Auto Security Audit

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:02 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent security-audit tool, but it needs Review because it asks users to install an unverified mutable scanner binary system-wide and automatically records sensitive host-scan details.

Review before installing. Only run it on systems and public IPs you are authorized to test, harden the nuclei installation with a pinned version and checksum/signature verification, and treat generated reports as sensitive because they may reveal exploitable host details.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:35
• Finding: Unverified Mutable Executable Download and System-Wide Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 35–37 **Vulnerability Type**: Unverified remote executable retrieval **Risk Level**: Medium ### Vulnerable Code ```bash curl -sL https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_$(curl -s https://api.github.com/repos/projectdiscovery/nuclei/releases/latest | grep tag_name | cut -d'"' -f4 | tr -d v)_linux_amd64.zip -o /tmp/nuclei.zip unzip /tmp/nuclei.zip -d /tmp && mv /tmp/nuclei /usr/local/bin/ nuclei -update-templates ``` ### Technical Analysis The installation instructions dynamically resolve the latest Nuclei release, download an executable archive, extract it, and move the resulting binary into the system-wide `/usr/local/bin` directory. No cryptographic checksum or signature is verified before installation. Although the URL belongs to ProjectDiscovery's official GitHub organization rather than a personal pastebin, the `latest` release reference is mutable. Consequently, the executable installed after a future invocation may differ from the version reviewed during this audit. A compromised upstream release, repository account, release artifact, or delivery path could cause arbitrary code to be installed. The procedure also uses predictable shared temporary paths, `/tmp/nuclei.zip` and `/tmp/nuclei`. If these instructions are run in a hostile multi-user environment—particularly with elevated privileges—an attacker may attempt path collisions, pre-placement, or replacement of temporary artifacts. The exact feasibility depends on file ownership, permissions, archive extraction behavior, and operating-system protections. The subsequent `nuclei -update-templates` command retrieves additional mutable remote content. Nuclei templates are necessary for its scanning function, but automatically accepting an unpinned current template set expands the supply-chain trust boundary beyond the reviewed Skill. This behavior exceeds the minimum safe installation procedu ...[truncated 1900 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin Nuclei to an explicitly reviewed version instead of resolving `latest` at installation time. 2. Download the corresponding checksum file or signed release metadata from an authenticated official source. 3. Verify the archive with a cryptographic checksum before extraction, and abort installation on any mismatch. 4. Verify a maintainer signature when ProjectDiscovery provides an appropriate signing mechanism. 5. Create a private temporary directory with `mktemp -d`, apply restrictive permissions, and register cleanup with a shell trap. 6. Extract the archive only inside that private directory and validate the expected filename and file type. 7. Install the verified binary using `install` with explicit ownership and mode rather than moving a file directly from shared `/tmp`. 8. Avoid running download, extraction, or template-update operations as root. Elevate only the final verified installation step if system-wide installation is required. 9. Pin Nuclei template revisions or document and review template updates before use in sensitive environments. 10. Prefer a trusted operating-system package or another package source that provides integrity verification and reproducible version pinning. Example hardened workflow: ```bash set -eu VERSION="3.x.y" WORKDIR="$(mktemp -d)" trap 'rm -rf "$WORKDIR"' EXIT chmod 700 "$WORKDIR" ARCHIVE="nuclei_${VERSION}_linux_amd64.zip" curl --fail --show-error --location \ "https://github.com/projectdiscovery/nuclei/releases/download/v${VERSION}/${ARCHIVE}" \ --output "$WORKDIR/$ARCHIVE" curl --fail --show-error --location \ "https://github.com/projectdiscovery/nuclei/releases/download/v${VERSION}/nuclei_${VERSION}_checksums.txt" \ --output "$WORKDIR/checksums.txt" ( cd "$WORKDIR" grep " ${ARCHIVE}$" checksums.txt | sha256sum --check - unzip -- "$ARCHIVE" ) sudo install -o root -g root -m 0755 "$WORKDIR/nuclei" /usr/local/bin/nuclei ``` The exact release naming and checksum ...[truncated 80 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 整体上，代码的主要目的与“自动化安全审计并生成 Markdown 报告”基本一致，没有出现明显无关或恶意的未声明能力；它还会访问外部服务 ifconfig.me 获取公网 IP，这可视为实现外网扫描的支持细节。然而，声明中的两个重要能力——cron 定时扫描和飞书推送——在代码中完全不存在，属于明显的描述过度。另有一些表述比实际能力更宽泛：所谓“12000+ CVE 漏洞检测”没有在代码层面得到保证，只是调用 nuclei 并在报告中写了一个固定模板数字；“内外网双扫”在实现上仅扫描 localhost 和本机公网 IP，且 nuclei 只对 http://target 运行，范围较受限。基于这些缺失和夸大，应判定描述与实际行为存在不匹配。

