Security Auditor Tk

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:33 AM UTC
• Version: 1.0.0

Overview

This security-audit skill is purpose-aligned, but it gives high-impact root-level fix commands without enough safeguards against lockout or service disruption.

Review this skill carefully before installing. It is not showing evidence of theft, deception, or hidden payloads, but its fix commands should be treated as examples for experienced administrators only. Do not run the SSH, firewall, mount, service, or sysctl commands on a production host until you have backups, an active fallback session or console access, target-specific validation, and rollback steps.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/common-fixes.md:6

Finding

Privileged remediation commands can cause lockout, service disruption, or unsafe system-wide configuration changes

Content

View full analysis

Vulnerability Details

File Location: references/common-fixes.md, lines 6–30, 35–51, 76–79, and 100–124
Vulnerability Type: Unsafe privileged remediation guidance
Risk Level: Medium

Complete Code Snippets

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

bash

sudo sed -i 's/#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

bash

sudo sed -i 's/#*MaxAuthTries.*/MaxAuthTries 3/' /etc/ssh/sshd_config
sudo systemctl restart sshd

bash

sudo sed -i 's/#*Port .*/Port 2222/' /etc/ssh/sshd_config
sudo ufw allow 2222/tcp
sudo systemctl restart sshd
# Then: sudo ufw delete allow 22/tcp

bash

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https
sudo ufw enable

bash

sudo apt install fail2ban -y
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo sed -i 's/bantime  = 10m/bantime  = 1h/' /etc/fail2ban/jail.local
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

bash

sudo mount -o remount,noexec,nosuid /tmp

bash

cat >> /etc/sysctl.d/99-hardening.conf << 'EOF'
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
kernel.randomize_va_space = 2
fs.suid_dumpable = 0
EOF
sudo sysctl --system

Technical Analysis

The Skill presents commands as copy-paste remediations even though they make immediate, system-wide changes with elevated privileges. The instructions do not require ...[truncated 3170 chars]

Remediation

View remediation

Remediation Suggestions

1. Clearly label all commands as environment-dependent examples rather than universally safe copy-paste fixes.
2. Require explicit user confirmation before installation, service enablement, firewall activation, SSH restart, mount modification, or kernel-setting changes.
3. Back up each affected configuration file with ownership and permissions preserved before editing it.
4. Validate SSH configuration with sudo sshd -t before reloading it. Prefer reload over restart where supported.
5. Keep an existing privileged SSH session open and verify a second key-authenticated connection before disabling passwords, root access, or port 22.
6. Inventory required inbound ports and use firewall dry-run or staged rules before enabling a default-deny policy.
7. Check whether Fail2ban is already installed and review its effective jail configuration before enabling persistent startup.
8. Assess application and distribution compatibility before changing /tmp mount options; make the change temporary and reversible during testing.
9. Write privileged files through sudo tee rather than relying on shell redirection, and replace managed configuration atomically instead of repeatedly appending values.
10. Validate sysctl settings individually and record previous values so they can be restored.
11. Include explicit verification and rollback commands for every remediation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (40)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/common-fixes.md (reported line 67)May include surrounding context.

Check pending updates

bash

sudo apt update && sudo apt list --upgradable 2>/dev/null | grep -i security

File Permissions

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · README.md (reported line 32)May include surrounding context.

md

| Firewall Analysis | UFW/iptables rules and policy check |
| Port Scanning | Open ports, unnecessary service exposure |
| SSL/TLS Audit | Certificates, protocols, cipher suites |
| File Permissions | SUID, world-readable, sensitive files |
| Update Status | Pending patches, EOL software |
| Web Security | Headers, CORS, cookies, disclosure |
| Fix Commands | Copy-paste remediation for every finding |

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

1. **Server Hardening Audit** — SSH config, firewall rules, user permissions, kernel parameters
2. **Port & Service Scan** — Open ports, running services, unnecessary exposure
3. **SSL/TLS Analysis** — Certificate validity, protocol versions, cipher suites
4. **File Permission Check** — World-readable configs, SUID binaries, sensitive file exposure
5. **Update Status** — Pending security patches, EOL software detection
6. **Web App Security** — Headers, CORS, cookie flags, common misconfigs
7. **Report Generation** — Prioritized findings with fix commands

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly offers 'exact commands to fix any issues' and 'copy-paste fix commands' for SSH, firewall, kernel, and permissions, but it does not warn that those commands can change security-critical system settings or disrupt access. In a security-auditing skill, users are especially likely to trust and execute remediation commands directly, increasing the chance of lockout, service interruption, or unsafe changes if commands are inaccurate or applied blindly.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md

- Pending security updates
- EOL software
- SUID/SGID binaries
- World-writable files
- Unowned files
- Cron job permissions
- tmp/var/tmp permissions

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The SSH hardening section gives direct configuration changes that can disrupt remote access, including disabling root login, disabling password authentication, and changing the SSH port, but it does not warn operators to verify alternate access first. In an audit/remediation skill, omission of lockout precautions can cause self-inflicted denial of access on production systems.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 7)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 8)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 13)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 14)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 19)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 20)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 25)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 26)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 27)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 28)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 35)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 36)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 37)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 38)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 39)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 40)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 45)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 46)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/common-fixes.md (reported line 47)May include surrounding context.

Disable root login

bash

sudo sed -i 's/#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Static analysis

No suspicious patterns detected.