T03 · Remote Payload Retrieval and Execution
Error
- Location
user-guide.md:979- Finding
Mutable Remote Bootstrap Script Is Executed as Root
- Content
View full analysis
- Remediation
View remediation
Security audit
Server-Mate
Security checks for vulnerabilities and agentic risk
Overview
This server-monitoring skill is mostly coherent, but its install and optional automation paths can create persistent root-level services and network-exposed controls that need careful review.
Install only after reviewing the bootstrap and configuration. Prefer a pinned release or commit instead of curl|sudo bash, run the agent under a dedicated low-privilege user, keep automation in dry-run until command templates and allowlists are reviewed, protect BT-Panel and webhook credentials, and expose the dashboard only behind authentication and TLS.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/server_agent.py:3146- Finding
Unvalidated Service Names Reach Local and Remote Shell Execution
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/server_agent.py:6070- Finding
Unauthenticated Dashboard Exposes Operational Data on Every Network Interface
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Error
- Location
assets/bootstrap_node.sh:66- Finding
Bootstrap Installs an Always-Restarting Privileged Service from Mutable Code
- Content
View full analysis
/etc/systemd/system/server-mate.service echo "Starting Server-Mate daemon..." systemctl daemon-reload systemctl enable server-mate.service systemctl restart server-mate.service ``` The generated service has no dedicated user and is configured to restart indefinitely: ```python lines = [ "# Copy this unit to /etc/systemd/system/server-mate.service", "[Unit]", "Description=Server-Mate Agent", "After=network-online.target", "Wants=network-online.target", "", "[Service]", "Type=simple", f"WorkingDirectory={quote_systemd_value(str(workspace_dir))}", "Environment=PYTHONUNBUFFERED=1", f"ExecStart={' '.join(exec_parts)}", "Restart=always", "RestartSec=5", "", "[Install]", "WantedBy=multi-user.target", ] ``` ### Technical Analysis The bootstrap requires root, writes a unit under `/etc/systemd/system`, enables it across reboots, and starts it immediately. The generated unit does not specify `User=` or `Group=`, so a system service ordinarily runs as root. The unit also lacks common systemd sandboxing controls. It runs a large monitoring application that parses logs, performs network requests, invokes diagnostic commands, and optionally changes firewall or service state. Running all of this code as root exceeds the minimum privilege needed for most collection and reporting operations. Because the installation directory is updated with `git pull`, the persistent service also executes mutable code on future restarts. ### Attack Path 1. An operator runs the do ...[truncated 858 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
assets/bootstrap_node.sh:50- Finding
Privileged Bootstrap Installs Unpinned Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (108)
Tainted flow: 'request' from os.getenv (line 4360, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 96% confidence
- Finding
The script reads an API key from the environment and automatically sends aggregated operational data to a configurable external AI endpoint. Because the endpoint is configuration-controlled and there is no allowlist, consent gate, or strong disclosure in this execution path, sensitive telemetry can be exfiltrated to an unintended remote service if config is altered or misused.
- Content
python method="POST", ) try: with urllib.request.urlopen(request, timeout=settings["timeout_seconds"]) as response: data = json.loads(response.read().decode("utf-8")) except (urllib.error.URLError, TimeoutError, json.JSONDecodeError): return None
Tainted flow: 'request' from os.getenv (line 4360, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 96% confidence
- Finding
This second outbound AI call path has the same issue: environment-sourced credentials are used to POST server-report data to a configurable remote endpoint without meaningful trust restrictions. In a monitoring/reporting skill, these summaries can include infrastructure identifiers, traffic patterns, errors, and security indicators that should not be silently exported to arbitrary third parties.
