T03 · Remote Payload Retrieval and Execution
Error
- Location
references/error-codes.md:133- Finding
Mutable Remote Installer Is Piped Directly Into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
sev-attestation
Security checks for vulnerabilities and agentic risk
Overview
This is a plausible AMD SEV-SNP attestation helper, but it overstates what it verifies and includes privileged setup and mutable installer guidance that users should review before trusting it with secrets.
Install only if you understand SEV-SNP administration and can review the scripts. Do not treat a PASS result as sufficient proof to release secrets unless you add or independently perform nonce, measurement, debug-bit, and TCB policy checks. Avoid running the whole workflow as root where possible, review any sudo commands before use, do not enable persistent module or device-permission changes without a rollback plan, and prefer pinned, verified dependency installation over cargo install without a version or curl | sh.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/full-attestation.sh:171- Finding
Attestation Success Does Not Enforce Nonce, Measurement, Debug, or TCB Policy
- Content
View full analysis
"$OUTPUT_DIR/nonce.hex" ``` The preferred verification path treats successful signature verification as sufficient: ```bash if command -v snpguest &>/dev/null; then echo "Verifying report using snpguest..." echo "" if snpguest verify attestation "$CERTS_DIR" "$REPORT_FILE" 2>&1; then echo "" echo -e "${GREEN}Report signature verification PASSED${NC}" # Display report details echo "" echo "=== Attestation Report Details ===" snpguest display report "$REPORT_FILE" 2>/dev/null || true exit 0 else echo "" echo -e "${RED}Report signature verification FAILED${NC}" exit 1 fi fi ``` The OpenSSL fallback likewise exits successfully after signature validation without applying an attestation policy: ```bash if openssl dgst -sha384 -verify "$WORK_DIR/vcek_pub.pem" -signature "$WORK_DIR/signature.der" "$WORK_DIR/signed_data.bin" 2>/dev/null; then echo "" echo -e "${GREEN}Report signature verification PASSED${NC}" # Display basic report info echo "" echo "=== Report Summary ===" echo "Report version: $(xxd -p -s 0 -l 4 "$REPORT_FILE" | fold -w2 | tac | ...[truncated 3786 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:112- Finding
Security-Critical Dependency Is Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (25)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
- Make it persistent:
bash echo "sev-guest" | sudo tee /etc/modules-load.d/sev-guest.conf
SEV-SNP not detected in firmware/CPU
- Make it persistent:
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Piping curl output directly into sh is a classic dangerous command chain because it combines remote content retrieval with immediate shell execution. If the remote endpoint, transport, or dependency chain is compromised, the user may execute arbitrary code with their local privileges.
- Content
- Install Rust if needed:
bash curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
IOCTL failure
- Install Rust if needed:
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
rm -rf ./output/certs is a destructive filesystem operation that can delete data irreversibly if run from the wrong directory or if paths are modified. In docs intended for copy-paste use, this carries real risk despite being aimed at a troubleshooting directory.
- Content
- Re-fetch certificates:
bash rm -rf ./output/certs ./scripts/fetch-certificates.sh ./output/report.bin ./output
- Re-fetch certificates:
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh if [[ -f "$OUTPUT_DIR/certs/cert_2.pem" ]]; then mv "$OUTPUT_DIR/certs/cert_2.pem" "$OUTPUT_DIR/certs/ark.pem" fi rm -f "$OUTPUT_DIR/certs/cert_0.pem" "$OUTPUT_DIR/certs/cert_"*.pem 2>/dev/null || true echo -e "${GREEN}Fetched ARK and ASK certificates${NC}" fi
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh fi # Cleanup rm -f "$CERTS_DIR/ca_bundle.pem" echo "" echo "=== Chain Verification Summary ==="
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly lists 'root 权限' as a dependency but does not warn users about the risks of running attestation scripts with elevated privileges or advise them to inspect the scripts first. In a security-sensitive skill that fetches certificates, invokes external tools, and performs system attestation, omission of privilege-safety guidance increases the chance of unnecessary root execution and magnifies the impact of any script defect or future compromise.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill instructs users to run local shell scripts and access privileged resources like /dev/sev-guest, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, this mismatch can cause the agent to invoke shell and file-read capabilities without clear authorization, increasing the risk of unintended command execution or access to sensitive host resources.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
-
Load the kernel module:
bash sudo modprobe sev-guest -
Verify kernel config:
-
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
-
Load the kernel module:
bash sudo modprobe sev-guest -
Verify kernel config:
-
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
-
Load the kernel module:
bash sudo modprobe sev-guest -
Verify kernel config:
-
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation instructs users to make a kernel module load persistently via a privileged write to /etc/modules-load.d without any caution about the security or operational impact. While not inherently malicious, persistent system configuration changes can have unintended consequences and should be clearly framed as admin-only actions with rollback guidance.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
This command pipes data into sudo tee to create a persistent module-load configuration file under /etc, which changes system behavior across reboots. The danger is not command injection from untrusted input here, but an undocumented persistent privileged modification that users may apply without understanding impact or rollback.
