scripts/security-audit.sh` — the single entry point for all checks.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

`scripts/security-audit.sh` — the single entry point for all checks.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

`scripts/security-audit.sh` — the single entry point for all checks.

YARA rule 'privilege_escalation_tools': Privilege escalation tools and techniques [hacktools]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/security-audit.sh (reported line 236)May include surrounding context.

sh

ed directories"
    else
        warn "World-writable files found — review the list above"
    fi

    gather_section "World-Writable Files" bash -c "for d in /etc /tmp /var /home /opt; do [ -d \"\$d\" ] && find \"\$d\" -maxdepth 3 -type f -perm -0002 2>/dev/null; done | head -50"
}

check_suid() {
    section "SUID Binaries"

    echo "Finding SUID bit set on binaries..."
    local suid_list=$(find / -perm -4000 -type f 2>/dev/null | sort)

    if [[ -z "$suid_list" ]]; then
        info "No SUID binaries found"
        return
    fi

    echo "$suid_list"
    echo ""

    local known_risky=("pkexec" "passwd" "sudo" "su" "mount" "umount" "chsh" "chfn" "newgrp" "gpasswd")
    local risky_found=()

    for bin in $suid_list; do
        local name=$(basename "$bin")
        for risky in "${known_risky[@]}"; do
            if [[ "$name" == "$risky" ]]; then
                risky_found+=("$bin")
                break
            fi
        done
    done

    if [[ ${#risky_found[@]} -gt

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: linux-security-scanner
description: Linux security auditing tool that checks SSH configuration, open/listening ports, firewall rules (ufw/iptables/nftables), failed login attempts, sudoers permissions, world-writable files, and SUID binaries. Use when a user needs a security posture assessment, hardening audit, or compliance check on a Linux host — run individual checks or a full comprehensive audit with a formatted report.
---

# Linux Security Scanner

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

---
name: linux-security-scanner
description: Linux security auditing tool that checks SSH configuration, open/listening ports, firewall rules (ufw/iptables/nftables), failed login attempts, sudoers permissions, world-writable files, and SUID binaries. Use when a user needs a security posture assessment, hardening audit, or compliance check on a Linux host — run individual checks or a full comprehensive audit with a formatted report.
---

# Linux Security Scanner

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/security-audit.sh (reported line 7)May include surrounding context.

sh

---
name: linux-security-scanner
description: Linux security auditing tool that checks SSH configuration, open/listening ports, firewall rules (ufw/iptables/nftables), failed login attempts, sudoers permissions, world-writable files, and SUID binaries. Use when a user needs a security posture assessment, hardening audit, or compliance check on a Linux host — run individual checks or a full comprehensive audit with a formatted report.
---

# Linux Security Scanner

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/security-audit.sh (reported line 25)May include surrounding context.

sh

---
name: linux-security-scanner
description: Linux security auditing tool that checks SSH configuration, open/listening ports, firewall rules (ufw/iptables/nftables), failed login attempts, sudoers permissions, world-writable files, and SUID binaries. Use when a user needs a security posture assessment, hardening audit, or compliance check on a Linux host — run individual checks or a full comprehensive audit with a formatted report.
---

# Linux Security Scanner

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/security-audit.sh (reported line 224)May include surrounding context.

sh

---
name: linux-security-scanner
description: Linux security auditing tool that checks SSH configuration, open/listening ports, firewall rules (ufw/iptables/nftables), failed login attempts, sudoers permissions, world-writable files, and SUID binaries. Use when a user needs a security posture assessment, hardening audit, or compliance check on a Linux host — run individual checks or a full comprehensive audit with a formatted report.
---

# Linux Security Scanner

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/security-audit.sh (reported line 343)May include surrounding context.

sh

---
name: linux-security-scanner
description: Linux security auditing tool that checks SSH configuration, open/listening ports, firewall rules (ufw/iptables/nftables), failed login attempts, sudoers permissions, world-writable files, and SUID binaries. Use when a user needs a security posture assessment, hardening audit, or compliance check on a Linux host — run individual checks or a full comprehensive audit with a formatted report.
---

# Linux Security Scanner

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

| `--ports` | Listening TCP ports (ss or netstat) |
| `--firewall` | ufw status, iptables filter rules, nftables ruleset |
| `--failed-logins` | lastb output and journalctl SSH auth failures (last 24h) |
| `--sudoers` | Sudoers file permissions (must be 440), files present, NOPASSWD entries, full sudo access grants |
| `--world-writable` | World-writable files in /etc, /tmp, /var, /home, /opt (depth 3) |
| `--suid` | All SUID binaries, risk assessment, unusual path detection |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

| `--ports` | Listening TCP ports (ss or netstat) |
| `--firewall` | ufw status, iptables filter rules, nftables ruleset |
| `--failed-logins` | lastb output and journalctl SSH auth failures (last 24h) |
| `--sudoers` | Sudoers file permissions (must be 440), files present, NOPASSWD entries, full sudo access grants |
| `--world-writable` | World-writable files in /etc, /tmp, /var, /home, /opt (depth 3) |
| `--suid` | All SUID binaries, risk assessment, unusual path detection |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

| `--ports` | Listening TCP ports (ss or netstat) |
| `--firewall` | ufw status, iptables filter rules, nftables ruleset |
| `--failed-logins` | lastb output and journalctl SSH auth failures (last 24h) |
| `--sudoers` | Sudoers file permissions (must be 440), files present, NOPASSWD entries, full sudo access grants |
| `--world-writable` | World-writable files in /etc, /tmp, /var, /home, /opt (depth 3) |
| `--suid` | All SUID binaries, risk assessment, unusual path detection |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/security-audit.sh (reported line 193)May include surrounding context.

