T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/issuefinder-tool.py:659- Finding
Unsigned Remote Code Is Automatically Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
Security audit
Issuefinder Tool
Security checks for vulnerabilities and agentic risk
Overview
This vehicle-log tool has useful, disclosed log workflows, but it automatically replaces itself with unverified code from a server and keeps executing that home-directory copy later.
Install only if you trust the IssueFinder server and are comfortable sending vehicle logs, VINs, and timestamps to that service. Avoid custom or HTTP servers, use --skip-version-check if running it anyway, and treat archives and downloaded outputs as untrusted until the updater, cached-script override, and path-validation issues are fixed.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T06 · System Persistence
Error
- Location
scripts/issuefinder-tool.py:1285- Finding
Persistent Unverified Home-Directory Script Overrides the Packaged Tool
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/issuefinder-tool.py:345- Finding
Server-Controlled Download Filenames Permit Writes Outside the Output Directory
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/issuefinder-tool.py:549- Finding
Untrusted Archives Are Extracted Without Path or Link Validation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/issuefinder-tool.py:159- Finding
Sensitive Vehicle Logs Can Be Uploaded to Arbitrary Plaintext or Untrusted Servers
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (25)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `issuefinder-tool.py` - 原始工具（从云端同步）
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
始工具的所有参数和功能
- ✅ 灵活覆盖：仍可通过
--output参数指定自定义路径
环境变量
ISSUEFINDER_LOGS_PATH
指定日志输出的基础路径。
默认值：
~/issuefinder_mcp_log设置方法：
bash # 临时设置（当前会话） export ISSUEFINDER_LOGS_PATH="/your/custom/path" # 永久设置（添加到 ~/.bashrc 或 ~/.zshrc） echo 'export ISSUEFINDER_LOGS_PATH="/your/custom/path"' >> ~/.bashrc source ~/.bashrc目录结构
包装脚本会自动创建以下目录结构：
text $ISSUEFINDER_LOGS_PATH/ ├── 2026/ │ ├── 02/ │ │ ├── 26/ │ │ │ ├── VIN_HLX33B124P1767770/ # 云端下载日志 │ │ │ │ ├── lastlog │ │ │ │ ├── minidump │ │ │ │ └── ... │ │ │ ├── vehicle_logs.zip/ # 本地处理日志 │ │ │ │ ├── parsed_lastlog.txt │ │ │- ✅ 灵活覆盖：仍可通过
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The self-update mechanism contacts a remote endpoint, downloads a new script, writes it to disk, marks it executable, and immediately replaces the current process with it. This is a high-risk software supply-chain pattern because compromise of the update source or transport yields arbitrary code execution on the client machine, and the skill's stated purpose does not justify this undeclared execution capability.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The tool performs automatic self-update and immediate execution without an explicit warning, consent prompt, or integrity verification. Users invoking a log utility would not reasonably expect it to replace itself and run new code on its own, making this a severe trust and code-execution issue.
- Content
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 99% confidence
- Finding
The tool downloads replacement Python code from a remote server into ~/.issuefinder and immediately re-executes it with os.execv, with no signature verification, hash pinning, or user confirmation. That creates an arbitrary code execution path controlled by the update endpoint or anyone able to tamper with traffic/server content, which is especially dangerous because this behavior is unrelated to simple log parsing and happens automatically.
- Content
python print_status("Restarting with new version...") # Re-execute with the new version os.execv(sys.executable, [sys.executable, new_tool_path] + sys.argv[1:]) except Exception as e: if verbose:
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script automatically executes a copy from ~/.issuefinder if it exists, introducing hidden persistence and alternate code loading behavior beyond the advertised functionality. Because the location is user-writable and populated by the self-update path, this creates a durable trust bypass where unreviewed code can take over future executions.
- Content
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 98% confidence
- Finding
On startup, the script checks ~/.issuefinder/issuefinder-tool.py and prefers executing that file instead of the current script. This implicitly trusts previously downloaded code in a user-writable location, enabling persistence and code hijacking if that file is replaced by a malicious local actor or was poisoned by the insecure self-update flow.