- Content
python method="POST", ) try: with urllib.request.urlopen(request, timeout=settings["timeout_seconds"]) as response: data = json.loads(response.read().decode("utf-8")) except (urllib.error.URLError, TimeoutError, json.JSONDecodeError): return None
Tainted flow: 'request' from os.getenv (line 3782, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python method="POST", ) try: with urllib.request.urlopen(request, timeout=settings["timeout_seconds"]) as response: data = json.loads(response.read().decode("utf-8")) except (urllib.error.URLError, TimeoutError, json.JSONDecodeError) as exc: log_alert_ai_fallback(str(exc), settings)
Tainted flow: 'request' from os.getenv (line 3782, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python method="POST", ) try: with urllib.request.urlopen(request, timeout=settings["timeout_seconds"]) as response: data = json.loads(response.read().decode("utf-8")) except (urllib.error.URLError, TimeoutError, json.JSONDecodeError) as exc: log_alert_ai_fallback(str(exc), settings)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### Security Hardening - **Command-injection defense**: every remote shell path supplied via configuration is hardened with `shlex.quote` plus a structural check that rejects embedded NUL / CR / LF before being spliced into any `ExecShell` command. A malicious `access_log` value such as `"/path; rm -rf /"` is contained inside a single-quoted shell literal and is never interpreted as a separate token - **NTP time-drift auto-detection**: BT signature failures most commonly surface as cryptic HTTP 200 + `{"status": false, "msg": "request_token error"}` payloads, not as 401/403. The client now recognises both English and Chinese variants of the auth-failure message and emits a precise, actionable hint — *"Authentication failed. Please check if the time on the Agent server and the Remote BT panel are synchronized (NTP Time Drift)."* — both in the raised exception and in the WARNING log, so operators stop chasing the wrong root cause - **Per-site fault isolation**: a failure in any one remote panel is caught, logged, and stamped into the cursor's `status` field; it cannot crash the cron tick or starve the other configured sites
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### Security Hardening - **Command-injection defense**: every remote shell path supplied via configuration is hardened with `shlex.quote` plus a structural check that rejects embedded NUL / CR / LF before being spliced into any `ExecShell` command. A malicious `access_log` value such as `"/path; rm -rf /"` is contained inside a single-quoted shell literal and is never interpreted as a separate token - **NTP time-drift auto-detection**: BT signature failures most commonly surface as cryptic HTTP 200 + `{"status": false, "msg": "request_token error"}` payloads, not as 401/403. The client now recognises both English and Chinese variants of the auth-failure message and emits a precise, actionable hint — *"Authentication failed. Please check if the time on the Agent server and the Remote BT panel are synchronized (NTP Time Drift)."* — both in the raised exception and in the WARNING log, so operators stop chasing the wrong root cause - **Per-site fault isolation**: a failure in any one remote panel is caught, logged, and stamped into the cursor's `status` field; it cannot crash the cron tick or starve the other configured sites
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### 安全加固（Security Hardening） - **命令注入防御（Command Injection Prevention）**：所有来自配置文件的远端 Shell 路径在拼入 `ExecShell` 命令前，必须经过 `shlex.quote` 严格转义 + 控制字符（NUL / CR / LF）拒绝双层校验。即使配置中混入恶意 payload（例如 `"/path; rm -rf /"`），最终也只能以单引号字面量形式存在于 shell 中，**绝不会被解析为独立命令** - **NTP 漂移自动识别（NTP Drift Auto-Detection）**：宝塔签名失败往往以 HTTP 200 + `{"status": false, "msg": "request_token error"}` 的形式返回，而非 401/403，极易误导排查方向。客户端现已识别中英文双语的鉴权失败关键字，并在异常 message 与 WARNING 日志中**同时**附加精准的修复指引——*"Authentication failed. Please check if the time on the Agent server and the Remote BT panel are synchronized (NTP Time Drift)."* - **站点级故障隔离**：任意单个远程面板的失败均会被捕获、记录、并写入游标的 `status` 字段，**绝不**会让一台远程不稳定导致 cron 周期崩溃，也不会饿死其他配置站点
