ClawHub
Back to skill

Security audit

tcp

Security checks for vulnerabilities and agentic risk

Overview

This is a simple TCP networking help skill; the scanner flags are false positives from ordinary example commands.

Install this if you want TCP programming and network-debugging help. Treat generated network test commands as real network activity and run them only against systems or networks where you have permission.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

YARA rule 'reverse_shell': Reverse shell patterns in scripts or source code [malware]

Critical
Category
YARA Match
Content
时、半开连接等错误排查
- 基于 TCP 的自定义协议或简单服务
- 与 TCP 相关的防火墙、端口、绑定地址配置

---

## 快速测试连接与端口

### 命令行

- **PowerShell（Windows）**：
  ```powershell
  Test-NetConnection -ComputerName host -Port port
  ```
  或使用 .NET 套接字简单测端口（脚本中）：
  ```powershell
  $tcp = New-Object System.Net.Sockets.TcpClient; $tcp.Connect("host", port); $tcp.Close()
  ```

- **netcat（nc）**（若已安装）：
  ```bash
  nc -zv host port
  ```
  交互收发：
  ```bash
  nc host port
  ```

- **telnet**（多数系统已弃用或未默认安装，仅作备选）：
  ```bash
  telnet host port
  ```

根据用户当前 OS 优先给出可用方案（如 Windows 用 `Test-NetConnection` 或 PowerShell 脚本）。

---

## 客户端/服务端代码要点

### 通用流程

- **客户端**：创建 socket → connect(host, port) → send/recv →
Confidence
85% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The skill body is written in Chinese and does not indicate that the language is optional or that users may request another language. This can violate language/locale policy because it imposes a specific language without explicit user opt-in or a documented regional justification.

Session Persistence

Medium
Category
Rogue Agent
Content
- **Python**：`socket.socket(socket.AF_INET, socket.SOCK_STREAM)`，`connect()`/`bind()`+`listen()`+`accept()`，`send()`/`recv()`。注意 `recv` 可能一次读不满，需循环或协议约定。
- **Node.js**：`net.createConnection(port, host)` 或 `net.createServer()`，事件 `data`/`end`/`error`。
- **Go**：`net.Dial("tcp", "host:port")`，`net.Listen("tcp", ":port")` + `Accept()`，`Read`/`Write`。
- **C#**：`TcpClient`/`TcpListener`，或 `Socket` 类。

按用户技术栈给出对应片段，并提醒：收发要处理缓冲与边界，服务端要处理多客户端（多线程/异步/select 等）和优雅关闭。
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.