ClawHub
Back to skill

Security audit

元安 yotta-security-audit

Security checks for vulnerabilities and agentic risk

Overview

This auditing skill needs review because it can miss disguised threats and expose student information in supposedly masked reports.

Use independent review before trusting a clean scan. The discovery and filename exemptions need correction, and --include-self does not remove every exemption. Avoid real student records until report masking is corrected, and inspect reports before sharing them. Choose installation targets explicitly and pin a reviewed package version; remotely fetched releases were not assessed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/yotta_audit.py
Finding

Untrusted Skills can impersonate the scanner to bypass auditing

Content
View full analysis

Impact

A third-party Skill can deterministically disappear from the default audit, suppressing findings for all its contents and undermining the user's pre-use or periodic security review. Executable content placed in an exempt rule filename also avoids every detector and hash check. This is an audit-integrity bypass, not code execution by the scanner.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (62)

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CHANGELOG.md (reported line 86)May include surrounding context.

md
系统基线新增 **CIS 合规检测器**（Linux，只读，接入 run_linux_baseline 尾部）：

- 空密码账号（/etc/shadow 密码字段为空 = 无需密码可登录，high）。
- sudo NOPASSWD 免密提权条目（/etc/sudoers 与 /etc/sudoers.d，medium）。
- 内核参数加固（sysctl 只读查询）：fs.suid_dumpable / kernel.randomize_va_space
  （ASLR）/ net.ipv4.conf.all.accept_redirects / send_redirects / ip_forward。

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · README.md (reported line 73)May include surrounding context.

md
| Exfiltration | Read sensitive files then exfiltrate / archive and upload | high |
| CredentialTheft | SSH/cloud credentials, browser data, system credential-store access | critical |
| NetworkCall | Reverse connections, raw sockets, HTTP clients (mostly context-dependent) | medium |
| PrivilegeEscalation | Permission-bit changes, setuid, joining admin groups | high |
| SocialEngineering | Social-engineering wording in names (file names) | medium |
| Base64 | Overlong base64 strings (upgraded if decoding reveals sensitive keywords) | medium→high |
| IOCMatch | Known malicious IP/domain/URL patterns/file hashes | critical |
| PostInstallHook | Install-time lifecycle scripts (download/execute is critical) | high→critical |
| HiddenChar | Zero-width and bidirectional override characters | medium |
| Entropy | High-entropy encoded strings (suspected obfuscated/encrypted payloads) | medium |

> The rule table lives in scripts/audit_rules.py (signature data file, self-scan

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Installation can be legitimate supporting functionality, so the absence of scanning logic in this installer alone would not establish a mismatch. However, the description explicitly promises read-only, detection-and-reporting-only behavior and no deletion. Normal installation calls clean_residue(), which uses rm -rf and find -delete when an existing target contains SKILL.md, and copy_tree(), which creates directories and copies files. These are concrete side effects outside that stated boundary. Dry-run mode and target/symlink safeguards limit risk but do not make ordinary operation read-only. The supplied chunk shows no network exfiltration or malicious intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Installation can legitimately support an auditing skill, so the absence of detectors in this installer alone does not establish a mismatch. However, its concrete side effects contradict the description's unconditional read-only and no-deletion guarantees: installTo and copyDir create and overwrite filesystem content, while cleanResidue and safeRemove delete existing artifacts using unlinkSync and rmdirSync. These operations are restricted to installation targets and selected residue, with link checks and a dry-run option, but those safeguards do not make normal installation read-only. The supplied code shows no network exfiltration or malicious payload execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

In run_edu_scan(), table headers are inserted verbatim into location strings using header[col] and header[c]. These strings are subsequently included in text, Markdown, and JSON reports. A header containing a student's email address or phone number can therefore be reported in full even when masked_sample is redacted. Paths are also generally emitted unchanged; filename masking applies only when particular filename rules match, and scope.path contains the resolved original input path. Thus the core auditing purpose is accurately represented, and no repair, deletion, or malware-removal action is evident, but the categorical student-data non-disclosure boundary is not consistently enforced. Optional report-file writing is supporting reporting behavior, not itself a mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/system-baseline.md (reported line 29)May include surrounding context.

md
| 开放端口 | ss -tln（降级 /proc/net/tcp） | 对外监听端口 |
| 用户 crontab | crontab -l | 持久化脚本 |
| PATH 劫持 | 环境变量 PATH 分析 | PATH 含可写目录可致命令劫持 |
| CIS：空密码账号 | 读取 /etc/shadow | 密码字段为空 = 无需密码可登录，高危 |
| CIS：sudo NOPASSWD | 读取 /etc/sudoers 与 /etc/sudoers.d | 免密提权条目（NOPASSWD），中危 |
| CIS：内核参数加固 | sysctl（suid_dumpable / ASLR / ICMP 重定向 / IP 转发） | 内核参数是否处于安全基线值 |
| CIS：登录历史 | lastb -n 50 / last -n 10 | 失败登录（暴力破解迹象）与近期登录核查 |