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### 安全加固（Security Hardening） - **命令注入防御（Command Injection Prevention）**：所有来自配置文件的远端 Shell 路径在拼入 `ExecShell` 命令前，必须经过 `shlex.quote` 严格转义 + 控制字符（NUL / CR / LF）拒绝双层校验。即使配置中混入恶意 payload（例如 `"/path; rm -rf /"`），最终也只能以单引号字面量形式存在于 shell 中，**绝不会被解析为独立命令** - **NTP 漂移自动识别（NTP Drift Auto-Detection）**：宝塔签名失败往往以 HTTP 200 + `{"status": false, "msg": "request_token error"}` 的形式返回，而非 401/403，极易误导排查方向。客户端现已识别中英文双语的鉴权失败关键字，并在异常 message 与 WARNING 日志中**同时**附加精准的修复指引——*"Authentication failed. Please check if the time on the Agent server and the Remote BT panel are synchronized (NTP Time Drift)."* - **站点级故障隔离**：任意单个远程面板的失败均会被捕获、记录、并写入游标的 `status` 字段，**绝不**会让一台远程不稳定导致 cron 周期崩溃，也不会饿死其他配置站点
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### 安全加固（Security Hardening） - **命令注入防御（Command Injection Prevention）**：所有来自配置文件的远端 Shell 路径在拼入 `ExecShell` 命令前，必须经过 `shlex.quote` 严格转义 + 控制字符（NUL / CR / LF）拒绝双层校验。即使配置中混入恶意 payload（例如 `"/path; rm -rf /"`），最终也只能以单引号字面量形式存在于 shell 中，**绝不会被解析为独立命令** - **NTP 漂移自动识别（NTP Drift Auto-Detection）**：宝塔签名失败往往以 HTTP 200 + `{"status": false, "msg": "request_token error"}` 的形式返回，而非 401/403，极易误导排查方向。客户端现已识别中英文双语的鉴权失败关键字，并在异常 message 与 WARNING 日志中**同时**附加精准的修复指引——*"Authentication failed. Please check if the time on the Agent server and the Remote BT panel are synchronized (NTP Time Drift)."* - **站点级故障隔离**：任意单个远程面板的失败均会被捕获、记录、并写入游标的 `status` 字段，**绝不**会让一台远程不稳定导致 cron 周期崩溃，也不会饿死其他配置站点
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### 安全加固（Security Hardening） - **命令注入防御（Command Injection Prevention）**：所有来自配置文件的远端 Shell 路径在拼入 `ExecShell` 命令前，必须经过 `shlex.quote` 严格转义 + 控制字符（NUL / CR / LF）拒绝双层校验。即使配置中混入恶意 payload（例如 `"/path; rm -rf /"`），最终也只能以单引号字面量形式存在于 shell 中，**绝不会被解析为独立命令** - **NTP 漂移自动识别（NTP Drift Auto-Detection）**：宝塔签名失败往往以 HTTP 200 + `{"status": false, "msg": "request_token error"}` 的形式返回，而非 401/403，极易误导排查方向。客户端现已识别中英文双语的鉴权失败关键字，并在异常 message 与 WARNING 日志中**同时**附加精准的修复指引——*"Authentication failed. Please check if the time on the Agent server and the Remote BT panel are synchronized (NTP Time Drift)."* - **站点级故障隔离**：任意单个远程面板的失败均会被捕获、记录、并写入游标的 `status` 字段，**绝不**会让一台远程不稳定导致 cron 周期崩溃，也不会饿死其他配置站点
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### 安全加固(Security Hardening) - **命令注入防御(Command Injection Prevention)**:所有来自配置文件的远端 Shell 路径在拼入 `ExecShell` 命令前,必须经过 `shlex.quote` 严格转义 + 控制字符(NUL / CR / LF)拒绝双层校验。即使配置中混入恶意 payload(例如 `"/path; rm -rf /"`),最终也只能以单引号字面量形式存在于 shell 中,**绝不会被解析为独立命令** - **NTP 漂移自动识别(NTP Drift Auto-Detection)**:宝塔签名失败往往以 HTTP 200 + `{"status": false, "msg": "request_token error"}` 的形式返回,而非 401/403,极易误导排查方向。客户端现已识别中英文双语的鉴权失败关键字,并在异常 message 与 WARNING 日志中**同时**附加精准的修复指引——*"Authentication failed. Please check if the time on the Agent server and the Remote BT panel are synchronized (NTP Time Drift)."* - **站点级故障隔离**:任意单个远程面板的失败均会被捕获、记录、并写入游标的 `status` 字段,**绝不**会让一台远程不稳定导致 cron 周期崩溃,也不会饿死其他配置站点
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### 安全加固(Security Hardening) - **命令注入防御(Command Injection Prevention)**:所有来自配置文件的远端 Shell 路径在拼入 `ExecShell` 命令前,必须经过 `shlex.quote` 严格转义 + 控制字符(NUL / CR / LF)拒绝双层校验。即使配置中混入恶意 payload(例如 `"/path; rm -rf /"`),最终也只能以单引号字面量形式存在于 shell 中,**绝不会被解析为独立命令** - **NTP 漂移自动识别(NTP Drift Auto-Detection)**:宝塔签名失败往往以 HTTP 200 + `{"status": false, "msg": "request_token error"}` 的形式返回,而非 401/403,极易误导排查方向。客户端现已识别中英文双语的鉴权失败关键字,并在异常 message 与 WARNING 日志中**同时**附加精准的修复指引——*"Authentication failed. Please check if the time on the Agent server and the Remote BT panel are synchronized (NTP Time Drift)."* - **站点级故障隔离**:任意单个远程面板的失败均会被捕获、记录、并写入游标的 `status` 字段,**绝不**会让一台远程不稳定导致 cron 周期崩溃,也不会饿死其他配置站点
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md ### 安全加固（Security Hardening） - **命令注入防御（Command Injection Prevention）**：所有来自配置文件的远端 Shell 路径在拼入 `ExecShell` 命令前，必须经过 `shlex.quote` 严格转义 + 控制字符（NUL / CR / LF）拒绝双层校验。即使配置中混入恶意 payload（例如 `"/path; rm -rf /"`），最终也只能以单引号字面量形式存在于 shell 中，**绝不会被解析为独立命令** - **NTP 漂移自动识别（NTP Drift Auto-Detection）**：宝塔签名失败往往以 HTTP 200 + `{"status": false, "msg": "request_token error"}` 的形式返回，而非 401/403，极易误导排查方向。客户端现已识别中英文双语的鉴权失败关键字，并在异常 message 与 WARNING 日志中**同时**附加精准的修复指引——*"Authentication failed. Please check if the time on the Agent server and the Remote BT panel are synchronized (NTP Time Drift)."* - **站点级故障隔离**：任意单个远程面板的失败均会被捕获、记录、并写入游标的 `status` 字段，**绝不**会让一台远程不稳定导致 cron 周期崩溃，也不会饿死其他配置站点
