Security audit

MiaoQIDS 🛡️量子防火墙-会做pcap文件分析的猫娘

Security checks for vulnerabilities and agentic risk

Overview

This PCAP intrusion-detection skill mostly matches its stated purpose, but it needs Review because it loads unverified executable model files and sends extracted IP addresses to an outside service without clear consent.

Install only if you trust the publisher and can verify the model/PCA files from a trusted source. Avoid sensitive incident-response PCAPs unless you are comfortable with public IP indicators being sent to ip-api.com and feature caches remaining on disk; run it in a contained environment and prefer disabling or replacing online geolocation before production use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill declares only `exec` in metadata while its documented behavior and static capabilities indicate file access, network access, shell/process use, and possible environment access. This undermines permission transparency and can cause a host to grant execution to a skill that also reads local files and sends data externally, increasing the chance of unintended data exposure or privilege abuse.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: There is a material description-behavior mismatch: beyond local IDS analysis, the skill also exposes an HTTP service and performs external IP geolocation / public-IP related lookups. When a skill does more than users are told, operators cannot accurately assess privacy, exposure, or firewall implications, and sensitive network indicators from PCAP analysis may be transmitted or exposed unexpectedly.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The code loads a model with pickle.load() from an arbitrary local file path. Python pickle is unsafe for untrusted input because deserialization can execute attacker-controlled code during loading, which can lead to arbitrary code execution if an attacker can influence the model file.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The code enumerates local interfaces and IP addresses via get_if_list() and get_if_addr() and uses them to classify packet directionality. This goes beyond passive PCAP-only analysis and introduces host-environment fingerprinting, which can leak local network context, reduce portability, and create unnecessary privacy exposure if the skill is run on analyst or production machines.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill transmits IP addresses derived from the analyzed PCAP to ip-api.com, which contradicts the expectation of purely local PCAP analysis and leaks potentially sensitive network metadata to a third party. In an intrusion-detection context, source and target IPs can be confidential incident-response data, so this external disclosure materially increases privacy and operational risk.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill exposes a threaded HTTP server with an analysis endpoint, expanding its attack surface beyond offline file analysis into a network-accessible service. Even when bound to localhost by default, this broadens misuse scenarios, increases parsing exposure, and can allow unauthorized local processes or misconfigured deployments to invoke file analysis on arbitrary paths.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: The code determines the host's local IP by initiating a connection to 8.8.8.8, creating unexpected outbound network activity unrelated to core PCAP classification. In restricted or sensitive environments, even this metadata-revealing connectivity can violate policy and surprise users who expect offline analysis.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The code intentionally inflates the 'benign traffic' confidence after model inference, meaning reported confidence values are no longer faithful outputs of the underlying analysis. In a security detection tool, this can suppress alerts or bias operator decisions, increasing the chance that malicious traffic is misclassified or deprioritized during incident response.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code deserializes a pickle file from disk using pickle.load without any integrity check, signature verification, or restriction on file origin. Pickle is code-execution capable, so if an attacker can replace or plant ./特征选择结果/unified_8class_spca.pkl, loading it can execute arbitrary code in the process context.

Missing User Warnings

High

Confidence: 99% confidence
Finding: pickle.load() deserializes arbitrary Python objects and may invoke attacker-controlled behavior without any warning or trust check. In the context of a security-analysis skill, this is especially dangerous because users may process external artifacts and could be tricked into loading a malicious model file, resulting in local arbitrary code execution.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill advertises IP geolocation but does not clearly warn that queried IP addresses may be sent to an external third-party service. IPs extracted from PCAPs can be sensitive incident data, and silent transmission to an external provider can leak investigation details, internal relationships, or victim/attacker indicators.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The skill documents automatic creation of feature-cache files without clearly warning that data derived from analyzed PCAPs will be written to disk. Even cached features can preserve sensitive traffic characteristics and create forensic residue or secondary disclosure risks on shared systems.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code loads a .pkl file with pickle.load() from a filesystem path under result_dir without any integrity verification, signature check, or restriction to trusted serialized formats. In Python, pickle is code-executing deserialization, so if an attacker can replace or plant unified_8class_spca.pkl, arbitrary code can run when the model is loaded; in an ML/security-analysis skill that processes external artifacts, that makes the issue more dangerous, not less.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill sends IPs from analyzed traffic to an external geolocation service without explicit user notice or consent, which is a privacy and data-handling issue. Because PCAP-derived IPs may belong to internal assets, customers, or ongoing investigations, this can disclose sensitive operational information to a third party.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: skill.py:59