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit_rules.py (reported line 123)May include surrounding context.

python
"Python 归档后上传", 85),
    Rule("EXF-003", "Exfiltration", "high",
         r"(?i)(?:\.env[^\n;]{0,80}(?:\bcurl\b|\bwget\b|requests\.post|urllib)|(?:\bcurl\b|\bwget\b|requests\.post|urllib)[^\n;]{0,80}\.env)",
         "读取 .env 后外传", 88),
    Rule("EXF-004", "Exfiltration", "high",
         r"(?i)(?:(?:id_rsa|id_ed25519|\.ssh)[^\n;]{0,80}(?:\bcurl\b|\bwget\b|requests\.post|urllib|ftp)|(?:\bcurl\b|\bwget\b|requests\.post|urllib|ftp)[^\n;]{0,80}(?:id_rsa|id_ed25519|\.ssh))",
         "读取 SSH 私钥后外传", 92),

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yotta_audit.py (reported line 102)May include surrounding context.

python
"student_data_rules.json",
}

# 无扩展名的点文件也纳入扫描（.env 等凭据文件常见形态）
DOTFILE_NAMES = {
    ".env", ".env.example", ".netrc", ".pgpass", ".bashrc", ".zshrc",
    ".profile", ".bash_profile", ".npmrc", ".gitconfig",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit_rules.py (reported line 136)May include surrounding context.

python
r"(?i)osascript[^\n;]{0,120}(?:password|passphrase)",
         "macOS 弹窗套取密码", 90),
    Rule("CRE-002", "CredentialTheft", "critical",
         r"(?i)security\s+find-generic-password|keychain",
         "访问 macOS keychain 凭据", 85),
    Rule("CRE-003", "CredentialTheft", "high",
         r"(?i)(?:id_rsa|id_ed25519|id_dsa)\.?(?:pub)?\b",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit_rules.py (reported line 137)May include surrounding context.

python
"macOS 弹窗套取密码", 90),
    Rule("CRE-002", "CredentialTheft", "critical",
         r"(?i)security\s+find-generic-password|keychain",
         "访问 macOS keychain 凭据", 85),
    Rule("CRE-003", "CredentialTheft", "high",
         r"(?i)(?:id_rsa|id_ed25519|id_dsa)\.?(?:pub)?\b",
         "读取 SSH 私钥文件", 80),

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/audit_rules.py (reported line 189)May include surrounding context.

python
"chmod 设置 setuid/setgid/sticky 权限位", 85),
    Rule("PRI-002", "PrivilegeEscalation", "high",
         r"(?i)\bchmod\s+777\b",
         "chmod 777 全权限", 70),
    Rule("PRI-003", "PrivilegeEscalation", "high",
         r"(?i)\bsetuid\s*\(|setgid\s*\(",
         "调用 setuid/setgid", 80),

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit_rules.py (reported line 241)May include surrounding context.

python
("id_ed25519", "SSH 私钥", "high", 85),
    ("id_dsa", "SSH 私钥", "high", 85),
    ("credentials", "云服务凭据文件", "high", 80),
    (".netrc", "网络凭据文件", "high", 80),
    (".pgpass", "数据库口令文件", "high", 85),
    ("history", "shell 历史文件", "medium", 60),
    (".env", "环境变量文件", "medium", 45),

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit_rules.py (reported line 244)May include surrounding context.

python
(".netrc", "网络凭据文件", "high", 80),
    (".pgpass", "数据库口令文件", "high", 85),
    ("history", "shell 历史文件", "medium", 60),
    (".env", "环境变量文件", "medium", 45),
]

# ══════════════════════════════════════════════════════════════════════════

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yotta_audit.py (reported line 93)May include surrounding context.

python
".md", ".txt", ".yaml", ".yml", ".json", ".toml", ".ini", ".cfg",
    ".rb", ".go", ".rs", ".java", ".c", ".cpp", ".h", ".hpp",
    ".html", ".css", ".xml", ".svg", ".plist", ".ps1", ".bat", ".cmd",
    ".env", ".conf", ".properties", ".gradle",
}
MAX_FILE_SIZE = 1_000_000  # 1 MB
# 签名数据文件：规则表是扫描器自身的签名数据库，不是被测技能行为，扫描时跳过

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yotta_audit.py (reported line 104)May include surrounding context.

