Vulnerability Analysis Hub

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:59 AM UTC
• Version: 1.1.1

Overview

This is a legitimate security-analysis skill, but it exposes powerful execution and exploit workflows with unsafe defaults that users should review before installing.

Install only if you need a high-powered vulnerability research workflow and will use it on authorized targets in an isolated environment. Before using any dynamic debugging, replace all-interface listeners with loopback or authenticated tunnels, avoid running PoC or fuzzing on production systems, and review each exec/Write action before allowing it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:577

Finding

Remote Debugger Exposed on All Network Interfaces

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:577
Vulnerability Type: Unrestricted network exposure of a remote debugging service
Risk Level: High

Vulnerable Code:

text

| **gdbserver** | Remote | `gdbserver --multi 0.0.0.0:23947` | Remote debugging for embedded systems |

Technical Analysis

The documented command starts gdbserver in multi-session mode and binds it to 0.0.0.0, making TCP port 23947 available through every IPv4 interface. This exceeds the minimum privilege required for ordinary local binary analysis, where a loopback-only listener is sufficient.

The GDB remote protocol does not provide an appropriate native authentication or encrypted transport boundary for exposure to untrusted networks. If host or network firewall rules permit access, an unauthorized party could connect with a compatible GDB client. Debugger capabilities can include starting or attaching to processes, reading process memory and registers, changing execution state, and writing process memory.

Attack Path

1. A user or Agent follows the documented command and starts gdbserver.
2. The service listens on TCP port 23947 across all IPv4 interfaces.
3. Host, container, cloud, or network firewall policy allows an attacker to reach that port.
4. The attacker connects using a GDB-compatible remote client.
5. The attacker abuses the debugging session when a process is started or attached, potentially inspecting sensitive memory or altering program execution.
6. Any resulting access operates within the permissions and isolation boundary of the account or container running gdbserver.

Impact Assessment

A reachable attacker could obtain debugger-level influence over processes managed through the exposed server. Potential consequences include disclosure of credentials or other secrets held in process memory, modification of runtime data, alteration of control flow, denial of service, and code execution ...[truncated 276 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the default command with a loopback-only listener:

  bash

  gdbserver --multi 127.0.0.1:23947
  

• If remote debugging is necessary, carry the connection through an authenticated and encrypted SSH tunnel or a properly configured VPN rather than exposing the GDB protocol directly.

• Restrict access with host and network firewall rules to specifically authorized administration endpoints.

• Run the service under a dedicated, unprivileged account with access only to the intended target process and files.

• Use container or sandbox isolation where practical.

• Start the debugger only for the required analysis session and terminate it immediately afterward.

• Add an explicit warning that binding to 0.0.0.0 is unsafe unless an independently authenticated and tightly restricted network boundary is in place.

T09 · Insecure Skill Coding Practices

Error

• Location: references/tool-quick-ref.md:12

Finding

Remote Debugger Exposure Repeated in Tool Reference

Content

View full analysis

Vulnerability Details

File Location: references/tool-quick-ref.md:12
Vulnerability Type: Unrestricted network exposure of a remote debugging service
Risk Level: High

Vulnerable Code:

text

| **gdbserver** | Remote | `gdbserver --multi 0.0.0.0:23947` | Remote debugging for embedded systems |

Technical Analysis

The quick-reference documentation independently recommends starting gdbserver on every IPv4 interface. Because quick-reference commands are likely to be copied directly, this duplicate instruction reinforces the insecure default and can expose a powerful debugging endpoint beyond the local host.

The exposed protocol lacks a sufficient built-in authentication and encryption layer for untrusted network access. Binding to all interfaces is unnecessary for local analysis and violates least-exposure principles.

Attack Path

1. An operator copies the command from the quick-reference file.
2. gdbserver listens on TCP port 23947 on every IPv4 interface.
3. An attacker discovers and reaches the exposed port.
4. The attacker connects with a GDB-compatible client.
5. When a target is launched or attached, the attacker uses debugger functions to inspect or manipulate it within the server account's permission boundary.

Impact Assessment

Successful exploitation could expose process memory, registers, program state, credentials, cryptographic material, or analyzed data. It may also permit execution-flow manipulation, process termination, or code execution with the privileges available to the debugger service.

Network controls and the service account's privileges determine the exact scope, but the documented global bind creates an avoidable high-impact attack surface.

Remediation

View remediation

Remediation Suggestions

• Change the quick-reference command to:

  bash

  gdbserver --multi 127.0.0.1:23947
  

• Document SSH tunneling or VPN access as the supported method for remote use.

• Require restrictive firewall rules, a dedicated unprivileged account, and session cleanup.

• Keep the primary Skill documentation and quick-reference file synchronized so the insecure example cannot be reintroduced from duplicated content.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 93% confidence

Finding

The skill explicitly enumerates exploit-framework components including pwntools, ROP tooling, one_gadget, and msfvenom shellcode generation. In a security-analysis skill that also permits execution, this materially increases dual-use abuse potential by providing operator-ready offensive tooling references and example commands.

