Security audit

Agent Handshake

Security checks for vulnerabilities and agentic risk

Overview

The skill is documented as a remote agent handshake helper, but it also instructs users to create persistent HTTP-based remote command execution with weak defaults and public tunnel exposure.

Review before installing. This skill should only be used by users who intentionally want remote administration capability and can harden it: unique high-entropy credentials, HTTPS or stronger auth, no public anonymous quick tunnel for command execution, least-privilege service accounts, explicit scan boundaries, protected inventory storage, audit logs, and a complete reviewed implementation of every referenced script.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T06 · System Persistence

Error

Location: SKILL.md:204
Finding: Boot-Persistent Remote Command Execution Service
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:131
Finding: Public Exposure of a Privileged Internal Agent Through a Quick Tunnel
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:90
Finding: Hardcoded Default Credentials and Plaintext Basic Authentication
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:24
Finding: Broad Network Reconnaissance and Persistent Infrastructure Inventory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:73
Finding: Security-Critical Behavior References Missing and Unreviewable Scripts
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases include broad terms such as '握手', '发现 agent', '注册服务器', and '打通隧道', which can match common user requests without clearly signaling that the skill may initiate powerful remote connection workflows. Overbroad activation increases the likelihood of unintended invocation of sensitive networking and registration actions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest markets the skill as discovery/registration/connection, but the body introduces generic server administration and shell replacement capabilities. This mismatch is dangerous because it hides the true security-sensitive behavior from users and reviewers, increasing the chance of accidental deployment of a powerful remote execution surface under an innocuous label.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation explicitly expands a 'handshake' skill into an HTTP-exposed remote command execution service that is described as equivalent to SSH, including running arbitrary shell tasks, reading/writing files, and system updates. This is dangerous because it normalizes deploying a generic admin backdoor over HTTP with weak/default Basic Auth patterns and tunnel/public exposure, greatly increasing the risk of unauthorized server takeover.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill describes remote command execution, file read/write, package upgrades, and SSH-like administration over HTTP, yet it lacks strong safety warnings proportional to that power. In this context, omission of clear warnings and constraints is dangerous because users may enable a highly privileged remote control channel without understanding the exposure, especially when combined with public IPs or Cloudflare tunnels.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The usage examples are ambiguous and encourage activation from casual phrases like '连接 opencode' or '快速握手' without clear scope boundaries or user confirmation. In the context of a skill that performs network discovery, persistent registration, and remote connectivity, such ambiguity makes accidental sensitive actions more likely.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The output example specifies “(agent 执行工具后的中文结果)”, which indicates a fixed Chinese-language response format. The file does not state that language is user-selectable or optional, so it may impose a locale preference without explicit user opt-in.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The documented curl examples transmit administrative tasks and Basic Auth credentials to a remote HTTP service, potentially over non-TLS endpoints, and encourage sending sensitive operational commands to another host. In the surrounding context of arbitrary remote execution, this external transmission is dangerous because it exposes credentials and privileged instructions in transit and operational logs, and enables remote system modification.
Content: Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.
bash
# 等价于 SSH 上去敲命令，但不经 SSH curl -X POST http://my-vps:4096/run -u user:pass \ -d '{"task":"查看磁盘: df -h && free -h"}' curl -X POST http://my-vps:4096/run -u user:pass \