T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:229- Finding
Over-Privileged System Modification and Persistent Service Enablement
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai Security Audit
Security checks for vulnerabilities and agentic risk
Overview
The skill is a plausible AI endpoint security runbook, but it asks for sensitive infrastructure details and recommends broad root-level host changes without enough guardrails.
Install only if you want an AI endpoint security runbook that may lead to administrator-level remediation. Do not let an agent execute the commands automatically; review each sudo, package upgrade, restart, firewall, audit, and fail2ban action first. Share only endpoint details you are comfortable exposing, prefer first-party cloud inventory over public IP-discovery services, redact secret-scan output, and pin container images or package versions before use.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:276- Finding
Overly Broad Privileged Host Reconnaissance and Secret Discovery
- Content
View full analysis
/dev/null | grep -v proc | grep -v sys ``` ```bash grep -r "password\|secret" ./config/ (review all results) ``` ### Technical Analysis The Skill recommends enumerating root cron entries, system cron files, listening processes, recently modified files across the root filesystem, and configuration lines that may contain credentials. Some host investigation is reasonable after a suspected compromise. However, these commands are not limited to the declared AI service: - `sudo crontab -l` accesses root-owned scheduling information. - `cat /etc/cron*/*` can reveal commands, account names, paths, tokens, or operational details from system-wide scheduled jobs. - `ss -tlnp` exposes the host's network service and process topology. - `find /` searches unrelated application, user, and tenant directories. - Recursive `grep` prints complete matching lines, potentially placing plaintext passwords, API keys, tokens, or secrets into terminal history, Agent context, transcripts, or centralized logs. The commands do not transmit the results themselves, but an Agent-mediated workflow may capture command output. The broad collection therefore creates unnecessary disclosure risk and exceeds the minimum scope required for an AI endpoint audit. ### Attack Path 1. The Skill identifies or alleges a threat-actor association. 2. The user permits host-level investigation and executes the recommended commands. 3. Root cro ...[truncated 1041 chars]- Remediation
View remediation
other
Note
- Location
SKILL.md:42- Finding
Public IP Disclosure to Third-Party Discovery Services
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (28)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
- Enable credential rotation policy — rotate every 90 days minimum
- Search for hardcoded credentials in config files:
bash grep -r "password\|secret\|api_key\|token" ./config/ --include="*.json" --include="*.env" --include="*.yaml"
NET-01: Restrict Port Exposure (always recommend)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md | CVE Range | Component | Action | |---|---|---| | CVE-2024-6387, CVE-2023-38408 | OpenSSH | `sudo apt update && sudo apt upgrade openssh-server` | | CVE-2023-48795, CVE-2025-26465 | SSH protocol | Disable weak algorithms in `/etc/ssh/sshd_config` | | CVE-2023-44487 | HTTP/2 (Rapid Reset) | Update nginx/apache, enable rate limiting | | CVE-2022-* Apache series | Apache httpd | `sudo apt upgrade apache2` |
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md | CVE Range | Component | Action | |---|---|---| | CVE-2024-6387, CVE-2023-38408 | OpenSSH | `sudo apt update && sudo apt upgrade openssh-server` | | CVE-2023-48795, CVE-2025-26465 | SSH protocol | Disable weak algorithms in `/etc/ssh/sshd_config` | | CVE-2023-44487 | HTTP/2 (Rapid Reset) | Update nginx/apache, enable rate limiting | | CVE-2022-* Apache series | Apache httpd | `sudo apt upgrade apache2` |
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md | CVE Range | Component | Action | |---|---|---| | CVE-2024-6387, CVE-2023-38408 | OpenSSH | `sudo apt update && sudo apt upgrade openssh-server` | | CVE-2023-48795, CVE-2025-26465 | SSH protocol | Disable weak algorithms in `/etc/ssh/sshd_config` | | CVE-2023-44487 | HTTP/2 (Rapid Reset) | Update nginx/apache, enable rate limiting | | CVE-2022-* Apache series | Apache httpd | `sudo apt upgrade apache2` |
