ClawHub
Back to skill

Security audit

元察 yotta-logwatch

Security checks for vulnerabilities and agentic risk

Overview

The log analyzer itself is offline and read-only, but its bundled installers can copy the skill into many agent skill directories, so installation needs review.

Install only with an explicit target such as --agent or --dir, avoid the no-argument and -g/--global installer modes unless you intentionally want this skill copied into multiple agent environments, and pin or otherwise verify the package version before running npx. When using the analyzer, provide the narrowest log file or directory needed because security logs may contain sensitive operational data.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (74)

YARA rule 'php_webshell_known': Known PHP webshell families (c99, r57, b374k, WSO, etc.) [webshells]

Critical
Category
YARA Match
Content
pinfo.php`、`/phpunit`、`/actuator`、`/console`、`/backup`、`/dump`、`/test`、`/explorer`、`/vendor`、`/config`、`/server-status`、`/server-info`、`/xmlrpc.php`、`/webdav`、`/shell`、`/shell.php`、`/cmd`、`/debug`、`/xdebug` 等。

### webshell 路径片段（WEBSHELL_PATH）

`/shell.php`、`/cmd.php`、`/eval`、`/webshell`、`/backdoor`、`/c99.php`、`/r57.php`、`/wso`、`/b374k`、`/uploads/shell`、`/hack.php`、`/shell.asp`、`/shell.jsp`、`/jsp/cmd`、`/marco` 等。

### 路径遍历特征（TRAVERSAL）

`../`、`..%2f`、`..%5c`、`%2e%2e%2f`、`%2e%2e%5c`、`%252e%252e`、`..%2F`、`..%252f`、`%c0%ae%c0%ae`、`%c0%ae`、`dotdot`。

### SQL 注入特征（SQLI）

`union select`、`or 1=1`、`or 1=1--`、`1=1`、`sleep(`、`benchmark(`、`information_schema`、`@@version`、`concat(`、`group_concat`、`or '1'='1`、`union all select`、`procedure analyse`、`and 1=1`、`waitfor delay`、`pg_sleep`、`into outfile`、`xp_cmdshell`、`%27`、`'%20or%20`
Confidence
90% confidence
Finding
YARA rule matched a known webshell pattern (PHP, Python, JSP, or ASPX webshell).

YARA rule 'php_webshell_known': Known PHP webshell families (c99, r57, b374k, WSO, etc.) [webshells]

Critical
Category
YARA Match
Content
pinfo.php`、`/phpunit`、`/actuator`、`/console`、`/backup`、`/dump`、`/test`、`/explorer`、`/vendor`、`/config`、`/server-status`、`/server-info`、`/xmlrpc.php`、`/webdav`、`/shell`、`/shell.php`、`/cmd`、`/debug`、`/xdebug` 等。

### webshell 路径片段（WEBSHELL_PATH）

`/shell.php`、`/cmd.php`、`/eval`、`/webshell`、`/backdoor`、`/c99.php`、`/r57.php`、`/wso`、`/b374k`、`/uploads/shell`、`/hack.php`、`/shell.asp`、`/shell.jsp`、`/jsp/cmd`、`/marco` 等。

### 路径遍历特征（TRAVERSAL）

`../`、`..%2f`、`..%5c`、`%2e%2e%2f`、`%2e%2e%5c`、`%252e%252e`、`..%2F`、`..%252f`、`%c0%ae%c0%ae`、`%c0%ae`、`dotdot`。

### SQL 注入特征（SQLI）

`union select`、`or 1=1`、`or 1=1--`、`1=1`、`sleep(`、`benchmark(`、`information_schema`、`@@version`、`concat(`、`group_concat`、`or '1'='1`、`union all select`、`procedure analyse`、`and 1=1`、`waitfor delay`、`pg_sleep`、`into outfile`、`xp_cmdshell`、`%27`、`'%20or%20`
Confidence
90% confidence
Finding
YARA rule matched a known webshell pattern (PHP, Python, JSP, or ASPX webshell).

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
A second analyzer pass reports the same underlying issue: hidden deployment/install behavior and local filesystem modification despite a declared non-modifying audit-only purpose. In a multi-agent environment, this increases the risk of unauthorized persistence, lateral propagation across skill directories, or silent tampering with local agent configuration.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
A second analyzer pass reports the same underlying issue: hidden deployment/install behavior and local filesystem modification despite a declared non-modifying audit-only purpose. In a multi-agent environment, this increases the risk of unauthorized persistence, lateral propagation across skill directories, or silent tampering with local agent configuration.

