Security audit

Pastewatch MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate secret-protection purpose, but it recommends installing an unpinned external binary and running it as a persistent system-wide proxy that can inspect LLM API traffic.

Install only if you trust the publisher and release process. Prefer a pinned, signed, or package-manager-verifiable build, and avoid the system-wide systemd setup unless you need it. If you use the proxy, run it with the least privilege practical and understand that it can inspect sensitive prompts, headers, and provider traffic passing through it.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T06 · System Persistence

Error

Location: SKILL.md:89
Finding: Persistent System-Wide API Proxy Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 89-116 **Vulnerability Type**: System persistence through a boot-enabled systemd service **Risk Level**: High ### Vulnerable Code ```bash # 1. Pastewatch proxy (starts first) cat > /etc/systemd/system/pastewatch-proxy.service << 'EOF' [Unit] Description=Pastewatch API Proxy (secret redaction) After=network-online.target Before=chainwatch-intercept.service [Service] Type=simple ExecStart=/usr/local/bin/pastewatch-cli proxy \ --port 9998 --upstream https://api.anthropic.com \ --severity high --audit-log /var/log/pastewatch-proxy.log Restart=always RestartSec=3 MemoryMax=128M [Install] WantedBy=multi-user.target EOF # 2. Update chainwatch to forward to pastewatch (not Anthropic directly) # Change --upstream from https://api.anthropic.com to http://localhost:9998 # 3. Enable and start systemctl daemon-reload systemctl enable pastewatch-proxy systemctl start pastewatch-proxy systemctl restart chainwatch-intercept ``` ### Technical Analysis The instructions create a system-level service under `/etc/systemd/system`, enable it for automatic startup, and configure it to restart continuously. They also direct the user to modify another proxy service so that API requests are routed through the downloaded `pastewatch-cli` executable. Continuous execution is relevant to an API proxy, but a root-managed, boot-enabled service is not required for the Skill's basic MCP scanning and redaction functionality. A foreground process or unprivileged per-user service would provide the relevant functionality with a smaller privilege and persistence footprint. Because the proxy is positioned in the outbound LLM request path, it can inspect and modify prompts, credentials, API headers, responses, and other data sent between the agent and its upstream provider. The reviewed project contains no source code for the executable, so its actual handling of intercepted traffic cannot be independently verified from ...[truncated 1834 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Do not make system-wide persistence the recommended default. Run the proxy interactively or provide an explicitly opt-in deployment procedure. - Prefer a per-user systemd service with a dedicated, unprivileged account. - If a system service is operationally necessary, add an explicit `User` and `Group` and apply systemd hardening such as: - `NoNewPrivileges=true` - `PrivateTmp=true` - `ProtectSystem=strict` - `ProtectHome=true` - `PrivateDevices=true` - `RestrictSUIDSGID=true` - `CapabilityBoundingSet=` - `RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6` - narrowly scoped `ReadWritePaths` for required logs or state - Bind the proxy only to loopback and authenticate or otherwise constrain local clients where supported. - Pin and verify the executable before allowing it to run as a service. - Document the security implications of proxying authorization headers and sensitive prompts. - Provide a complete rollback procedure: ```bash systemctl stop pastewatch-proxy systemctl disable pastewatch-proxy rm -f /etc/systemd/system/pastewatch-proxy.service systemctl daemon-reload systemctl reset-failed ``` - Require restoration and verification of the original Chainwatch upstream as part of rollback. ]]>

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:19
Finding: Mutable Remote Executable Download and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 19-27 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # Linux (binary + checksum) curl -fsSL https://github.com/ppiankov/pastewatch/releases/latest/download/pastewatch-cli-linux-amd64 \ -o /usr/local/bin/pastewatch-cli curl -fsSL https://github.com/ppiankov/pastewatch/releases/latest/download/pastewatch-cli-linux-amd64.sha256 \ -o /tmp/pastewatch-cli.sha256 cd /usr/local/bin && sha256sum -c /tmp/pastewatch-cli.sha256 chmod +x /usr/local/bin/pastewatch-cli ``` ### Technical Analysis The installation procedure downloads a precompiled executable from a mutable `releases/latest` URL and installs it into `/usr/local/bin`. The reviewed Skill does not contain the executable's source or a pinned digest, so the payload executed by users can change after the Skill itself has been reviewed. A SHA-256 checksum is downloaded, but it comes from the same mutable release and trust domain as the executable. This protects against accidental transmission corruption but does not establish authenticity if the repository, maintainer account, release workflow, or release assets are compromised. An attacker able to replace the binary can also replace its checksum, causing `sha256sum -c` to succeed. The risk is amplified because later instructions make this binary a root-run, automatically restarting system service and route LLM API traffic through it. Writing to `/usr/local/bin` also commonly requires administrative privileges. ### Attack Path 1. An attacker compromises the maintainer's GitHub account, repository release process, CI credentials, or release assets. 2. The attacker publishes or substitutes a malicious `pastewatch-cli-linux-amd64` asset under the `latest` release. 3. The attacker supplies a matching `.sha256` file through the same compromised channel. 4. A user follows the Skill instructions and downloads both attacker-control ...[truncated 1125 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Replace the mutable `latest` URL with a specific immutable release version. - Pin the expected digest in the reviewed Skill rather than downloading the digest from the same location at installation time. - Verify cryptographic release signatures using a trusted public key distributed independently from the release assets. - Prefer a package manager or artifact channel that supports signed metadata, reproducible builds, and provenance verification. - Publish and verify supply-chain attestations, such as Sigstore signatures and SLSA provenance. - Download into a newly created, permission-restricted temporary directory rather than a predictable file in `/tmp`. - Verify the artifact before moving it into `/usr/local/bin` or granting execute permission. - Avoid installation and execution as root unless demonstrably required. - Provide source-build instructions tied to a reviewed commit as an alternative to downloading an opaque native executable. - Ensure service deployment is separate, optional, and performed only after artifact authenticity has been independently validated. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

Category: Privilege Escalation
Content: ## Guard — Block Secret-Leaking Commands ```bash pastewatch-cli guard "cat .env" # BLOCKED if .env has secrets pastewatch-cli guard "psql -f migrate.sql" # scans SQL file pastewatch-cli guard "docker-compose up" # scans env_files ```
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: ## Guard — Block Secret-Leaking Commands ```bash pastewatch-cli guard "cat .env" # BLOCKED if .env has secrets pastewatch-cli guard "psql -f migrate.sql" # scans SQL file pastewatch-cli guard "docker-compose up" # scans env_files ```
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

Category: Rogue Agent
Content: # 3. Enable and start systemctl daemon-reload systemctl enable pastewatch-proxy systemctl start pastewatch-proxy systemctl restart chainwatch-intercept ```
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.