T08 · Insecure Dependencies
Warning
- Location
hytale.sh:40- Finding
Downloader Executed Without Integrity or Authenticity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Hytale Server
Security checks for vulnerabilities and agentic risk
Overview
This looks like a legitimate local Hytale server helper, but it runs a user-provided downloader binary with local credentials without integrity checks or strong handling guidance.
Install only if you are comfortable running the Hytale downloader you place in ~/hytale_server. Verify the downloader's source or checksum if available, protect hytale-downloader-credentials.json with restrictive permissions such as 600, and keep credentials out of backups, logs, and source control. Review the script before use because update executes the downloader with your normal user privileges.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
hytale.sh:11- Finding
Imprecise Screen Session Matching Can Select or Report an Unintended Session
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - Java 21+ (Installed) - Screen (Installed) - Hytale Downloader (User must provide) - Credentials (User must provide `hytale-downloader-credentials.json` in `~/hytale_server`) ## Setup
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - Java 21+ (Installed) - Screen (Installed) - Hytale Downloader (User must provide) - Credentials (User must provide `hytale-downloader-credentials.json` in `~/hytale_server`) ## Setup
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh - Java 21+ (Installed) - Screen (Installed) - Hytale Downloader (User must provide) - Credentials (User must provide `hytale-downloader-credentials.json` in `~/hytale_server`) ## Setup
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh - Java 21+ (Installed) - Screen (Installed) - Hytale Downloader (User must provide) - Credentials (User must provide `hytale-downloader-credentials.json` in `~/hytale_server`) ## Setup
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs users to place a credential file in a predictable local directory but provides no warning about the sensitivity of that file, required file permissions, or safe handling practices. This increases the risk of accidental exposure through overly broad filesystem permissions, backups, logs, or other local tooling that may access files in the home directory.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The update path executes an external binary from the server directory after only checking for file existence and setting it executable. Because that binary is expected to be downloaded and placed manually, the script provides no integrity verification, trust validation, or explicit warning before execution, so a tampered or replaced downloader could run arbitrary code with the user's privileges and access local server files.
- Content
Static analysis
No suspicious patterns detected.