安全扫描器(免费版)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:36 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed security scanner, but it asks agents to run powerful local network-scanning commands with weak scoping and unsafe command construction examples.

Install only if you intend to run active scans on systems you are authorized to test. Require explicit target confirmation, avoid running it with elevated privileges, do not use callback_url unless you trust the endpoint, and replace the sample shell=True command handling with validated argument-list execution before operational use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:182

Finding

Shell Command Injection Through an Unvalidated Scan Target

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 182–273
Vulnerability Type: OS command injection
Risk Level: High

python

def __init__(self, target):
    self.target = target
    self.results = {}
    self.report_dir = "reports"
    os.makedirs(self.report_dir, exist_ok=True)

def quick_recon(self):
    result = self._run_command(f"nmap -sn -T4 {self.target}")
    self.results["host_discovery"] = result

def full_scan(self):
    result = self._run_command(
        f"nmap -p- -sV -sC -A -T4 {self.target}"
    )
    self.results["full_scan"] = result

def vuln_scan(self):
    result = self._run_command(
        f"nmap --script vuln {self.target}"
    )
    self.results["vuln_scan"] = result

    result = self._run_command(
        f"nuclei -u http://{self.target} -t cves/ -t vulnerabilities/"
    )
    self.results["nuclei_scan"] = result

def ssl_scan(self):
    result = self._run_command(f"sslscan {self.target}")
    self.results["ssl_scan"] = result

def web_scan(self):
    result = self._run_command(
        f"nikto -h http://{self.target} -o {self.report_dir}/nikto_{self.target}.txt"
    )
    self.results["web_scan"] = result

def _run_command(self, command):
    try:
        result = subprocess.run(
            command, shell=True, capture_output=True,
            text=True, timeout=600
        )
        return result.stdout if result.stdout else result.stderr
    except subprocess.TimeoutExpired:
        return "Scan timed out"
    except Exception as e:
        return f"Error: {str(e)}"

Technical Analysis

The documented implementation stores the externally supplied target value without validation and inserts it directly into multiple command strings. _run_command then invokes these strings through subprocess.run with shell=True.

Consequently, the operating-system shell interprets metacharacters contained in the targ ...[truncated 1723 chars]

Remediation

View remediation

Remediation Suggestions

• Remove shell=True and pass each command as an argument list:

  python

  subprocess.run(
      ["nmap", "-sn", "-T4", self.target],
      shell=False,
      capture_output=True,
      text=True,
      timeout=600,
      check=False,
  )
  

• Validate the target before use. Accept only explicitly supported IP addresses, CIDR networks, or DNS hostnames. Python's ipaddress module should be used for IP addresses and networks.

• If hostnames are supported, apply strict length and label validation and reject whitespace, control characters, shell metacharacters, URL paths, and command-line options.

• Reject targets beginning with - so they cannot be interpreted as scanner options.

• Construct nuclei and nikto URLs using a URL-building API rather than string concatenation.

• Run scanners as an unprivileged, isolated account or container with restricted filesystem and network access.

• Add tests covering command separators, substitutions, redirections, newlines, leading hyphens, and malformed hostnames.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:239

Finding

Path Traversal and Unintended File Writes Through the Scan Target

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 239–256
Vulnerability Type: Path traversal and unsafe filename construction
Risk Level: Medium

python

def web_scan(self):
    """Web application scan"""
    print(f"[*] Starting web scan: {self.target}")

    result = self._run_command(
        f"nikto -h http://{self.target} -o {self.report_dir}/nikto_{self.target}.txt"
    )
    self.results["web_scan"] = result

def generate_report(self):
    """Generate scan report"""
    timestamp = datetime.now().strftime("%Y-%m-%d")
    report_path = os.path.join(
        self.report_dir,
        f"security-scan-{self.target}-{timestamp}.md"
    )

    with open(report_path, 'w', encoding='utf-8') as f:
        f.write(f"# Security Scan Report\n\n")
        f.write(f"**Target**: {self.target}\n")

Technical Analysis

The untrusted self.target value is embedded directly into filenames used by both nikto and the report generator. No filename sanitization, canonicalization, or containment check is performed.

A target containing path separators or traversal components can influence the final output path. In generate_report, os.path.join does not ensure that the resulting path remains beneath self.report_dir. The nikto output path is additionally included in a shell command, compounding this issue with the command-injection vulnerability reported separately.

Attack Path

1. An attacker submits a target containing path separators or traversal components.
2. The application incorporates the value into security-scan-{target}-{date}.md or nikto_{target}.txt.
3. The resulting path is interpreted by the filesystem or scanner rather than treated as an opaque identifier.
4. If the constructed parent directories exist and process permissions permit access, output may be created or an existing file may be truncated outside the intended reports directory.
5. Generated scan dat ...[truncated 642 chars]

Remediation

View remediation

Remediation Suggestions

• Do not use a network target as a filename. Generate an opaque identifier, such as a UUID, for every scan and store the original target only inside report content or structured metadata.

