Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed server-administration skill, but it exposes very broad BT-Panel control with unsafe credential, tunnel, TLS, and raw-API handling.
Install only if you understand that this gives the agent broad administrative control over BT-Panel-managed servers. Before use, remove or tightly gate raw mode, enable normal TLS verification, avoid public tunnels that collapse all callers to 127.0.0.1, do not print tokens into transcripts or logs, rotate any exposed token, and require enforced confirmation for every write, file, task, Docker, certificate, database, or site-changing action.
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
Location
scripts/bt_api.py:42
Finding
TLS Certificate and Hostname Verification Disabled for Privileged API Requests
Content
View full analysis
Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
Location
scripts/enable_api.py:15
Finding
Public Tunnel Configuration Defeats the Panel Source-IP Allowlist
Content
View full analysis
1 else '127.0.0.1'
data = api.get_api_config()
if not data.get('open'):
api.set_token(G(t_type='2')) # Enable API and generate token/token_crypt
api.set_token(G(t_type='3', limit_addr=whitelist)) # Set IP allowlist
```
The documentation states that the public tunnel makes every caller appear to originate from `127.0.0.1`, and therefore permits remote calls from arbitrary locations:
```text
The tunnel delivers requests to BT-Panel with source IP 127.0.0.1.
Setting the allowlist to 127.0.0.1 therefore permits the Agent to call it remotely from any location.
```
The documentation also acknowledges that this arrangement makes the token the only effective protection because the tunnel is publicly reachable.
### Technical Analysis
BT-Panel's source-IP allowlist is intended to restrict API access to explicitly trusted clients. In the documented architecture, an Internet-facing FRP or reverse-proxy tunnel forwards all requests using the loopback source address. BT-Panel therefore cannot distinguish an authorized remote Agent from any other caller able to reach the public tunnel.
Using `127.0.0.1` as the default allowlist entry is normally safe only when the API is genuinely local. Here, the tunnel converts untrusted remote traffic into apparently local traffic, eliminating that security boundary and leaving possession of the API token as the sole effective authorization factor.
### Attack Path
1. The administrator runs `enable_api.py` without an explicit allowlist argum
...[truncated 902 chars]
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
Location
scripts/enable_api.py:23
Finding
Privileged Setup Script Decrypts and Prints the Panel API Token in Plaintext
Content
View full analysis
Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
Location
scripts/bt_api.py:91
Finding
Unrestricted Raw API Mode Permits Arbitrary Privileged Panel and File Operations
If the underlying skill/code enables BT-Panel API access, modifies whitelist settings, or retrieves plaintext tokens while presenting itself as a normal operations wrapper, that is a serious trust-boundary violation. Exposing or manipulating API credentials and security configuration can grant full administrative control of internet-reachable server panels, especially given the skill text explicitly states the token is the 'only defense' and that 127.0.0.1 whitelisting enables remote use via the tunnel.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
If the underlying skill/code enables BT-Panel API access, modifies whitelist settings, or retrieves plaintext tokens while presenting itself as a normal operations wrapper, that is a serious trust-boundary violation. Exposing or manipulating API credentials and security configuration can grant full administrative control of internet-reachable server panels, especially given the skill text explicitly states the token is the 'only defense' and that 127.0.0.1 whitelisting enables remote use via the tunnel.
Content
No source excerpt is available for this finding.
Vague Triggers
High
Category
Not specified by scanner
Confidence
95% confidence
Finding
The trigger phrases are broad ('管一下服务器', 'bt panel', '宝塔面板') and can cause this high-privilege remote administration skill to be selected for vague requests. In this context the danger is elevated because the skill can perform write actions against production infrastructure and even invoke arbitrary BT-Panel API endpoints via the raw interface.
Content
No source excerpt is available for this finding.
Missing User Warnings
High
Category
Not specified by scanner
Confidence
99% confidence
Finding
TLS certificate verification and hostname checks are fully disabled, enabling man-in-the-middle interception of authenticated BT-Panel API traffic. Because this tool manages production infrastructure using panel credentials, an attacker on the network path could steal auth material, observe administrative actions, or modify requests and responses to take over servers.
Content
No source excerpt is available for this finding.