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list includes broad phrases like 'security audit' and 'check my endpoint', which can cause unintended activation in unrelated conversations. In a skill that solicits infrastructure details and provides high-impact administrative commands, overbroad invocation increases the chance of accidental data disclosure or unsafe operational guidance being surfaced without clear user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly asks users for sensitive infrastructure data including public IPs, hostnames, cloud provider, region, ASN, and deployment timing, but provides no privacy warning, minimization guidance, or handling constraints. This creates unnecessary exposure of high-value targeting information and could normalize sharing sensitive operational details into an AI workflow.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Using firewall (ufw):
bash # Block public access to port 18789 sudo ufw deny 18789 # Allow only specific trusted IPs sudo ufw allow from <your-office-ip> to any port 18789
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Using firewall (ufw):
bash # Block public access to port 18789 sudo ufw deny 18789 # Allow only specific trusted IPs sudo ufw allow from <your-office-ip> to any port 18789
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Using firewall (ufw):
bash # Block public access to port 18789 sudo ufw deny 18789 # Allow only specific trusted IPs sudo ufw allow from <your-office-ip> to any port 18789
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Using firewall (ufw):
bash # Block public access to port 18789 sudo ufw deny 18789 # Allow only specific trusted IPs sudo ufw allow from <your-office-ip> to any port 18789
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Using firewall (ufw):
bash # Block public access to port 18789 sudo ufw deny 18789 # Allow only specific trusted IPs sudo ufw allow from <your-office-ip> to any port 18789
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Using firewall (ufw):
bash # Block public access to port 18789 sudo ufw deny 18789 # Allow only specific trusted IPs sudo ufw allow from <your-office-ip> to any port 18789
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Using firewall (ufw):
bash # Block public access to port 18789 sudo ufw deny 18789 # Allow only specific trusted IPs sudo ufw allow from <your-office-ip> to any port 18789
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Using firewall (ufw):
bash # Block public access to port 18789 sudo ufw deny 18789 # Allow only specific trusted IPs sudo ufw allow from <your-office-ip> to any port 18789
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Using firewall (ufw):
bash # Block public access to port 18789 sudo ufw deny 18789 # Allow only specific trusted IPs sudo ufw allow from <your-office-ip> to any port 18789
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Using firewall (ufw):
bash # Block public access to port 18789 sudo ufw deny 18789 # Allow only specific trusted IPs sudo ufw allow from <your-office-ip> to any port 18789
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Using firewall (ufw):
bash # Block public access to port 18789 sudo ufw deny 18789 # Allow only specific trusted IPs sudo ufw allow from <your-office-ip> to any port 18789
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Using firewall (ufw):
bash # Block public access to port 18789 sudo ufw deny 18789 # Allow only specific trusted IPs sudo ufw allow from <your-office-ip> to any port 18789
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md sudo ufw deny 18789 # Allow only specific trusted IPs sudo ufw allow from <your-office-ip> to any port 18789 sudo ufw allow from <vpn-subnet> to any port 18789 sudo ufw reload
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md sudo ufw deny 18789 # Allow only specific trusted IPs sudo ufw allow from <your-office-ip> to any port 18789 sudo ufw allow from <vpn-subnet> to any port 18789 sudo ufw reload
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md sudo ufw deny 18789 # Allow only specific trusted IPs sudo ufw allow from <your-office-ip> to any port 18789 sudo ufw allow from <vpn-subnet> to any port 18789 sudo ufw reload
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md sudo ufw deny 18789 # Allow only specific trusted IPs sudo ufw allow from <your-office-ip> to any port 18789 sudo ufw allow from <vpn-subnet> to any port 18789 sudo ufw reload
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md sudo ufw deny 18789 # Allow only specific trusted IPs sudo ufw allow from <your-office-ip> to any port 18789 sudo ufw allow from <vpn-subnet> to any port 18789 sudo ufw reload
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # Enable auditd sudo apt install auditd -y sudo systemctl enable --now auditd # Log all authentication events sudo auditctl -w /var/log/auth.log -p rwa -k auth_monitor
Static analysis
No suspicious patterns detected.