Security audit

防火墙配置工具包免费版

Security checks across malware telemetry and agentic risk

Overview

This firewall skill matches its stated purpose, but its examples include privileged rule resets and service changes that could disrupt or lock users out without enough safety controls.

Install only if you understand Linux firewall administration and will review every command before execution. Do not run the reset or hardening examples on a remote, production, shared, or nonstandard-SSH host unless you have console access, current rule backups, explicit allow rules for management access, and a tested rollback plan.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The skill metadata and activation description are broad enough that an agent may invoke this skill in loosely related security or networking tasks. In an exec-enabled skill that performs privileged firewall actions, overbroad triggering increases the chance of unintended destructive execution on the wrong host or in the wrong context.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The keyword coverage list is excessively broad and includes generic security and network terms, which can cause this privileged skill to match unrelated requests. Because the skill has exec access and includes reset/enable operations, accidental selection materially raises the risk of unintended system modification or service disruption.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The documented workflow resets existing firewall rules and enables a deny-by-default policy without an upfront risk warning, backup step, rollback plan, or mandatory confirmation. In an agent context with exec capability, this can lock out SSH, break production traffic, and create immediate denial of service if run on a live server with nonstandard access requirements.

Missing User Warnings

High

Confidence: 97% confidence
Finding: This example flushes all iptables rules, sets restrictive default policies, and persists the new rules to a system file, but offers no explicit safety guidance. On a remote or shared system, that combination can sever access, disrupt services, and overwrite a working firewall baseline, making the impact operationally severe.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The 'initial hardening' scenario combines firewall reset, service shutdown, SSH configuration changes, and package installation, yet lacks a consolidated risk notice or change-control guidance. In a privileged agent workflow, bundling multiple invasive host changes raises the chance of service outage, access loss, and unintended configuration drift far beyond simple firewall management.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: echo "=== UFW防火墙基础配置 ===" # ... # 重置防火墙规则 ufw --force reset # ... # 设置默认策略 ufw default deny incoming # 默认拒绝所有入站
Confidence: 98% confidence
Finding: Using 'ufw --force reset' suppresses interactive protection and immediately deletes existing firewall rules, which can remove carefully curated access controls without operator review. In this skill's context, the command is especially dangerous because it sits in an exec-enabled workflow and is presented as a standard step rather than an exceptional destructive action.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: # ... # 1. 配置防火墙 echo "--- 1. 配置UFW防火墙 ---" ufw --force reset ufw default deny incoming ufw default allow outgoing ufw limit 22/tcp # SSH限速
Confidence: 98% confidence
Finding: This second use of 'ufw --force reset' appears in a broader hardening scenario, magnifying risk because it is embedded alongside other state-changing host actions. A user or agent running the full scenario may unintentionally wipe firewall rules and lose remote access before validating the rest of the system changes.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: # ... echo "=== Web服务器防火墙配置 ===" # ... ufw --force reset ufw default deny incoming ufw default allow outgoing # ...
Confidence: 98% confidence
Finding: The web-server example also starts with 'ufw --force reset', which can erase unrelated but necessary rules for monitoring, management, VPN, or internal services. Because the scenario is framed as a reusable template, operators may copy it into production without understanding that it performs a destructive full-policy replacement.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.