🦒 Giraffe Guard — 长颈鹿卫士

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:02 PM UTC
• Version: 3.1.0

Overview

This is a mostly transparent security scanner, but it needs review because one script bug can contact remote Git repositories without the documented pre-install flag and SARIF reports can be manipulated by scanned content.

Install only if you are comfortable letting this skill read the directories you explicitly scan, including files that may contain secrets. Treat its SARIF output as untrusted for CI gates until output encoding is fixed, and avoid passing remote-looking targets such as git@... or paths ending in .git unless you intend a network clone.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/audit.sh:199

Finding

Incorrect Boolean Grouping Causes Unintended Remote Repository Cloning

Content

View full analysis

/dev/null; then echo "Error: Failed to clone $TARGET_DIR" rm -rf "$PRE_INSTALL_TMPDIR" exit 1 fi TARGET_DIR="$PRE_INSTALL_TMPDIR/repo" echo "Cloned to temp dir. Scanning WITHOUT running install..." echo "" fi ``` ### Technical Analysis The condition combines `&&` and `||` without explicitly grouping all remote-target checks under the `PRE_INSTALL` requirement. Its effective logic is: ```text (PRE_INSTALL is true AND target begins with HTTP) OR target begins with git@ OR target ends with .git ``` Therefore, a `git@...` target or any target ending in `.git` triggers `git clone` even when the caller did not provide `--pre-install`. This violates the scanner's intended privilege and behavior boundary: ordinary scan mode is expected to inspect a local directory, while network retrieval should occur only when pre-install mode is explicitly selected. The clone operation disables repository hooks through `core.hooksPath=/dev/null`, and the scanner does not install or execute the downloaded repository. This substantially limits code-execution risk, but it does not prevent unintended network communication or retrieval of attacker-controlled content. ### Attack Path 1. An attacker supplies or recommends a target such as: ```text [e-mail]:malicious/repository.git ``` 2. The user invokes the scanner without `--pre-install`: ```bash bash scripts/audit.sh [e-mail]:malicio ...[truncated 959 chars]

Remediation

View remediation

/dev/null; then echo "Error: Failed to clone $TARGET_DIR" rm -rf "$PRE_INSTALL_TMPDIR" exit 1 fi TARGET_DIR="$PRE_INSTALL_TMPDIR/repo" fi ``` Additional hardening should include: 1. Reject remote-looking targets when `--pre-install` is absent. 2. Restrict accepted schemes to an explicit allowlist such as HTTPS and SSH. 3. Consider disabling interactive SSH prompts for automated use. 4. Apply clone size and execution-time limits where the environment supports them. 5. Document clearly that pre-install mode performs network access. 6. Add regression tests proving that `git@...` and `*.git` targets do not trigger cloning in ordinary scan mode. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/audit.sh:1319

Finding

Unescaped Attacker-Controlled Values Permit SARIF Output Injection

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (32)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

| 10 | covert-downloader | One-liner downloaders | 单行下载器 |
| 11 | persistence-launchagent | macOS LaunchAgent | 持久化 |
| 13 | string-concat-bypass | String concatenation bypass | 字符串拼接绕过 |
| 15 | env-file-leak | .env with real secrets | .env 密钥泄露 |
| 16 | typosquat-npm/pip | Typosquatting packages | 包名仿冒 |
| 17 | malicious-postinstall | Malicious lifecycle scripts | 恶意生命周期脚本 |
| 18 | git-hooks | Active git hooks | 活跃 git hooks |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.sh (reported line 371)May include surrounding context.

sh

| 10 | covert-downloader | One-liner downloaders | 单行下载器 |
| 11 | persistence-launchagent | macOS LaunchAgent | 持久化 |
| 13 | string-concat-bypass | String concatenation bypass | 字符串拼接绕过 |
| 15 | env-file-leak | .env with real secrets | .env 密钥泄露 |
| 16 | typosquat-npm/pip | Typosquatting packages | 包名仿冒 |
| 17 | malicious-postinstall | Malicious lifecycle scripts | 恶意生命周期脚本 |
| 18 | git-hooks | Active git hooks | 活跃 git hooks |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.sh (reported line 791)May include surrounding context.

