防火墙配置工具包免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:37 AM UTC
• Version: 1.0.1

Overview

This firewall skill is mostly on-topic, but it includes root-level commands that can wipe firewall rules, restart SSH, disable services, install packages, and persist changes without enough safeguards.

Review before installing or using on any real server. Do not let an agent run the reset, flush, enable, sshd, systemctl, apt-get, or iptables-save examples unless you have console recovery access, current firewall backups, confirmed SSH management rules, and an explicit rollback plan.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:64

Finding

Destructive Firewall Rule Replacement Can Cause Persistent Remote Lockout

Content

View full analysis

/etc/iptables/rules.v4 ``` ### Technical Analysis The Skill directs an agent with root-level execution capability to erase the host's existing firewall configuration and replace it with a fixed rule set. The workflow does not: - Export or back up the current rules before resetting them. - Detect the SSH daemon's actual listening port. - Preserve the source address and port used by the active administration session. - Preserve application-specific, VPN, container, orchestrati ...[truncated 3754 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation includes commands that reset firewall rules, set restrictive defaults, and later elsewhere modifies SSH/service configuration, but it does not present a prominent risk warning. On remote systems, these actions can immediately disrupt access, lock out administrators, or break application connectivity if applied without host-specific review.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

ufw --force reset is a destructive command that wipes existing firewall rules without interactive confirmation. In an agent-executable skill, this can remove host-specific protections and temporarily expose or disconnect systems, especially when run remotely or as part of an automated workflow.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

echo "=== UFW防火墙基础配置 ==="
# ...
# 重置防火墙规则
ufw --force reset
# ...
# 设置默认策略
ufw default deny incoming     # 默认拒绝所有入站

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This scenario script again performs a forced firewall reset as part of 'new server hardening'. Even in that context, wiping rules non-interactively is dangerous because the actual server may already have provider, bastion, or application-specific access controls that will be lost immediately.

Content

Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.

md

# ...
# 1. 配置防火墙
echo "--- 1. 配置UFW防火墙 ---"
ufw --force reset
ufw default deny incoming
ufw default allow outgoing
ufw limit 22/tcp      # SSH限速

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The web-server example also begins with a forced reset, making destructive behavior part of a common-use template. This is especially risky because users may copy-paste it onto production systems, causing service outages or accidental exposure before all necessary restrictions are reapplied.

Content

Scanner excerpt · SKILL.md (reported line 324)May include surrounding context.

md

# ...
echo "=== Web服务器防火墙配置 ==="
# ...
ufw --force reset
ufw default deny incoming
ufw default allow outgoing
# ...

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description is broad and does not define clear invocation boundaries or exclusions, despite exposing exec-capable workflows that modify firewall state. Overbroad trigger text increases the likelihood of accidental activation in unrelated server tasks, which is dangerous when the skill can run privileged, state-altering commands.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The capability coverage keyword list is excessively long and highly generic, including broad terms like security, network, and group. In an agent ecosystem, such generalized matching can cause this privileged skill to be selected in contexts where firewall reconfiguration was not intended, increasing the risk of unintended destructive changes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a firewall toolkit, but the documented workflow also stops/disables services, edits SSH daemon configuration, installs packages, and restarts system services. This scope expansion increases the chance that a user or agent invokes privileged host-hardening actions they did not explicitly consent to, creating avoidable integrity and availability risk on production hosts.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 384)May include surrounding context.

bash

# 检查UFW状态
sudo ufw status verbose
# ...
# 检查iptables状态
sudo iptables -L -n

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 387)May include surrounding context.

bash

# 检查UFW状态
sudo ufw status verbose
# ...
# 检查iptables状态
sudo iptables -L -n

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 406)May include surrounding context.

bash

# 检查UFW状态
sudo ufw status verbose
# ...
# 检查iptables状态
sudo iptables -L -n

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

This sudo command changes the default inbound policy, which is a privileged and potentially disruptive operation. In a skill with exec access and broad triggers, embedding direct root-level mutation steps raises the risk of accidental or premature execution on the wrong host.

Content

Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.

bash

# 使用UFW快速加固
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw limit 22/tcp
sudo ufw allow 80/tcp

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

This root-level command changes outbound firewall policy, which can affect package installs, service integrations, and monitoring if later tightened or paired with other rules. The danger comes from privileged state changes being presented as quick-start actions without sufficient operational guardrails.

Content

Scanner excerpt · SKILL.md (reported line 395)May include surrounding context.

bash

# 使用UFW快速加固
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw limit 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

This privileged command alters SSH rate limiting, affecting remote administrative access. In the context of a broadly matchable exec skill, including immediate apply commands without strong warnings increases the chance of self-inflicted access issues or unintended policy changes.

Content

Scanner excerpt · SKILL.md (reported line 396)May include surrounding context.

md

# 使用UFW快速加固
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw limit 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw --force enable

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 79% confidence

Finding

Allowing HTTP via sudo is a legitimate firewall operation, but it is still a privileged mutation presented in a quick-start block. The main risk is accidental execution in an unintended environment, not the specific port choice itself.

Content

Scanner excerpt · SKILL.md (reported line 397)May include surrounding context.

sudo ufw default deny incoming sudo ufw default allow outgoing sudo ufw limit 22/tcp sudo ufw allow 80/tcp sudo ufw allow 443/tcp sudo ufw --force enable

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 79% confidence

Finding

Opening HTTPS via a root-level command is expected for a web server, but it remains a privileged configuration change. In an automated skill context, any direct apply step should be considered risky if trigger boundaries and confirmations are weak.

Content

Scanner excerpt · SKILL.md (reported line 398)May include surrounding context.

sudo ufw default allow outgoing sudo ufw limit 22/tcp sudo ufw allow 80/tcp sudo ufw allow 443/tcp sudo ufw --force enable

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Enabling the firewall with sudo immediately activates the preceding rules and can lock out remote access if prerequisites are wrong. Because the skill also demonstrates resets and broad hardening steps, this activation command materially increases availability risk on live systems.

Content

Scanner excerpt · SKILL.md (reported line 399)May include surrounding context.

sudo ufw limit 22/tcp sudo ufw allow 80/tcp sudo ufw allow 443/tcp sudo ufw --force enable

text

### 第三步:验证配置

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

L005-L006 以及全文说明均固定为中文，未见任何提供用户语言/地区选择的说明。按照语言/locale 政策，若技能呈现或交互默认强制特定语言而未提供选择，可能构成自然语言策略违规。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The documentation says the free edition is purely local and requires no API key, yet it defines a callback_url parameter for asynchronous notifications. That inconsistency can mislead operators about possible outbound communication and may result in unintended network egress or disclosure of execution metadata to an attacker-controlled endpoint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.