T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/bootstrap-host.sh:336- Finding
Unverified ACME Installer Is Piped Directly into a Root Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Deploy Xray VLESS using 3X UI on your VPS
Security checks for vulnerabilities and agentic risk
Overview
The skill is not clearly malicious, but it needs Review because it performs root-level VPS changes with under-guarded supply-chain, firewall, update, and credential-handling risks.
Install this only for a dedicated VPS where replacing firewall policy, Docker state, nginx configuration, and 3X-UI state is acceptable. Prefer SSH keys over --ssh-password, review or pin the Docker/acme/3X-UI sources before running, back up current UFW rules and /opt/3x-ui, and treat add-inbound-client.py --dry-run as contacting the panel unless fixed.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/bootstrap-host.sh:289- Finding
Unverified Docker Convenience Installer Executes as Root
- Content
View full analysis
/dev/null 2>&1 || ! docker compose version >/dev/null 2>&1; then for pkg in docker.io docker-compose docker-doc docker-compose-v2 podman-docker containerd runc; do apt-get remove -y "${pkg}" >/dev/null 2>&1 || true done curl -fsSL https://get.docker.com -o /tmp/get-docker.sh sh /tmp/get-docker.sh rm -f /tmp/get-docker.sh fi ``` ### Technical Analysis The script downloads Docker's mutable convenience installer and executes it as root without checking a signature, fixed release version, or expected digest. Saving the response to a file before execution does not provide integrity protection by itself. The script also removes existing container-related packages before executing the downloaded installer. Consequently, a delivery failure or malicious installer can leave the host without its previous container runtime while obtaining unrestricted root execution. Installing Docker is consistent with the Skill's declared functionality, but an unverified convenience script is not required to accomplish that task. ### Attack Path 1. An attacker compromises the Docker installer source, publishing infrastructure, or trusted delivery chain. 2. The operator starts a fresh deployment on a host without the expected Docker Compose installation. 3. The bootstrap removes potentially conflicting container packages. 4. The attacker-controlled installer is downloaded to `/tmp/get-docker.sh`. 5. The script runs through `sh` with root privileges. 6. The payload modifies the host, steals data, or installs persistent malicious components. ### Impact Assessment Exploitation results in arbitrary root-level execution and complete compromise of the remote VPS. The attacker can control packages, services, firewall rules, Docker configura ...[truncated 83 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
scripts/bootstrap-host.sh:299- Finding
Mutable Latest Container Image Runs with Host Networking and Automatic Restart
- Content
View full analysis
"${WORKDIR}/docker-compose.yml" <- Remediation
View remediation
`. 2. Verify image provenance and signatures, such as with Sigstore/Cosign where supported. 3. Treat digest changes as explicit, reviewed updates rather than automatically following `latest`. 4. Test each new digest before production rollout and maintain a known-good rollback digest. 5. Reduce container privileges and capabilities where compatible with 3X-UI. 6. Reassess whether host networking is strictly required; otherwise use a dedicated Docker network with only necessary host port bindings. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bootstrap-host.sh:442- Finding
Unescaped Deployment Values Are Later Sourced by a Root Shell
- Content
View full analysis
"${WORKDIR}/bootstrap.env" <- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/add-inbound-client.py:203- Finding
Add-Client Dry-Run Mode Transmits Credentials and Performs Panel Requests
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/bootstrap-host.sh:434- Finding
Bootstrap and Update Operations Destructively Reset the Entire UFW Policy
- Content
View full analysis
/dev/null ufw default deny incoming >/dev/null ufw default allow outgoing >/dev/null ufw allow "${SSH_PORT}/tcp" >/dev/null ufw allow 80/tcp >/dev/null ufw allow 443/tcp >/dev/null ufw --force enable >/dev/null ``` Update behavior: ```bash if command -v ufw >/dev/null 2>&1; then ufw --force reset >/dev/null ufw default deny incoming >/dev/null ufw default allow outgoing >/dev/null ufw allow "${SSH_PORT}/tcp" >/dev/null ufw allow 80/tcp >/dev/null ufw allow 443/tcp >/dev/null ufw --force enable >/dev/null fi ``` ### Technical Analysis Rather than adding or reconciling rules owned by the Skill, both workflows reset the host's entire UFW configuration. This removes unrelated allow rules, deny rules, source restrictions, routing rules, and operator-managed controls. A tightly restricted public policy is part of the declared deployment, so configuring SSH, HTTP, and HTTPS is legitimate. However, silently deleting every unrelated firewall rule—especially during a routine update—exceeds the minimum changes necessary to maintain the Skill's services. ### Attack Path 1. The VPS has existing UFW rules for administration, monitoring, VPN access, source-specific restrictions, or other hosted services. 2. An administrator runs the bootstrap or routine update script. 3. `ufw --force reset` deletes all existing rules without interactive confirmation. 4. The script installs only generic SSH, HTTP, and HTTPS allowances. 5. Existing services become unreachable, or defense-in-depth deny and source-restriction rules disappear. This is primarily an operational and access-control failure rather than a direct standalone path to code execution. ### Impact Assessm ...[truncated 309 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (21)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill advertises a tightly scoped 3X-UI deployment workflow, but the available behavior includes generic SSH access with plaintext password support, which materially expands what can be done on remote systems. This mismatch is dangerous because operators or policy systems may trust the declared purpose while the implementation enables broader remote access and credential handling than expected.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use [`scripts/bootstrap-host.sh`](scripts/bootstrap-host.sh).
