ClawHub
Back to skill

Security audit

litellm attack detector

Security checks for vulnerabilities and agentic risk

Overview

This skill is a focused LiteLLM compromise detector that does not install or remove anything, though users should know it may make DNS queries while running.

Install only if you want a LiteLLM incident-response detector. Run it knowingly in sensitive or air-gapped environments because it may issue DNS queries for known IoC domains and may use the current kubectl context for read-only cluster checks when kubectl is available.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md
Recommended actions:
   1. Uninstall litellm and delete litellm_init.pth manually
   2. Remove backdoor: ~/.config/sysmon/ and sysmon.service
   3. Purge caches: pip cache purge / rm -rf ~/.cache/uv
   4. ROTATE ALL CREDENTIALS:
      - SSH keys
      - AWS / GCP / Azure credentials

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md
- SSH keys
      - AWS / GCP / Azure credentials
      - Kubernetes configs and service account tokens
      - All API keys in .env files
      - Database passwords
      - Git credentials
      - CI/CD secrets

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/detect.sh (reported line 185)May include surrounding context.

sh
- SSH keys
      - AWS / GCP / Azure credentials
      - Kubernetes configs and service account tokens
      - All API keys in .env files
      - Database passwords
      - Git credentials
      - CI/CD secrets

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md
echo " Recommended actions:"
  echo "   1. Uninstall litellm and delete litellm_init.pth manually"
  echo "   2. Remove backdoor: ~/.config/sysmon/ and sysmon.service"
  echo "   3. Purge caches: pip cache purge / rm -rf ~/.cache/uv"
  echo "   4. ROTATE ALL CREDENTIALS:"
  echo "      - SSH keys"
  echo "      - AWS / GCP / Azure credentials"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/detect.sh (reported line 180)May include surrounding context.

sh
echo " Recommended actions:"
  echo "   1. Uninstall litellm and delete litellm_init.pth manually"
  echo "   2. Remove backdoor: ~/.config/sysmon/ and sysmon.service"
  echo "   3. Purge caches: pip cache purge / rm -rf ~/.cache/uv"
  echo "   4. ROTATE ALL CREDENTIALS:"
  echo "      - SSH keys"
  echo "      - AWS / GCP / Azure credentials"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/detect.sh (reported line 180)May include surrounding context.

sh
echo " Recommended actions:"
  echo "   1. Uninstall litellm and delete litellm_init.pth manually"
  echo "   2. Remove backdoor: ~/.config/sysmon/ and sysmon.service"
  echo "   3. Purge caches: pip cache purge / rm -rf ~/.cache/uv"
  echo "   4. ROTATE ALL CREDENTIALS:"
  echo "      - SSH keys"
  echo "      - AWS / GCP / Azure credentials"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/detect.sh (reported line 180)May include surrounding context.

sh
echo " Recommended actions:"
  echo "   1. Uninstall litellm and delete litellm_init.pth manually"
  echo "   2. Remove backdoor: ~/.config/sysmon/ and sysmon.service"
  echo "   3. Purge caches: pip cache purge / rm -rf ~/.cache/uv"
  echo "   4. ROTATE ALL CREDENTIALS:"
  echo "      - SSH keys"
  echo "      - AWS / GCP / Azure credentials"

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The 'When to Use' section says the skill should trigger for requests like '检查一下有没有中招' and '扫描一下 litellm 是否被篡改'. These are broad phrasings that could appear in ordinary troubleshooting or security conversations, and the file does not provide exclusion conditions or tighter constraints for when the skill should not activate.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script claims to be a read-only local detector, but this section performs live DNS lookups with host against external domains. That creates outbound network activity, which can leak that the detector was run and violates user expectations for an offline/local-only security scan.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code comments say it is checking DNS cache or resolver logs, but the implementation actually performs fresh DNS queries. This mismatch is dangerous because operators may run the tool in sensitive environments believing it is passive, when it is instead generating observable network traffic.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The file presents core instructions and descriptions in both Chinese and English, but it does not state whether language selection follows the user's preference. Because the policy requires avoiding forced language or locale constraints without opt-in, the skill should explicitly say it will respond in the user's language or allow selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script performs external DNS lookups without warning the user that network activity will occur. Even if the domains are legitimate IoCs, silent outbound resolution can be inappropriate in restricted, air-gapped, or incident-response environments and can create audit or privacy concerns.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.