sh

| 10 | covert-downloader | One-liner downloaders | 单行下载器 |
| 11 | persistence-launchagent | macOS LaunchAgent | 持久化 |
| 13 | string-concat-bypass | String concatenation bypass | 字符串拼接绕过 |
| 15 | env-file-leak | .env with real secrets | .env 密钥泄露 |
| 16 | typosquat-npm/pip | Typosquatting packages | 包名仿冒 |
| 17 | malicious-postinstall | Malicious lifecycle scripts | 恶意生命周期脚本 |
| 18 | git-hooks | Active git hooks | 活跃 git hooks |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.sh (reported line 808)May include surrounding context.

sh

| 10 | covert-downloader | One-liner downloaders | 单行下载器 |
| 11 | persistence-launchagent | macOS LaunchAgent | 持久化 |
| 13 | string-concat-bypass | String concatenation bypass | 字符串拼接绕过 |
| 15 | env-file-leak | .env with real secrets | .env 密钥泄露 |
| 16 | typosquat-npm/pip | Typosquatting packages | 包名仿冒 |
| 17 | malicious-postinstall | Malicious lifecycle scripts | 恶意生命周期脚本 |
| 18 | git-hooks | Active git hooks | 活跃 git hooks |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ast_analyzer.py (reported line 412)May include surrounding context.

python

def scan_directory(dirpath):
    """Recursively scan all .py files in a directory."""
    skip_dirs = {".git", "__pycache__", "node_modules", ".venv", "venv",
                 "env", ".env", ".tox", ".mypy_cache", ".pytest_cache",
                 "test", "tests", "__tests__", "spec", "fixtures", "testdata"}
    for root, dirs, files in os.walk(dirpath):
        # Skip excluded directories

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/audit.sh (reported line 57)May include surrounding context.

sh

echo 0 > "$TMPDIR_AUDIT/files"
FINDINGS_FILE="$TMPDIR_AUDIT/findings_json"
touch "$FINDINGS_FILE"
trap 'rm -rf "$TMPDIR_AUDIT"; [[ -n "$PRE_INSTALL_TMPDIR" ]] && rm -rf "$PRE_INSTALL_TMPDIR"' EXIT

usage() {
    cat <<EOF

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/audit.sh (reported line 106)May include surrounding context.

sh

Grep-based rules (always active):
  RULE NAME                   SEVERITY    DESCRIPTION
  pipe-execution              CRITICAL    curl/wget piped to shell (curl|bash)
  base64-decode-pipe          CRITICAL    Base64 decoded and piped to execution
  base64-echo-decode          CRITICAL    Echo piped to base64 decode
  long-base64-string          WARNING     Suspiciously long Base64 encoded string

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/audit.sh (reported line 111)May include surrounding context.

sh

base64-echo-decode          CRITICAL    Echo piped to base64 decode
  long-base64-string          WARNING     Suspiciously long Base64 encoded string
  security-bypass             CRITICAL    macOS Gatekeeper / quarantine bypass
  dangerous-permissions       WARNING     chmod 777, setuid, chown root
  suspicious-network-ip       WARNING     Direct IP connection (non-private)
  tor-onion-address           CRITICAL    .onion domain usage
  reverse-shell               CRITICAL    Reverse shell patterns (nc -e, /dev/tcp)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/audit.sh (reported line 351)May include surrounding context.

sh

base64-echo-decode          CRITICAL    Echo piped to base64 decode
  long-base64-string          WARNING     Suspiciously long Base64 encoded string
  security-bypass             CRITICAL    macOS Gatekeeper / quarantine bypass
  dangerous-permissions       WARNING     chmod 777, setuid, chown root
  suspicious-network-ip       WARNING     Direct IP connection (non-private)
  tor-onion-address           CRITICAL    .onion domain usage
  reverse-shell               CRITICAL    Reverse shell patterns (nc -e, /dev/tcp)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.sh (reported line 119)May include surrounding context.

sh

covert-exec-python          WARNING     os.system() / subprocess in unexpected context
  covert-exec-eval            WARNING     eval() in shell/JS/TS files
  file-disguise               WARNING     Double extensions (.pdf.exe, .jpg.sh)
  sensitive-data-access       WARNING     /etc/passwd, /etc/shadow access
  anti-sandbox                CRITICAL    Anti-debug techniques (ptrace, LD_PRELOAD)
  covert-downloader-python    CRITICAL    Python one-liner downloader
  covert-downloader-node      CRITICAL    Node one-liner downloader

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.sh (reported line 773)May include surrounding context.