Chaining Abuse

High
Category
Tool Misuse
Content
| auth | credential_stuffing | high | 同源尝试多个不同用户名 |
| auth | abnormal_login | high | 同源多次失败后成功登录 |
| auth | root_login | medium | 来源以 root 直登 |
| auth | sudo_escalation / sudo_attempt | medium~high | sudo 提权 / 越权（not in sudoers） |
| web | path_traversal | high | 路径穿越（../ 或编码变体） |
| web | sql_injection | high | SQL 注入特征 |
| web | webshell_upload | critical | webshell 上传 / 访问轨迹 |
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High
Category
Tool Misuse
Content
| auth | credential_stuffing | high | 同源尝试多个不同用户名 |
| auth | abnormal_login | high | 同源多次失败后成功登录 |
| auth | root_login | medium | 来源以 root 直登 |
| auth | sudo_escalation / sudo_attempt | medium~high | sudo 提权 / 越权（not in sudoers） |
| web | path_traversal | high | 路径穿越（../ 或编码变体） |
| web | sql_injection | high | SQL 注入特征 |
| web | webshell_upload | critical | webshell 上传 / 访问轨迹 |
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High
Category
Tool Misuse
Content
| auth | credential_stuffing | high | 同源尝试多个不同用户名 |
| auth | abnormal_login | high | 同源多次失败后成功登录 |
| auth | root_login | medium | 来源以 root 直登 |
| auth | sudo_escalation / sudo_attempt | medium~high | sudo 提权 / 越权（not in sudoers） |
| web | path_traversal | high | 路径穿越（../ 或编码变体） |
| web | sql_injection | high | SQL 注入特征 |
| web | webshell_upload | critical | webshell 上传 / 访问轨迹 |
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
技能清单将该技能描述为仅用于本地安全日志的只读分析，明确声明“不修改任何其内容”。但此安装器会创建目录并将整个技能复制到目标位置，属于实际写入文件系统的修改行为。即使这是安装阶段代码而非分析逻辑本身，它仍是该技能包实际包含的操作，与“只读”整体表述不一致。

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
Manifest将技能描述为仅用于本地日志的只读分析，不修改内容；但该脚本实际执行安装操作：创建目录、复制整个技能目录，并删除目标中的.git。这不是日志分析实现细节，而是显式的本地文件写入/修改行为，与“只读”边界不一致。

Tool Parameter Abuse

High
Category
Tool Misuse
Content
install_to() {
  mkdir -p "$1/$SKILL_NAME"
  cp -r "$SOURCE_DIR/." "$1/$SKILL_NAME/"
  rm -rf "$1/$SKILL_NAME/.git"
  echo "installed -> $1/$SKILL_NAME"
}
Confidence
95% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High
Category
Privilege Escalation
Content
典型行（combined）：

```
10.0.0.9 - - [05/Jan/2026:12:00:01 +0000] "GET /../../etc/passwd HTTP/1.1" 404 123 "-" "curl/7.64"
```

引擎解析来源 IP、时间、方法、URI、状态码、User-Agent。URI 会先做 URL 解码（unquote）再做特征匹配，因此 `union%20select` / `%2e%2e%2f` 也能命中。
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
典型行（combined）：

```
10.0.0.9 - - [05/Jan/2026:12:00:01 +0000] "GET /../../etc/passwd HTTP/1.1" 404 123 "-" "curl/7.64"
```

引擎解析来源 IP、时间、方法、URI、状态码、User-Agent。URI 会先做 URL 解码（unquote）再做特征匹配，因此 `union%20select` / `%2e%2e%2f` 也能命中。
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Content
��务创建 | task_created | 出现 4698 | medium | 计划任务持久化；核对任务动作与触发条件 |

> 同一条事件可能同时命中多条规则（如 4624 同时触发 rdp_logon + admin_logon + abnormal_login），
> 这是正常行为，便于逐条复核，不影响时间线去重。

## 可疑进程特征（EventID 4688）

| 特征 | 默认严重度 | 说明 |
|---|---|---|
| mimikatz / lsass / procdump | critical~high | 凭据窃取 / 内存转储 |
| downloadstring / frombase64string / -enc / -windowstyle hidden | high | 下载执行 / 编码命令 / 隐藏窗口执行 |
| mshta / certutil -urlcache / regsvr32 /s / rundll32 javascript / bitsadmin /transfer | high | LOLBin 远程加载 / 下载执行 |
| powershell / pwsh / cmd /c / wscript / cscript / schtasks /create / sc create | medium | 脚本宿主 / 持久化命令 |
| whoami / taskkill /f / net user | low~medium | 侦察 / 账户管理（需结合上下文） |