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use [`scripts/bootstrap-host.sh`](scripts/bootstrap-host.sh).
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use [`scripts/bootstrap-host.sh`](scripts/bootstrap-host.sh).
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash ssh <target> 'ss -ltnp | egrep ":2053 |:2096 |:1234 "' curl -k -I https://<domain>/Expected result:
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh curl -fsSL https://get.docker.com -o /tmp/get-docker.sh sh /tmp/get-docker.sh rm -f /tmp/get-docker.sh fi cat > "${WORKDIR}/docker-compose.yml" <<EOF
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
Piping a network-fetched script directly into sh as root executes unverified remote code with full system privileges. If the upstream source, transport path, DNS, or delivery endpoint is compromised, the VPS can be fully taken over; this is especially dangerous here because the script already targets remote root-managed hosts.
- Content
sh fi if [[ ! -d "/root/.acme.sh" ]]; then curl -fsSL https://get.acme.sh | sh -s email="${ACME_EMAIL:-}" fi if [[ -n "${ACME_EMAIL}" ]]; then
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Resetting UFW with --force reset wipes the host's entire firewall policy, not just rules related to 3X-UI, and then applies a minimal replacement ruleset. On a multipurpose VPS this can unintentionally expose services or break access controls relied on by other applications, making it a real and potentially severe security issue.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Using ufw --force reset suppresses interactive safeguards and immediately destroys existing firewall configuration. The danger is amplified because this runs remotely on a root-managed VPS, where a mistaken reset can remove defense-in-depth controls or cause lockout/exposure before replacement rules are correctly applied.
- Content
sh docker restart 3x-ui >/dev/null sleep 5 ufw --force reset >/dev/null ufw default deny incoming >/dev/null ufw default allow outgoing >/dev/null ufw allow "${SSH_PORT}/tcp" >/dev/null
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The remote script performs broad system modifications without confirmation, including
apt upgrade, container redeployment, database changes, service restart, and a fullufw --force reset. In a root-managed VPS context, this can immediately disrupt connectivity, remove existing firewall policy, or break unrelated services, making the lack of explicit warning and confirmation a meaningful operational security risk.- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
ufw --force resetwipes all existing firewall rules and profiles before applying a narrow new policy set. On a multi-purpose VPS or a host with custom management ports, VPNs, monitoring, or service-specific rules, this can lock out administrators or unintentionally expose or disable services; because it runs as root on a remote host, the skill context makes this especially dangerous.- Content
sh docker restart 3x-ui >/dev/null if command -v ufw >/dev/null 2>&1; then ufw --force reset >/dev/null ufw default deny incoming >/dev/null ufw default allow outgoing >/dev/null ufw allow "${SSH_PORT}/tcp" >/dev/null
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs operators to run shell commands and make network connections to remote VPS hosts, but it declares no tool scope or permission boundaries. In a skill that can mutate remote infrastructure, missing explicit permission metadata increases the chance of over-broad execution, accidental misuse, or the agent invoking capabilities beyond what reviewers expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script performs extensive remote root actions including package installation/removal, nginx activation, certificate issuance, Docker installation, database mutation, container restart, and firewall reconfiguration without an explicit destructive-operation warning or confirmation step. Even when the functionality is expected, the lack of clear user-facing guardrails materially increases the chance of accidental harmful execution against the wrong host or on a host with other services.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script removes existing container-related packages and installs Docker via a remote bootstrap script, which changes core host software outside the narrow scope of configuring 3X-UI. In a root-managed VPS context this may be intended, but it is still dangerous because it can disrupt unrelated workloads and replaces system components without interactive confirmation or compatibility checks.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh write_http_only_nginx_site nginx -t systemctl enable --now nginx systemctl reload nginx DOMAIN_A_RECORDS="$(dig +short A "${DOMAIN}" | awk 'NF')"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script explicitly supports passing an SSH password on the command line and then exports it into the environment for use by an askpass helper. Plain-text credentials supplied this way may be exposed via shell history, process listings, logs, or inherited environments, which is especially risky in a root/VPS administration skill where highly privileged credentials are likely involved.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh #!/usr/bin/env bash printf '%s\n' "${SSH_PASSWORD?}" EOF chmod 700 "${ASKPASS_SCRIPT}" export SSH_PASSWORD export SSH_ASKPASS="${ASKPASS_SCRIPT}"
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 84% confidence
- Finding
The script forces password-based authentication by disabling public-key authentication and preferring password/keyboard-interactive methods. While not an exploit on its own, this is an unsafe default because it nudges users away from stronger SSH key-based auth and increases the chance that privileged credentials are transmitted, reused, or brute-forced in operational workflows.
- Content
sh export DISPLAY="${DISPLAY:-codex-askpass}" ssh \ -o PubkeyAuthentication=no \ -o PreferredAuthentications=password,keyboard-interactive,password \ "$@"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script explicitly accepts an SSH password via a command-line parameter and forwards it to another helper script. Command-line secrets are commonly exposed through shell history, process listings, CI logs, and audit tooling, so this creates a real credential-handling weakness even if the overall administrative intent is legitimate.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh set -euo pipefail if [[ "${EUID}" -ne 0 ]]; then echo "Run as root on the remote host." >&2 exit 1 fi
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh set -euo pipefail if [[ "${EUID}" -ne 0 ]]; then echo "Run as root on the remote host." >&2 exit 1 fi
Static analysis
No suspicious patterns detected.