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def run(cmd, timeout=120):
    try:
        r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
        return r.stdout + r.stderr
    except subprocess.TimeoutExpired:
        return "[TIMEOUT]"

• Confidence: 97% confidence
• Finding: This is a true tool-parameter abuse issue because shell-mediated command execution is used as a generic wrapper for multiple security tools. In a security-audit skill, this is more dangerous because such tools often evolve to accept user-supplied targets, making the wrapper a natural injection point with broad system-level execution impact.

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

• Category: YARA Match

Content

apture_output=True, text=True, timeout=timeout)
        return r.stdout + r.stderr
    except subprocess.TimeoutExpired:
        return "[TIMEOUT]"
    except Exception as e:
        return f"[ERROR] {e}"

def get_external_ip():
    out = run("curl -s ifconfig.me", timeout=10).strip()
    return out if re.match(r'^\d+\.\d+\.\d+\.\d+$', out) else "unknown"

def scan_ports(target):
    return run(f"nmap -sS -sV -T4 --top-ports 1000 -oN /dev/stdout {target}", timeout=300)

def scan_vuln(target):
    return run(f"nmap --script vuln -T4 --top-ports 100 -oN /dev/stdout {target}", timeout=300)

def scan_nuclei(target):
    return run(f"nuclei -u http://{target} -severity critical,high,medium -rate-limit 50 -silent 2>&1", timeout=600)

def scan_nuclei_external(ip):
    if ip == "unknown":
        return "跳过（无法获取外网IP）"
    return run(f"nuclei -u http://{ip} -severity critical,high,medium -rate-limit 50 -silent 2>&1", timeout=600)

def scan_ssl(target, port=443):
    return r

• Confidence: 70% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises and instructs shell execution and report generation, but it does not declare an explicit tool scope such as allowed shell or file-write permissions. That weakens reviewability and policy enforcement, because a runner may permit broader command execution or filesystem access than users expect for a scanning skill that can touch network, system configuration, and local reports.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The manifest description and visible skill content are written entirely in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking environment. Under the language/locale policy rule, this is a natural-language locale constraint that lacks opt-in or justification.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
apt install -y nmap sslscan
# nuclei
curl -sL https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_$(curl -s https://api.github.com/repos/projectdiscovery/nuclei/releases/latest | grep tag_name | cut -d'"' -f4 | tr -d v)_linux_amd64.zip -o /tmp/nuclei.zip
unzip /tmp/nuclei.zip -d /tmp && mv /tmp/nuclei /usr/local/bin/
nuclei -update-templates
```

• Confidence: 86% confidence
• Finding: The installation instructions fetch a release version from the GitHub API and download a binary from GitHub, then install it into /usr/local/bin without any checksum, signature, or pinned-version verification. This creates a supply-chain risk: if the download source, release metadata, or network path is compromised, a malicious binary could be installed and later executed with the user's privileges.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run(cmd, timeout=120):
    try:
        r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
        return r.stdout + r.stderr
    except subprocess.TimeoutExpired:
        return "[TIMEOUT]"

• Confidence: 95% confidence
• Finding: The helper executes arbitrary shell commands with shell=True, which is unsafe because any variable interpolated into cmd can become shell metacharacter-controlled command injection. In this file, target/IP values are inserted into shell command strings, so future changes or externalized inputs could turn this into direct command execution.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script makes external calls to ifconfig.me and performs nuclei scans against the discovered external IP without an explicit consent or warning flow. That can disclose host/network metadata off-device and may trigger unauthorized scanning of external-facing assets, which is sensitive in an agent skill context.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The generated Markdown report stores sensitive security data including open ports, vulnerabilities, firewall rules, listening services, SSH settings, package state, and recent login records in a predictable local path. If the workspace is shared, synced, or readable by other users/processes, this creates a high-value disclosure target for attackers.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The module docstring and all user-facing strings are in Chinese, indicating the skill is designed to operate in a fixed language. The policy for this audit requires flagging language/locale restrictions when the skill does not provide user opt-in or clearly justify the locale constraint.

Static analysis

No suspicious patterns detected.