sh

| `--ports` | Listening TCP ports (ss or netstat) |
| `--firewall` | ufw status, iptables filter rules, nftables ruleset |
| `--failed-logins` | lastb output and journalctl SSH auth failures (last 24h) |
| `--sudoers` | Sudoers file permissions (must be 440), files present, NOPASSWD entries, full sudo access grants |
| `--world-writable` | World-writable files in /etc, /tmp, /var, /home, /opt (depth 3) |
| `--suid` | All SUID binaries, risk assessment, unusual path detection |

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

| `--firewall` | ufw status, iptables filter rules, nftables ruleset |
| `--failed-logins` | lastb output and journalctl SSH auth failures (last 24h) |
| `--sudoers` | Sudoers file permissions (must be 440), files present, NOPASSWD entries, full sudo access grants |
| `--world-writable` | World-writable files in /etc, /tmp, /var, /home, /opt (depth 3) |
| `--suid` | All SUID binaries, risk assessment, unusual path detection |

Example:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

| `--firewall` | ufw status, iptables filter rules, nftables ruleset |
| `--failed-logins` | lastb output and journalctl SSH auth failures (last 24h) |
| `--sudoers` | Sudoers file permissions (must be 440), files present, NOPASSWD entries, full sudo access grants |
| `--world-writable` | World-writable files in /etc, /tmp, /var, /home, /opt (depth 3) |
| `--suid` | All SUID binaries, risk assessment, unusual path detection |

Example:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/security-audit.sh (reported line 226)May include surrounding context.

sh

| `--firewall` | ufw status, iptables filter rules, nftables ruleset |
| `--failed-logins` | lastb output and journalctl SSH auth failures (last 24h) |
| `--sudoers` | Sudoers file permissions (must be 440), files present, NOPASSWD entries, full sudo access grants |
| `--world-writable` | World-writable files in /etc, /tmp, /var, /home, /opt (depth 3) |
| `--suid` | All SUID binaries, risk assessment, unusual path detection |

Example:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/security-audit.sh (reported line 202)May include surrounding context.

sh

gather_section "Sudoers Audit" bash -c "echo 'Files:'; find /etc/sudoers /etc/sudoers.d -type f 2>/dev/null; echo '---'; echo 'NOPASSWD:'; grep -r 'NOPASSWD' /etc/sudoers /etc/sudoers.d 2>/dev/null || echo 'none'; echo 'Full sudo:'; grep -r 'ALL=(ALL:ALL) ALL' /etc/sudoers /etc/sudoers.d 2>/dev/null || echo 'none'"
}

check_world_writable() {
    section "World-Writable Files"

    local dirs=("/etc" "/tmp" "/var" "/home" "/opt")

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/security-audit.sh (reported line 308)May include surrounding context.

sh

gather_section "Sudoers Audit" bash -c "echo 'Files:'; find /etc/sudoers /etc/sudoers.d -type f 2>/dev/null; echo '---'; echo 'NOPASSWD:'; grep -r 'NOPASSWD' /etc/sudoers /etc/sudoers.d 2>/dev/null || echo 'none'; echo 'Full sudo:'; grep -r 'ALL=(ALL:ALL) ALL' /etc/sudoers /etc/sudoers.d 2>/dev/null || echo 'none'"
}

check_world_writable() {
    section "World-Writable Files"

    local dirs=("/etc" "/tmp" "/var" "/home" "/opt")

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/security-audit.sh (reported line 343)May include surrounding context.

sh

gather_section "Sudoers Audit" bash -c "echo 'Files:'; find /etc/sudoers /etc/sudoers.d -type f 2>/dev/null; echo '---'; echo 'NOPASSWD:'; grep -r 'NOPASSWD' /etc/sudoers /etc/sudoers.d 2>/dev/null || echo 'none'; echo 'Full sudo:'; grep -r 'ALL=(ALL:ALL) ALL' /etc/sudoers /etc/sudoers.d 2>/dev/null || echo 'none'"
}

check_world_writable() {
    section "World-Writable Files"

    local dirs=("/etc" "/tmp" "/var" "/home" "/opt")

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/security-audit.sh (reported line 203)May include surrounding context.

sh

}

check_world_writable() {
    section "World-Writable Files"

    local dirs=("/etc" "/tmp" "/var" "/home" "/opt")
    local found=0

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/security-audit.sh (reported line 229)May include surrounding context.

sh

}

check_world_writable() {
    section "World-Writable Files"

    local dirs=("/etc" "/tmp" "/var" "/home" "/opt")
    local found=0

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill can run a full audit with a formatted report, and the script builds a REPORT variable throughout execution. However, at the end it only states that raw audit data is stored in the shell variable and does not print, save, or otherwise return the formatted report, so the documented/reporting intent diverges from actual behavior.

Content

No source excerpt is available for this finding.