- Content
- Make it persistent:
bash echo "sev-guest" | sudo tee /etc/modules-load.d/sev-guest.conf
SEV-SNP not detected in firmware/CPU
- Make it persistent:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
The phrase 'Run as root' is a broad escalation recommendation that lacks least-privilege rationale. In security-sensitive tooling, blanket root guidance can lead to unnecessary privileged execution of local scripts.
- Content
Solutions:
- Run as root:
bash sudo ./scripts/generate-report.sh ./output
- Run as root:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 78% confidence
- Finding
Telling users to run the report-generation script as root increases the blast radius if the script or its dependencies behave unexpectedly. In documentation, recommending blanket root execution without discussing alternatives or trust boundaries is a risky practice.
- Content
-
Run as root:
bash sudo ./scripts/generate-report.sh ./output -
Add user to sev group:
-
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This section recommends running as root, changing group membership, and modifying device ownership/permissions on /dev/sev-guest, but does not warn that these actions expand access to a sensitive device node. Users may weaken least-privilege controls or apply unsafe permission changes without understanding the security implications.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 87% confidence
- Finding
Adding a user to the sev group changes long-term access control and may grant ongoing access to a sensitive device interface. Without warning or scope guidance, users may over-grant privileges beyond what is necessary for one-time troubleshooting.
- Content
- Add user to sev group:
bash sudo usermod -a -G sev $USER # Log out and back in
- Add user to sev group:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
Changing permissions on /dev/sev-guest with chmod 660 is not maximally permissive, but it still alters access control on a device node and may diverge from intended platform policy. Presented without caution, this can normalize ad hoc security-sensitive permission changes.
- Content
bash ls -la /dev/sev-guest # Fix if needed: sudo chmod 660 /dev/sev-guest sudo chown root:sev /dev/sev-guest
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
Changing permissions on /dev/sev-guest with chmod 660 is not maximally permissive, but it still alters access control on a device node and may diverge from intended platform policy. Presented without caution, this can normalize ad hoc security-sensitive permission changes.
- Content
bash ls -la /dev/sev-guest # Fix if needed: sudo chmod 660 /dev/sev-guest sudo chown root:sev /dev/sev-guest
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
Changing device ownership to root:sev grants the sev group access to the device node and may broaden access in a persistent or semi-persistent way depending on the system's device management. Without explanation, users may apply it without understanding who now gains hardware interface access.
- Content
ls -la /dev/sev-guest
Fix if needed:
sudo chmod 660 /dev/sev-guest sudo chown root:sev /dev/sev-guest
text ### snpguest not found
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation includes a recursive deletion command against a path under ./output without an explicit warning or validation step. Even if scoped, rm -rf is hazardous in copy-paste workflows and can become destructive if variables, paths, or working directories differ from expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
All user-facing documentation in this file is written in Chinese, with no indication that the skill is region-specific or that other language options are available. The policy requires avoiding language or locale constraints unless the user opts in or the restriction is clearly justified.
- Content
Excessive Permissions
Low
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
- Content
Log out and back in
text 3. **Check device permissions:** ```bash ls -la /dev/sev-guest # Fix if needed:
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The documentation instructs users to execute a remotely fetched script directly with curl | sh, which bypasses meaningful review and makes supply-chain compromise or network interception highly impactful. Even over HTTPS, this pattern is dangerous because it delegates code execution to external content at runtime.
- Content
- Install Rust if needed:
bash curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
IOCTL failure
- Install Rust if needed:
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script writes nonce.hex, request_data.bin, and report.bin into the provided output directory using shell redirection and the snpguest command, but there is no confirmation prompt or explicit warning that prior files in that directory may be replaced. Because these are filesystem-modifying operations in a generic output path, users are not clearly alerted to the overwrite risk.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code creates a temporary CA bundle at "$CERTS_DIR/ca_bundle.pem" and later deletes it, which is a file write and deletion operation. Although the script prints verification progress, it does not disclose in the usage/help text or nearby comments that it will modify the target directory by creating a temporary file.
- Content
Static analysis
No suspicious patterns detected.