sh

covert-exec-python          WARNING     os.system() / subprocess in unexpected context
  covert-exec-eval            WARNING     eval() in shell/JS/TS files
  file-disguise               WARNING     Double extensions (.pdf.exe, .jpg.sh)
  sensitive-data-access       WARNING     /etc/passwd, /etc/shadow access
  anti-sandbox                CRITICAL    Anti-debug techniques (ptrace, LD_PRELOAD)
  covert-downloader-python    CRITICAL    Python one-liner downloader
  covert-downloader-node      CRITICAL    Node one-liner downloader

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.sh (reported line 119)May include surrounding context.

sh

covert-exec-python          WARNING     os.system() / subprocess in unexpected context
  covert-exec-eval            WARNING     eval() in shell/JS/TS files
  file-disguise               WARNING     Double extensions (.pdf.exe, .jpg.sh)
  sensitive-data-access       WARNING     /etc/passwd, /etc/shadow access
  anti-sandbox                CRITICAL    Anti-debug techniques (ptrace, LD_PRELOAD)
  covert-downloader-python    CRITICAL    Python one-liner downloader
  covert-downloader-node      CRITICAL    Node one-liner downloader

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.sh (reported line 773)May include surrounding context.

sh

covert-exec-python          WARNING     os.system() / subprocess in unexpected context
  covert-exec-eval            WARNING     eval() in shell/JS/TS files
  file-disguise               WARNING     Double extensions (.pdf.exe, .jpg.sh)
  sensitive-data-access       WARNING     /etc/passwd, /etc/shadow access
  anti-sandbox                CRITICAL    Anti-debug techniques (ptrace, LD_PRELOAD)
  covert-downloader-python    CRITICAL    Python one-liner downloader
  covert-downloader-node      CRITICAL    Node one-liner downloader

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/audit.sh (reported line 124)May include surrounding context.

sh

ve-data-access       WARNING     /etc/passwd, /etc/shadow access
  anti-sandbox                CRITICAL    Anti-debug techniques (ptrace, LD_PRELOAD)
  covert-downloader-python    CRITICAL    Python one-liner downloader
  covert-downloader-node      CRITICAL    Node one-liner downloader
  covert-downloader-powershell CRITICAL   PowerShell download cradles
  cron-injection              WARNING     Crontab / LaunchAgent modification
  persistence-launchagent     CRITICAL    LaunchAgent/Daemon creation
  encoding-obfuscation        WARNING     Hex/octal/unicode escape sequences
  suspicious-npm-package      WARNING     Known malicious npm packages
  postinstall-script          WARNING     npm lifecycle scripts with network/exec
  skillmd-injection           WARNING     Skill.md with embedded code injection
  dockerfile-privileged       WARNING     Dockerfile privileged / ADD from URL
  zero-width-chars            WARNING     Zero-width unicode characters
  hardcoded-aws-key           CRIT

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.sh (reported line 133)May include surrounding context.

sh

dockerfile-privileged       WARNING     Dockerfile privileged / ADD from URL
  zero-width-chars            WARNING     Zero-width unicode characters
  hardcoded-aws-key           CRITICAL    AWS access key (AKIA...)
  hardcoded-github-token      CRITICAL    GitHub personal access token (ghp_...)
  hardcoded-stripe-key        CRITICAL    Stripe live secret key (sk_live_...)
  hardcoded-slack-token       CRITICAL    Slack token (xoxb-/xoxp-/xoxs-)
  hardcoded-slack-webhook     WARNING     Slack webhook URL

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · scripts/audit.sh (reported line 380)May include surrounding context.

sh

skillmd-prompt-injection) echo "Remove prompt injection patterns from SKILL.md" ;;
        skillmd-dangerous-command) echo "Remove destructive commands from SKILL.md" ;;
        skillmd-privilege-escalation) echo "Remove sudo/root requirements from SKILL.md" ;;
        dockerfile-privileged) echo "Remove --privileged; use specific capabilities instead" ;;
        dockerfile-sensitive-mount) echo "Avoid mounting host /etc, /root, /home into containers" ;;
        dockerfile-host-network) echo "Use bridge networking instead of --net=host" ;;
        zero-width-chars|embedded-bom) echo "Remove hidden Unicode characters; they may conceal malicious content" ;;

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · scripts/audit.sh (reported line 382)May include surrounding context.