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md ### 安全加固（Security Hardening） - **命令注入防御（Command Injection Prevention）**：所有来自配置文件的远端 Shell 路径在拼入 `ExecShell` 命令前，必须经过 `shlex.quote` 严格转义 + 控制字符（NUL / CR / LF）拒绝双层校验。即使配置中混入恶意 payload（例如 `"/path; rm -rf /"`），最终也只能以单引号字面量形式存在于 shell 中，**绝不会被解析为独立命令** - **NTP 漂移自动识别（NTP Drift Auto-Detection）**：宝塔签名失败往往以 HTTP 200 + `{"status": false, "msg": "request_token error"}` 的形式返回，而非 401/403，极易误导排查方向。客户端现已识别中英文双语的鉴权失败关键字，并在异常 message 与 WARNING 日志中**同时**附加精准的修复指引——*"Authentication failed. Please check if the time on the Agent server and the Remote BT panel are synchronized (NTP Time Drift)."* - **站点级故障隔离**：任意单个远程面板的失败均会被捕获、记录、并写入游标的 `status` 字段，**绝不**会让一台远程不稳定导致 cron 周期崩溃，也不会饿死其他配置站点
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Run `report_generator.py` as one-shot scheduled jobs.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Run `report_generator.py` as one-shot scheduled jobs.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Run `report_generator.py` as one-shot scheduled jobs.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Run `report_generator.py` as one-shot scheduled jobs.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Run `report_generator.py` as one-shot scheduled jobs.
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module documentation states that reports are generated from SQLite rollups, but the daily PDF path substitutes synthetic/demo content. This mismatch is security-relevant because it misrepresents the integrity of monitoring outputs, which can conceal service degradation, abuse, or certificate issues in a server-monitoring workflow.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Daily PDF generation presents largely hard-coded demo content while the tool claims to generate reports from real rollup data. In an ops/security monitoring context this is dangerous because operators may make security or reliability decisions based on fabricated charts, masking real incidents or creating false assurance.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The diagnostics subsystem contains built-in command sets that are executed automatically after alerts, locally or on remote BT panels via exec_shell. Because this occurs in response to monitored data and uses shell commands, it expands the blast radius from passive monitoring to active code execution, creating a powerful post-compromise or config-abuse primitive.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
This finding points to the same dangerous pattern as the AST4 hit at line 3028: tool/command execution via subprocess.run with shell=True on a free-form command string. In an agent skill that monitors logs and can react automatically, this is particularly risky because tool invocation may be influenced by configuration or derived values and can execute with server-side privileges.
- Content
python Never raises — exceptions are caught and returned as an error string. """ try: result = subprocess.run( cmd, shell=True, capture_output=True,
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The agent can automatically ban/unban IPs and restart services based on parsed logs and thresholds, with execution driven by configurable command templates and no human confirmation. In this skill context, that makes mistakes, malicious config changes, or manipulated telemetry operationally dangerous: it can lock out legitimate users, disrupt services, or repeatedly restart critical daemons.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The LLM shield path transmits sampled access-log data, including IP addresses, URIs, user agents, and behavior summaries, to an external AI endpoint to decide whether to ban clients. This is especially sensitive because it can export potentially personal data and security telemetry during live incidents, and those AI responses directly influence automated blocking decisions.
- Content
Static analysis
No suspicious patterns detected.