- Content
python # or if it's different from current script try: # Re-execute with the updated version os.execv(sys.executable, [sys.executable, updated_tool] + sys.argv[1:]) except Exception: pass # If re-execution fails, continue with current version
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill advertises and instructs use of capabilities including environment variables, file read/write, shell execution, and network access, but it declares no explicit tool scope or permissions boundary. In a skill that downloads remote vehicle logs, extracts archives, updates itself, and writes to user-controlled paths, this omission prevents users and platforms from enforcing least privilege and increases the risk of overbroad access or abuse.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language documentation forces a single language presentation throughout the skill file. Under the stated policy, language constraints should either offer user choice or be explicitly documented and justified as region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation instructs users to send VINs, timestamps, and vehicle log data to IssueFinder/cloud services, but it does not clearly warn that potentially sensitive telemetry and diagnostic data will be transmitted to remote systems. Because vehicle logs can contain identifiers, operational details, and other sensitive data, users may expose regulated or confidential information without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation explicitly promotes cloud log download and automated analysis of vehicle logs, but provides no warning about the sensitivity of those logs or the privacy/security implications of transmitting them. Vehicle logs can contain VINs, timestamps, device state, crash data, and other sensitive operational information, so normalizing upload/download workflows without disclosure increases the risk of inadvertent data exposure or mishandling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This file contains natural-language documentation and runtime messages in Chinese only, such as the module docstring and later printed status/error text. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is justified or optional, which is not shown here.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 执行原始工具 try: result = subprocess.run(cmd, check=False) sys.exit(result.returncode) except KeyboardInterrupt: print("\n操作被用户中断")
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
python 'User-Agent': 'IssueFinder-CLI/1.0' } def _make_request(self, method, url, data=None, headers=None, timeout=None, max_retries=3): """Make HTTP request with retry logic""" full_url = f"{self.server_url}{url}" req_headers = self.session_headers.copy()
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This function reads arbitrary local files and uploads their full contents to a remote server, but the tool does not provide a strong data-transmission warning or consent checkpoint beyond the generic upload mode. In the context of vehicle logs, uploaded data may contain sensitive operational, location, or personal information, so silent or weakly disclosed transmission increases privacy and compliance risk.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 86% confidence
- Finding
Downloaded filenames from the remote environment are joined directly with the local output directory and intermediate directories are created without validating the resulting path. If the server returns names containing ../ or absolute-path elements, the tool can write files outside the intended output directory, enabling overwrite of arbitrary user-accessible files and potentially planting persistent code or configuration.
- Content
python file_name = file_info['name'] local_path = os.path.join(final_output_dir, file_name) # Create subdirectories if needed local_dir = os.path.dirname(local_path) if local_dir and local_dir != final_output_dir: os.makedirs(local_dir, exist_ok=True)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # Try system tools first if filename.endswith('.zip'): try: subprocess.run(['unzip', '-q', archive_path, '-d', extract_to], check=True, capture_output=True, text=True) if verbose: print_status("Extracted using system unzip")
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python elif filename.endswith(('.tar.gz', '.tgz')): try: subprocess.run(['tar', '-xzf', archive_path, '-C', extract_to], check=True, capture_output=True, text=True) if verbose: print_status("Extracted using system tar")
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python elif filename.endswith('.tar'): try: subprocess.run(['tar', '-xf', archive_path, '-C', extract_to], check=True, capture_output=True, text=True) if verbose: print_status("Extracted using system tar")
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python try: with open(output_path, 'wb') as output_file: subprocess.run(['gunzip', '-c', archive_path], stdout=output_file, check=True) if verbose: print_status("Extracted using system gunzip")
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python elif filename.endswith('.7z'): try: subprocess.run(['7z', 'x', archive_path, f'-o{extract_to}', '-y'], check=True, capture_output=True, text=True) if verbose: print_status("Extracted using system 7z")
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
python def find_files_in_directory(directory, verbose=False): """ Recursively find all files in directory and detect their types Args: directory: Directory to search
Cloud Storage Exfiltration
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
The code uploads selected local files to a cloud environment, which is core functionality, but it still constitutes off-host data exfiltration from a security perspective. In a vehicle-log context this is somewhat expected, yet still sensitive because archives may contain credentials, proprietary telemetry, or personally identifiable information and the upload is coupled to an external service.
- Content
python uploaded_files = [] for file_path in files_to_process: print_status(f"Uploading file: {os.path.basename(file_path)}") upload_response = client.upload_file(env_id, file_path) uploaded_files.append(upload_response['filename']) print_status(f"File uploaded: {upload_response['filename']}", "SUCCESS")
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The skill promotes automatic extraction of zip, tar.gz, and 7z archives without warning that extracted contents will be written to disk and may consume space or introduce unsafe filenames/paths. In a log-processing workflow, users may handle untrusted archives, so silent extraction increases the chance of filesystem overwrite, path traversal exposure in downstream tooling, or accidental processing of malicious content.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
A language or locale policy violation applies to all file types when a skill effectively forces a specific language without user opt-in. This file presents all instructions in Chinese and does not indicate that users may choose another language or that the skill is restricted to a Chinese-speaking context.
- Content