## 阈值与调参

- 4625 聚合复用 `--m
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Credential Access

High
Category
Privilege Escalation
Content
SCANNER_PATH = [
    "/wp-login.php", "/wp-admin", "/wp-content", "/administrator",
    "/phpmyadmin", "/pma", "/mysql", "/admin", "/login", "/manager",
    "/cgi-bin", "/.git", "/.env", "/.svn", "/.htaccess", "/phpinfo.php",
    "/phpunit", "/actuator", "/console", "/backup", "/dump", "/test",
    "/explorer", "/vendor", "/config", "/server-status", "/server-info",
    "/xmlrpc.php", "/.well-known", "/robots.txt", "/webdav", "/shell",
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Content
��块包含混淆特征（iex / -enc / [char] / 字符串拼接 / 格式化等），"
                "可能用于规避检测。建议：尝试解码还原后人工核实。",
                evidence=evid, time_value=ev.get("ts")))

    return findings


# Windows 事件日志可疑进程特征：(匹配子串, 说明, 严重度)。按严重度从高到低匹配。
SUSPICIOUS_PROCESS = [
    ("mimikatz", "凭据窃取工具（Mimikatz）", "critical"),
    ("lsass", "LSASS 进程访问（凭据窃取）", "critical"),
    ("downloadstring", "下载内容并执行", "critical"),
    ("procdump", "内存转储（可能窃取凭据）", "high"),
    ("frombase64string", "Base64 解码执行", "high"),
    ("mshta", "MSHTA 脚本宿主（可加载远程内容）", "high"),
    ("certutil -urlcache", "CertUtil 下载执行", "high"),
    ("certutil -decode", "CertUtil 解码执行", "high"),
    ("regsvr32 /s", "Regsvr32 静默注册（可远程加载）", "high"),
    ("rundll32 javascr
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
This NOTICE file is entirely written in Chinese and includes an explicit claim of '中文教学' on L11, with no indication that users may choose another language or that the Chinese-only presentation is required for a region-specific purpose. That creates a natural-language locale policy concern under the language/locale rule.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The README repeatedly states that the tool outputs "Chinese teaching-style reports" and "Chinese plain-language explanations" as a fixed behavior. This is a natural-language locale policy issue because it forces a specific output language without indicating user opt-in or an available language choice.

Skill Enumeration

Medium
Category
Agent Snooping
Content
```text
# Optional China mirror: npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-logwatch --agent <agent-name>      # install to the agent's default user-level skills dir
npx -y @yottameta/yotta-logwatch --dir <your-skills-dir>   # point to the skills dir itself (e.g. ~/.codex/skills)
```
Confidence
85% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The README says the skill auto-activates when it detects broad intents like analyzing login/web/PowerShell logs or auditing abnormal activity. Overly broad activation criteria can cause the skill to trigger in unrelated contexts and ingest sensitive local files more often than intended, especially in agent ecosystems where skill selection may be heuristic.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding
The README instructs users to run `npx -y @yottameta/yotta-logwatch` without pinning a specific package version. That causes execution of whatever version is current in the registry at install time, creating a supply-chain risk if a malicious or compromised release is published later. Because this is an installation path for an agent skill, it can directly place attacker-controlled content into the agent's skills environment.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding
The README instructs users to run `npx -y @yottameta/yotta-logwatch` without pinning a specific package version. That causes execution of whatever version is current in the registry at install time, creating a supply-chain risk if a malicious or compromised release is published later. Because this is an installation path for an agent skill, it can directly place attacker-controlled content into the agent's skills environment.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding
The README instructs users to run `npx -y @yottameta/yotta-logwatch` without pinning a specific package version. That causes execution of whatever version is current in the registry at install time, creating a supply-chain risk if a malicious or compromised release is published later. Because this is an installation path for an agent skill, it can directly place attacker-controlled content into the agent's skills environment.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding
The README instructs users to run `npx -y @yottameta/yotta-logwatch` without pinning a specific package version. That causes execution of whatever version is current in the registry at install time, creating a supply-chain risk if a malicious or compromised release is published later. Because this is an installation path for an agent skill, it can directly place attacker-controlled content into the agent's skills environment.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding
The README instructs users to run `npx -y @yottameta/yotta-logwatch` without pinning a specific package version. That causes execution of whatever version is current in the registry at install time, creating a supply-chain risk if a malicious or compromised release is published later. Because this is an installation path for an agent skill, it can directly place attacker-controlled content into the agent's skills environment.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/yotta_logwatch.py:725