Security audit

防火墙配置工具包专业版

Security checks for vulnerabilities and agentic risk

Overview

The skill is for firewall administration, but it gives an agent broad root-level and persistent network-control instructions without enough safeguards.

Review before installing. Use this only if you intentionally want an agent to manage real firewalls or cloud security groups. Require explicit confirmation for every change, test on non-production hosts, back up current rules, validate generated rules before applying them, restrict target hosts and cloud credentials, and avoid running the remote root deployment example as written.

SkillSpector

Vulnerability Patterns

Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The CIS audit example wraps shell conditions in a string and executes them with `eval`, which is unsafe if any part of the condition can be influenced by untrusted input now or in future edits. In a skill that exposes `exec` and encourages automation, this pattern can turn audit logic into arbitrary command execution with the agent's privileges, especially since the documented environment expects root/sudo access.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill claims command execution is performed in a safe sandbox, but the actual documented behavior includes host-level firewall modification, root/sudo requirements, and remote deployment over SSH as root. This mismatch is dangerous because it can mislead users or downstream agents into approving destructive operations under a false assumption of isolation.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The Bash example overwrites /etc/nftables.conf and immediately applies it with nft -f, then enables the service persistently. In an agent skill context, this is dangerous because copying or executing the example can abruptly replace an existing firewall policy, cause self-lockout, or disrupt network connectivity without any warning, backup, validation, or rollback guidance.

Session Persistence

Medium

Category: Rogue Agent
Content: nft -f /etc/nftables.conf echo "nftables配置已应用" systemctl enable nftables systemctl start nftables echo ""
Confidence: 89% confidence
Finding: The script enables the nftables service to start on boot, creating persistent system state changes beyond the current session. In a skill or automation context, persistence increases operational risk because an unsafe or misapplied firewall policy can survive reboots, prolonging outages or lockouts and making accidental damage harder to recover from.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: echo "--- 部署到: ${ip}:${port} ---" # ... if scp -P "$port" "$RULES_FILE" "root@${ip}:/tmp/firewall-rules.sh" 2>/dev/null; then if ssh -p "$port" "root@${ip}" "bash /tmp/firewall-rules.sh && rm /tmp/firewall-rules.sh" 2>/dev/null; then echo " [OK] ${ip} 部署成功" ((SUCCESS++)) else
Confidence: 96% confidence
Finding: The batch deployment example copies a script to remote hosts and executes it as `root` via SSH, then deletes the file. In a skill designed for agent-driven `exec`, this is a high-risk remote code execution pattern: if the rules file, host list, or invocation workflow is compromised, the agent can push arbitrary commands across multiple machines with full privileges.

Static analysis

No suspicious patterns detected.