• If a readable filename is required, replace all characters outside a restrictive allowlist such as [A-Za-z0-9._-], impose a short maximum length, and explicitly reject . and .. path components.

• Resolve the candidate path and verify containment before writing:

  python

  report_root = Path("reports").resolve()
  report_path = (report_root / safe_filename).resolve()
  
  if report_root not in report_path.parents:
      raise ValueError("Report path escapes the report directory")
  

• Create files using exclusive creation where overwrites are not intended.

• Apply restrictive directory and file permissions.

• Pass nikto arguments as a list with shell=False, including the separately validated output path.

• Add tests for absolute paths, traversal sequences, Windows and POSIX separators, repeated separators, excessive lengths, and filename collisions.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:397

Finding

Unpinned Nuclei Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 397
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

bash

go install projectdiscovery/nuclei/v3/cmd/nuclei@latest

Technical Analysis

The installation instruction uses the mutable @latest selector instead of a reviewed, fixed release. This makes installations non-reproducible and causes future users to trust whichever release the upstream module resolves to at installation time.

The referenced module does not appear to be a typographical imitation in the reviewed material, and no malicious package was demonstrated. The risk arises from automatically consuming future upstream changes without version review or integrity controls.

Attack Path

1. A user follows the documented dependency installation instructions.
2. Go resolves @latest at that point in time.
3. A changed, compromised, or defective future release is downloaded and compiled.
4. The resulting binary executes locally when the skill performs a nuclei scan.
5. That binary receives the supplied target and inherits the scanner process's local permissions and network access.

Impact Assessment

The impact depends on the behavior of the retrieved release and the privileges used to run it. A compromised dependency could access files available to the user, inspect environment data, alter scan results, or make network requests.

The likelihood is lower than the direct coding vulnerabilities because exploitation requires an upstream compromise or unsafe future release, and the audit found no evidence that the currently referenced project is malicious.

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an explicitly reviewed version, for example @v3.x.y.
• Maintain the approved version in a lock file, deployment manifest, or documented dependency baseline.
• Verify release provenance, checksums, signatures, and source repository ownership before deployment where the ecosystem supports these controls.
• Test dependency upgrades in an isolated environment before changing the pinned version.
• Run third-party scanners with minimum privileges and restrict their filesystem and network access.
• Establish a controlled update process that includes security review and rollback procedures.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

• Category: YARA Match
• Confidence: 70% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

��始扫描,发现存活主机和开放端口.

输入格式

参数名	类型	必填	说明
input	string	是	安全扫描器(免费版)处理的输入数据或指令
options	object	否	附加配置选项,如模式选择、格式偏好等
callback_url	string	否	异步处理完成后的回调通知URL

bash

# 主机发现
nmap -sn -T4 192.168.1.0/24
# ...
# 快速端口扫描(前100个常用端口)
nmap -F 192.168.1.1
# ...
# 服务版本识别
nmap -sV -T4 192.168.1.1

场景二:全端口深度扫描

bash

# 全65535端口+服务+脚本+OS探测
nmap -p- -sV -sC -A -T4 192.168.1.1 -oN full_scan.txt

场景三:Web漏洞扫描

bash

# Nuclei CVE漏洞扫描
nuclei -u https://target.com -t cves/ -o nuclei_results.txt
# ...
# Nikto Web服务器扫描
nikto -h target.com -o nikto_report.txt
# ...
# 目录枚举
nmap --script http-enum -p 80,443 target.com

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The implementation constructs shell commands with interpolated target input and executes them via subprocess.run(..., shell=True). If an attacker can influence self.target or related parameters, they can inject arbitrary shell metacharacters and execute unintended system commands, leading to remote code execution on the host running the agent.

Content

Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.

md

def _run_command(self, command):
        """执行系统命令"""
        try:
            result = subprocess.run(
                command, shell=True, capture_output=True,
                text=True, timeout=600
            )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill exposes command execution and active network scanning capability without a prominent warning about traffic generation, service disruption risk, privilege needs, and legal/authorization requirements. In an agent context, this omission is dangerous because users may trigger scans without understanding operational impact on targets or their own environment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill states scans run locally without API keys, yet it accepts a callback_url for asynchronous completion. That creates a data-flow path for scan results or metadata to leave the local environment, which can mislead users into disclosing sensitive network information to external endpoints they did not anticipate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are broad enough that an agent could invoke a network-capable scanning skill for generic requests about security checks, compliance, or encryption. In context, this increases the chance of unintended execution of intrusive scans against systems or networks without sufficiently explicit user intent or authorization checks.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The output section specifies a JSON object with fields like success, data, execution_log, and error. However, the sample implementation stores scan outputs as plain strings, writes a Markdown report file in generate_report, and returns raw stdout/stderr from _run_command rather than the documented structured JSON response. This is a direct contradiction between documentation and code behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The display name, summary, and the rest of the skill instructions are presented in Chinese, effectively forcing a specific language for users without any opt-in or alternative locale handling. The file does not state that this is a region-specific skill or provide a language-selection mechanism.

Content

No source excerpt is available for this finding.