sh

skillmd-privilege-escalation) echo "Remove sudo/root requirements from SKILL.md" ;;
        dockerfile-privileged) echo "Remove --privileged; use specific capabilities instead" ;;
        dockerfile-sensitive-mount) echo "Avoid mounting host /etc, /root, /home into containers" ;;
        dockerfile-host-network) echo "Use bridge networking instead of --net=host" ;;
        zero-width-chars|embedded-bom) echo "Remove hidden Unicode characters; they may conceal malicious content" ;;
        hardcoded-aws-key) echo "Use IAM roles or AWS Secrets Manager instead of hardcoded keys" ;;
        hardcoded-github-token) echo "Use GITHUB_TOKEN from Actions or GitHub App tokens" ;;

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · scripts/audit.sh (reported line 941)May include surrounding context.

sh

skillmd-privilege-escalation) echo "Remove sudo/root requirements from SKILL.md" ;;
        dockerfile-privileged) echo "Remove --privileged; use specific capabilities instead" ;;
        dockerfile-sensitive-mount) echo "Avoid mounting host /etc, /root, /home into containers" ;;
        dockerfile-host-network) echo "Use bridge networking instead of --net=host" ;;
        zero-width-chars|embedded-bom) echo "Remove hidden Unicode characters; they may conceal malicious content" ;;
        hardcoded-aws-key) echo "Use IAM roles or AWS Secrets Manager instead of hardcoded keys" ;;
        hardcoded-github-token) echo "Use GITHUB_TOKEN from Actions or GitHub App tokens" ;;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.sh (reported line 741)May include surrounding context.

sh

local bname
        bname=$(basename "$file")
        case "$bname" in
            .gitignore|.gitkeep|.gitattributes|.editorconfig|.eslintrc*|.prettierrc*|.DS_Store|.env*|.npmrc|.yarnrc*) continue ;;
        esac
        add_finding "WARNING" "$file" "0" "hidden-executable" "Hidden executable file: $bname"
    done

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.sh (reported line 887)May include surrounding context.

sh

local bname
        bname=$(basename "$file")
        case "$bname" in
            .gitignore|.gitkeep|.gitattributes|.editorconfig|.eslintrc*|.prettierrc*|.DS_Store|.env*|.npmrc|.yarnrc*) continue ;;
        esac
        add_finding "WARNING" "$file" "0" "hidden-executable" "Hidden executable file: $bname"
    done

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.sh (reported line 888)May include surrounding context.

sh

local bname
        bname=$(basename "$file")
        case "$bname" in
            .gitignore|.gitkeep|.gitattributes|.editorconfig|.eslintrc*|.prettierrc*|.DS_Store|.env*|.npmrc|.yarnrc*) continue ;;
        esac
        add_finding "WARNING" "$file" "0" "hidden-executable" "Hidden executable file: $bname"
    done

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.sh (reported line 890)May include surrounding context.

sh

local bname
        bname=$(basename "$file")
        case "$bname" in
            .gitignore|.gitkeep|.gitattributes|.editorconfig|.eslintrc*|.prettierrc*|.DS_Store|.env*|.npmrc|.yarnrc*) continue ;;
        esac
        add_finding "WARNING" "$file" "0" "hidden-executable" "Hidden executable file: $bname"
    done

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.sh (reported line 884)May include surrounding context.

sh

fi
    done
    # Credential files
    find "$dir" -type f \( -name "credentials.json" -o -name "service-account*.json" -o -name ".pypirc" \) ! -path "*/.git/*" 2>/dev/null | while read -r f; do
        add_finding "CRITICAL" "$f" "0" "sensitive-file-leak" "Credential file found: $(basename "$f")"
    done
    # .npmrc with auth token

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · scripts/audit.sh (reported line 936)May include surrounding context.

sh

done

    # Sensitive volume mounts
    grep -n -E '(-v|volumes:)\s*.*\b(/etc|/root|/home|/var/run/docker.sock|/private)\b' "$file" 2>/dev/null | while IFS=: read -r lineno content; do
        add_finding "WARNING" "$file" "$lineno" "dockerfile-sensitive-mount" "Sensitive host directory mounted: $content"
    done

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · scripts/ast_analyzer.py (reported line 183)May include surrounding context.

python

if mode_val in ("exec", "eval"):
                    add_finding(WARNING, self.filepath, node.lineno,
                                "ast-compile-exec",
                                f"compile() with mode='{mode_val}' can execute arbitrary code",
                                "Review code being compiled; prefer static imports")

        # ── Rule: __import__() ─────────────────────────────────

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/ast_analyzer.py:156

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/audit.sh:117