python
# 无扩展名的点文件也纳入扫描（.env 等凭据文件常见形态）
DOTFILE_NAMES = {
    ".env", ".env.example", ".netrc", ".pgpass", ".bashrc", ".zshrc",
    ".profile", ".bash_profile", ".npmrc", ".gitconfig",
}
MAX_FILES_PER_SKILL = 1000

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yotta_audit.py (reported line 104)May include surrounding context.

python
# 无扩展名的点文件也纳入扫描（.env 等凭据文件常见形态）
DOTFILE_NAMES = {
    ".env", ".env.example", ".netrc", ".pgpass", ".bashrc", ".zshrc",
    ".profile", ".bash_profile", ".npmrc", ".gitconfig",
}
MAX_FILES_PER_SKILL = 1000

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yotta_audit.py (reported line 105)May include surrounding context.

python
# 无扩展名的点文件也纳入扫描（.env 等凭据文件常见形态）
DOTFILE_NAMES = {
    ".env", ".env.example", ".netrc", ".pgpass", ".bashrc", ".zshrc",
    ".profile", ".bash_profile", ".npmrc", ".gitconfig",
}
MAX_FILES_PER_SKILL = 1000
MAX_LINE_LEN = audit_rules.MAX_LINE_LEN

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/yotta_audit.py (reported line 1765)May include surrounding context.

python
findings.append(_sys_finding(
                "环境变量持久化点 %s" % env_key, "low", env_key,
                "键名: %s（值已脱敏）" % names[:200],
                "环境变量可被用于持久化，注意异常键名"))


def _win_browser_cred(findings):
    appdata = os.environ.get("LOCALAPPDATA", "")
    apdata = os.environ.get("APPDATA", "")
    marks = [
        ("Chrome 登录数据", Path(appdata) / "Google" / "Chrome" / "User Data" / "Default" / "Login Data"),
        ("Edge 登录数据", Path(appdata) / "Microsoft" / "Edge" / "User Data" / "Default" / "Login Data"),
        ("Firefox 登录数据", Path(apdata) / "Mozilla" / "Firefox" / "Profiles"),
    ]
    present = []
    for label, p in marks:
        try:
            ok = p.exists()
        except OSError:
            ok = False
        if ok:
            present.append(label)
    if present:
        findings.append(_sys_finding(
            "浏览器凭据存储位置存在", "info", "; ".j

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yotta_audit.py (reported line 1868)May include surrounding context.

python
if re.search(pat, content, re.M):
                findings.append(_sys_finding(msg, sev, str(sshd), msg,
                                             "建议禁用：PermitRootLogin no / 密钥认证"))
    ssh_cfg = Path.home() / ".ssh" / "config"
    if ssh_cfg.is_file():
        try:
            content = ssh_cfg.read_text(encoding="utf-8", errors="replace")

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yotta_audit.py (reported line 1934)May include surrounding context.

python
def _linux_cis_empty_passwd(findings):
    """CIS 1.1.5 / 5.4.x：/etc/shadow 中密码字段为空 = 无需密码即可登录。"""
    lines = _linux_read_lines("/etc/shadow")
    if lines is None:
        findings.append(_sys_finding(

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yotta_audit.py (reported line 1938)May include surrounding context.

python
lines = _linux_read_lines("/etc/shadow")
    if lines is None:
        findings.append(_sys_finding(
            "CIS：/etc/shadow 不可读", "info", "/etc/shadow",
            "文件不存在或当前用户无权限", "以 root 运行扫描以读取影子文件"))
        return
    users = []

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yotta_audit.py (reported line 1938)May include surrounding context.

python
lines = _linux_read_lines("/etc/shadow")
    if lines is None:
        findings.append(_sys_finding(
            "CIS：/etc/shadow 不可读", "info", "/etc/shadow",
            "文件不存在或当前用户无权限", "以 root 运行扫描以读取影子文件"))
        return
    users = []

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yotta_audit.py (reported line 1956)May include surrounding context.

python
users.append(name)
    if users:
        findings.append(_sys_finding(
            "CIS：空密码账号 %d 个" % len(users), "high", "/etc/shadow",
            "账号: " + "; ".join(users[:20])[:200],
            "空密码账号可被直接登录，立即设置密码或锁定账号"))

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yotta_audit.py (reported line 1935)May include surrounding context.

python
def _linux_cis_empty_passwd(findings):
    """CIS 1.1.5 / 5.4.x：/etc/shadow 中密码字段为空 = 无需密码即可登录。"""
    lines = _linux_read_lines("/etc/shadow")
    if lines is None:
        findings.append(_sys_finding(
            "CIS：/etc/shadow 不可读", "info", "/etc/shadow",

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-security-audit'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.