ClawHub
Back to skill

Security audit

Port Process

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed port/process troubleshooting tool, but users should treat its kill commands as potentially disruptive.

Install only if you want a local macOS/Linux port troubleshooting helper. Before terminating anything, run dry-run or find first, prefer the safe SIGTERM flow, avoid sudo unless you understand the target process, and be especially careful on shared or production systems.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manual command lsof -ti :<port> | xargs kill -9 is a forceful, irreversible kill pattern presented as a 'classic' command without a warning that SIGKILL bypasses graceful shutdown and may cause data loss or service disruption. Because the skill is specifically about port-based process management, readers are likely to reuse this exact one-liner, increasing the chance of unsafe termination in the wrong context.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

描述将技能定位为“查找和管理系统进程”，并明确列出两类管理能力：杀掉占用端口的进程，以及查看当前端口使用情况。实际代码的核心功能仅是查询指定端口对应的进程，并打印/输出结果。代码中没有调用 kill、pkill、killall 等终止进程操作，也没有无参数枚举全部端口或系统整体端口使用情况的逻辑；它必须接收一个或多个具体端口号作为输入。因此，描述涵盖了超出代码实际能力的重要功能，属于实质性描述不符。另一方面，已声明的“查找占用端口的进程”与代码是吻合的。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

声明描述的是一个“通过端口查找和管理系统进程”的工具，重点包括：1）查找某个端口被谁占用，2）杀掉占用某个端口的进程，3）查看端口使用情况。实际代码只提供“列出所有正在使用/监听的端口”的功能：通过 lsof、ss 或 netstat 收集监听端口信息并打印，没有提供接收目标端口参数的能力，也没有任何 kill/terminate 进程的逻辑。因此，代码只覆盖了声明中的“查看端口使用情况”这一部分，缺失了“按端口查找”和“杀掉占用端口进程”这两个关键能力，属于描述与实际行为不一致。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README includes commands for terminating processes by port, including examples that normalize killing whatever is bound to a port, but it does not warn users to verify the target PID/process first or note that this can interrupt unrelated services. In a process-management skill, this is relevant because users may copy commands directly into production or shared environments and unintentionally stop critical applications.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill clearly instructs use of shell commands (lsof, ss, netstat, kill, xargs) that inspect system processes and can terminate them, but it does not declare any tool scope or permissions boundary. In an agent environment, missing explicit shell/tool declarations weakens review and containment, making destructive process-management behavior easier to invoke without proper governance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The natural-language content throughout the skill file is Chinese-only, including the description, headings, usage guidance, and safety notes. Under the policy rules, forcing a specific language without user opt-in or a documented justification is a locale/language policy violation.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
82% confidence
Finding

The skill recommends sudo package-install commands, which normalize privileged execution in a skill already centered on shell operations. While common in system administration, encouraging root-level commands in agent instructions increases the blast radius of mistakes or prompt-induced misuse, especially if combined with process-kill actions.

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md
### "lsof: command not found"
- **macOS**：通常预装了 lsof，如缺失可安装 Xcode Command Line Tools
- **Linux**：`sudo apt install lsof` (Debian/Ubuntu) 或 `sudo yum install lsof` (RHEL/CentOS)

### "端口没有被占用"但仍然无法绑定
- 检查 TIME_WAIT 状态：`netstat -an | grep TIME_WAIT`

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
93% confidence
Finding

The skill explicitly advises using sudo to inspect other users' processes and references sudo kill, which can terminate arbitrary system services when run as root. In the context of a port/process management skill, this materially increases the risk of denial of service or disruption of critical services if the wrong port or process is targeted.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

md
### 权限不足
- 使用 `sudo` 运行以查看其他用户的进程
- 注意：使用 `sudo kill` 时要格外小心

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This Python code invokes shell commands via subprocess.run with shell=True, which is a safety-relevant operation under the code-file warning criteria. Although the script's purpose is to inspect ports, there is no explicit user-facing disclosure in output, comments, or docstrings warning that it will execute system utilities such as lsof, ss, grep, and ps.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The code executes shell commands via subprocess.run(..., shell=True) using command strings that incorporate the port value. Although argparse enforces integer input in normal CLI use, this helper is generic and the shell-based design creates unnecessary command-injection risk if the function is ever reused with non-validated input or modified later; it also executes external system utilities directly.

Content

Scanner excerpt · scripts/find_port.py (reported line 24)May include surrounding context.

python
def run_command(cmd, shell=True):
    """运行命令并返回输出"""
    try:
        result = subprocess.run(
            cmd,
            shell=shell,
            capture_output=True,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This Python file contains natural-language instructions and descriptions exclusively in Chinese, including the module docstring that explains purpose and usage. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale restriction is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Argument help text, warnings, confirmation prompts, and status messages are all hard-coded in Chinese. This imposes a specific language on all users of the skill without opt-in or a clearly documented region-specific justification.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/kill_by_port.py (reported line 162)May include surrounding context.

python
print(f"\n✅ 端口 {args.port} 已释放")
        return 0
    else:
        print(f"\n⚠️  部分进程终止失败，可能需要 sudo 权限")
        return 1

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/list_ports.py (reported line 26)May include surrounding context.

python
def run_command(cmd, shell=True):
    """运行命令并返回输出"""
    try:
        result = subprocess.run(
            cmd,
            shell=shell,
            capture_output=True,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The visible user-facing documentation is written in Chinese, including the title and description, with no indication that another language is available or that Chinese-only output is a justified requirement. Under the policy, language constraints should be opt-in or explicitly justified rather than implicitly imposed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The natural-language instructions, description, and CLI help strings are all presented in Chinese, with no indication that the tool is intended only for a Chinese-speaking audience or that other language options are available. Under the policy, forcing a specific language without opt-in can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The docstrings, CLI description, help text, and user-facing output are all written in Chinese, with no option to select another language or locale. This is a natural-language policy concern because the skill enforces a specific language for interaction rather than offering user opt-in or choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.