Content

Scanner excerpt · SKILL.md (reported line 587)May include surrounding context.

md

程调试嵌入式 |

### 利用开发框架

| 工具 | 用途 | 关键命令 |
|------|------|---------|
| **pwntools** | Python exploit | `process()`/`remote()`/`ELF()`/`ROP()` |
| **ROPgadget** | ROP gadget 搜索 | `--binary ./bin --only "pop\|ret"` |
| **ropper** | gadget + chain | `--file ./bin --search "pop rdi"` |
| **one_gadget** | libc one-shot | `/lib/x86_64-linux-gnu/libc.so.6` |
| **msfvenom** | shellcode | `-p linux/x64/shell_reverse_tcp` |

### Fuzzing 工具

| 工具 | 目标 | 特点 |
|------|------|------|
| **syzkaller** | Linux 内核 | 系统性 Fuzzing，覆盖所有子系统 |
| **trinity** | Linux 系统调用 | 多架构支持，快速生成用例 |
| **libfuzzer** | LLVM 组件 | 集成在编译器中，cov 导向 |
| **AFL** | 用户态程序 | 遗传算法，fork server |

---

## 输出约束

| 约束 | 说明 |
|------|------|
| 概念性 PoC | 仅伪代码 + 触发序列，不生成可执行攻击代码 |
| 信息来源 | 至少 3 个不同来源，�

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/tool-quick-ref.md (reported line 31)May include surrounding context.

md

�汇编、符号表 |

## 利用开发框架

| 工具 | 用途 | 关键命令 |
|------|------|---------|
| **pwntools** | Python exploit | `process()`/`remote()`/`ELF()`/`ROP()` |
| **ROPgadget** | ROP gadget 搜索 | `--binary ./bin --only "pop\|ret"` |
| **ropper** | gadget + chain | `--file ./bin --search "pop rdi"` |
| **one_gadget** | libc one-shot | `/lib/x86_64-linux-gnu/libc.so.6` |
| **msfvenom** | shellcode | `-p linux/x64/shell_reverse_tcp` |

## 静态分析工具

| 工具 | 用途 | 关键命令 |
|------|------|---------|
| **CodeQL** | 语义漏洞查询 | `codeql database create` |
| **Semgrep** | 结构化规则 | `semgrep --config rules.yaml` |
| **Coccinelle** | 内核语义 patch | `spatch --sp-file rules.cocci` |
| **grep** | 快速关键词 | `grep -rn "pattern" ./` |

## Fuzzing 工具

| 工具 | 目标 | 特点 |
|------|------|------|
| **syzkaller** | Linux 内核 | 系统性 Fuzzing，覆盖所有子系统 |
| **trinity** | Linux 系统调用 | 多架构�

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list includes broad terms such as vulnerability analysis, reverse engineering, fault analysis, and security audit, which can match ambiguous user requests. Overbroad activation increases the chance that this powerful skill—especially one exposing exec and exploit-oriented guidance—runs in contexts where a narrower, safer skill should have been selected.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 484)May include surrounding context.

bash

# 创建 CodeQL 数据库
codeql database create /path/to/db --language=cpp --source-root=/path/to/kernel/driver

# 查询特定漏洞模式
codeql database analyze /path/to/db /path/to/rules/buffer-overflow.ql --format=sarif-latest --output=results.sarif

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill states that PoC output must remain conceptual and that PoC code must never be executed, yet it also documents active fuzzing, exploit-development tooling, remote debugging, and shellcode-generation commands. In a skill with allowed-tools: ... exec, this contradiction weakens safety boundaries and can normalize or induce operational use of offensive tooling beyond passive analysis.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

“中英文混合场景优先中文输出”属于语言/locale 偏好约束，但文档未说明需经用户同意，也未提供语言选择机制。根据规则，未经用户选择而强制特定语言属于自然语言政策违规。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The title and the entire reference content are written in Chinese, and the file does not indicate that language selection is optional or that the skill is region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code file prints an execution flow that includes fuzzing tools and PoC generation, which can affect system integrity or create potentially dangerous artifacts, but the script provides no cautionary notice, confirmation, or safety disclosure around those actions. Although it is only routing/output logic, the displayed workflow communicates safety-critical behavior without warning the user.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The section title explicitly describes a complete seven-phase workflow, and the numbered subsections start at 阶段 1. Later, the document introduces '阶段 8：签名与导出', which contradicts the stated count and misrepresents the actual workflow structure. This is an internal intent/documentation inconsistency.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Nearly all visible prompts and routing descriptions are presented only in Chinese, which forces a specific language on users without opt-in. The policy allows locale constraints when explicitly justified or when users are offered a choice, neither of which is present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.