ClawHub
Back to skill

Security audit

Port Process

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed port/process troubleshooting tool, but users should treat its kill commands as potentially disruptive.

Install only if you want a local macOS/Linux port troubleshooting helper. Before terminating anything, run dry-run or find first, prefer the safe SIGTERM flow, avoid sudo unless you understand the target process, and be especially careful on shared or production systems.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)

Missing User Warnings

High
Confidence
97% confidence
Finding
The manual command `lsof -ti :<port> | xargs kill -9` is a forceful, irreversible kill pattern presented as a 'classic' command without a warning that SIGKILL bypasses graceful shutdown and may cause data loss or service disruption. Because the skill is specifically about port-based process management, readers are likely to reuse this exact one-liner, increasing the chance of unsafe termination in the wrong context.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
描述将技能定位为“查找和管理系统进程”，并明确列出两类管理能力：杀掉占用端口的进程，以及查看当前端口使用情况。实际代码的核心功能仅是查询指定端口对应的进程，并打印/输出结果。代码中没有调用 kill、pkill、killall 等终止进程操作，也没有无参数枚举全部端口或系统整体端口使用情况的逻辑；它必须接收一个或多个具体端口号作为输入。因此，描述涵盖了超出代码实际能力的重要功能，属于实质性描述不符。另一方面，已声明的“查找占用端口的进程”与代码是吻合的。

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
声明描述的是一个“通过端口查找和管理系统进程”的工具，重点包括：1）查找某个端口被谁占用，2）杀掉占用某个端口的进程，3）查看端口使用情况。实际代码只提供“列出所有正在使用/监听的端口”的功能：通过 lsof、ss 或 netstat 收集监听端口信息并打印，没有提供接收目标端口参数的能力，也没有任何 kill/terminate 进程的逻辑。因此，代码只覆盖了声明中的“查看端口使用情况”这一部分，缺失了“按端口查找”和“杀掉占用端口进程”这两个关键能力，属于描述与实际行为不一致。

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README includes commands for terminating processes by port, including examples that normalize killing whatever is bound to a port, but it does not warn users to verify the target PID/process first or note that this can interrupt unrelated services. In a process-management skill, this is relevant because users may copy commands directly into production or shared environments and unintentionally stop critical applications.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly instructs use of shell commands (`lsof`, `ss`, `netstat`, `kill`, `xargs`) that inspect system processes and can terminate them, but it does not declare any tool scope or permissions boundary. In an agent environment, missing explicit shell/tool declarations weakens review and containment, making destructive process-management behavior easier to invoke without proper governance.

Natural-Language Policy Violations

Medium
Confidence
87% confidence
Finding
The natural-language content throughout the skill file is Chinese-only, including the description, headings, usage guidance, and safety notes. Under the policy rules, forcing a specific language without user opt-in or a documented justification is a locale/language policy violation.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
### "lsof: command not found"
- **macOS**：通常预装了 lsof，如缺失可安装 Xcode Command Line Tools
- **Linux**：`sudo apt install lsof` (Debian/Ubuntu) 或 `sudo yum install lsof` (RHEL/CentOS)

### "端口没有被占用"但仍然无法绑定
- 检查 TIME_WAIT 状态：`netstat -an | grep TIME_WAIT`
Confidence
82% confidence
Finding
The skill recommends `sudo` package-install commands, which normalize privileged execution in a skill already centered on shell operations. While common in system administration, encouraging root-level commands in agent instructions increases the blast radius of mistakes or prompt-induced misuse, especially if combined with process-kill actions.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
### 权限不足
- 使用 `sudo` 运行以查看其他用户的进程
- 注意：使用 `sudo kill` 时要格外小心
Confidence
93% confidence
Finding
The skill explicitly advises using `sudo` to inspect other users' processes and references `sudo kill`, which can terminate arbitrary system services when run as root. In the context of a port/process management skill, this materially increases the risk of denial of service or disruption of critical services if the wrong port or process is targeted.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
This Python code invokes shell commands via subprocess.run with shell=True, which is a safety-relevant operation under the code-file warning criteria. Although the script's purpose is to inspect ports, there is no explicit user-facing disclosure in output, comments, or docstrings warning that it will execute system utilities such as lsof, ss, grep, and ps.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run_command(cmd, shell=True):
    """运行命令并返回输出"""
    try:
        result = subprocess.run(
            cmd,
            shell=shell,
            capture_output=True,
Confidence
95% confidence
Finding
The code executes shell commands via subprocess.run(..., shell=True) using command strings that incorporate the port value. Although argparse enforces integer input in normal CLI use, this helper is generic and the shell-based design creates unnecessary command-injection risk if the function is ever reused with non-validated input or modified later; it also executes external system utilities directly.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
This Python file contains natural-language instructions and descriptions exclusively in Chinese, including the module docstring that explains purpose and usage. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale restriction is a natural-language policy violation.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
Argument help text, warnings, confirmation prompts, and status messages are all hard-coded in Chinese. This imposes a specific language on all users of the skill without opt-in or a clearly documented region-specific justification.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
print(f"\n✅ 端口 {args.port} 已释放")
        return 0
    else:
        print(f"\n⚠️  部分进程终止失败，可能需要 sudo 权限")
        return 1
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run_command(cmd, shell=True):
    """运行命令并返回输出"""
    try:
        result = subprocess.run(
            cmd,
            shell=shell,
            capture_output=True,
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low
Confidence
83% confidence
Finding
The visible user-facing documentation is written in Chinese, including the title and description, with no indication that another language is available or that Chinese-only output is a justified requirement. Under the policy, language constraints should be opt-in or explicitly justified rather than implicitly imposed.

Natural-Language Policy Violations

Low
Confidence
93% confidence
Finding
The natural-language instructions, description, and CLI help strings are all presented in Chinese, with no indication that the tool is intended only for a Chinese-speaking audience or that other language options are available. Under the policy, forcing a specific language without opt-in can be a locale-policy violation.

Natural-Language Policy Violations

Low
Confidence
95% confidence
Finding
The docstrings, CLI description, help text, and user-facing output are all written in Chinese, with no option to select another language or locale. This is a natural-language policy concern because the skill enforces a specific language for interaction rather than offering user opt-in or choice.

Static analysis

No suspicious patterns detected.