Missing User Warnings
High
Category
Not specified by scanner
Confidence
98% confidence
Finding
The script silently enables the API, updates whitelist settings, and emits the plaintext token without any interactive warning, confirmation, or secondary authorization. This combination turns a convenience helper into a high-risk privilege-escalation and secret-exfiltration mechanism, especially in an agent skill context where actions may be triggered indirectly or wrapped by automation.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
High
Category
Not specified by scanner
Confidence
99% confidence
Finding
The code decrypts or directly reads the BT-Panel API token and prints the plaintext token to stdout, creating an explicit credential-extraction path. Plaintext admin API tokens are highly sensitive secrets; once exposed through logs, terminal history, wrappers, or other tooling, they can be reused to fully control the panel and potentially all managed infrastructure.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The README explicitly broadens the operational model from BT-Panel API control to SSH-based arbitrary command execution. In a server-administration skill, that materially increases capability from structured panel actions to unrestricted remote execution, which can enable destructive actions, persistence, or full host compromise if the skill or its credentials are abused.
Content
No source excerpt is available for this finding.
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
84% confidence
Finding
The documented setup requires running a local script with sudo against BT-Panel's internal Python environment to enable the API and reveal the plaintext token. While privileged administration is sometimes necessary, embedding a root-required bootstrap path in a skill increases the blast radius of mistakes or abuse, especially when it changes authentication state and exposes credentials.
Content
Scanner excerpt · README.md (reported line 33)May include surrounding context.
且 set_token 里 if 'request_token' in get: return '不能通过API接口配置API' —— 不能用 API 去开 API（鸡生蛋）。
The documentation recommends exposing panel access remotely through FRP/Nginx while relying on a localhost whitelist because traffic arrives as 127.0.0.1. That effectively defeats source-IP access control and makes the token the sole barrier for a publicly reachable administrative interface, substantially increasing exposure if the token leaks or the tunnel/proxy is misconfigured.
Content
No source excerpt is available for this finding.
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content
Scanner excerpt · README.md (reported line 52)May include surrounding context.
The skill performs privileged network-based server administration but does not declare any tool scope or permission boundaries. In practice this leaves a powerful remote-control skill under-specified, increasing the chance that an agent invokes network access and administrative actions without explicit governance or user-visible restriction.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
This reference doc exposes highly sensitive file and log access endpoints, including arbitrary file read and write capabilities, but only labels them as '谨慎' without clearly warning about privacy, credential exposure, or full-host compromise risk. In the context of a server administration skill with stored panel credentials and support for arbitrary BT API calls, this materially lowers the barrier to reading secrets, modifying configs, or implanting persistence.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The comment suggests writes require explicit invocation, but the 'raw' mode lets callers hit any BT-Panel endpoint with arbitrary parameters, including destructive administrative actions. In this skill context, that mismatch is especially dangerous because users or higher-level agents may rely on the comment and assume the tool is mostly read-only when it is actually a full privileged control surface.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding
The file defines write-effecting operations that can change service availability by stopping or starting sites. Although a comment notes that write operations require explicit calls, there is no user-facing confirmation prompt, warning message, or CLI disclosure before executing these potentially disruptive actions.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
This helper script programmatically enables the BT-Panel API, modifies the IP whitelist, and then retrieves credential material from the panel configuration. In an ops skill, this expands access beyond routine administration into security-boundary reconfiguration and secret handling, which is dangerous because anyone able to invoke or reuse the script can widen API exposure and obtain reusable access to the panel.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
84% confidence
Finding
The title and surrounding documentation are entirely in Chinese, which implies a fixed language for operating the skill. Under the stated policy, locale or language constraints should either offer user opt-in or be clearly justified as region-specific; this file does neither.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
76% confidence
Finding
Documenting immediate task execution as a routine endpoint without a prominent warning can encourage unsafe invocation of scheduled jobs whose side effects may be disruptive, destructive, or externally visible. Because this skill is designed for live multi-panel operations on production servers, triggering a cron task on demand could execute backups, deployment hooks, cleanup jobs, or custom scripts at unsafe times.
Content
No source excerpt is available for this finding.
Dynamic attribute access via getattr()
Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
Content
Scanner excerpt · scripts/bt_api.py (reported line 99)May include surrounding context.
python
if a.cmd == "raw":
out = bt.call(a.endpoint, json.loads(a.params))
elif a.cmd in ("site_stop", "site_start"):
out = getattr(bt, a.cmd)(a.id, a.name)
else:
out = getattr(bt, a.cmd)()
print(json.dumps(out, ensure_ascii=False, indent=2))
Dynamic attribute access via getattr()
Low
Category
Dangerous Code Execution
Confidence
84% confidence
Finding
This getattr(bt, a.cmd)() call allows any attribute name provided on the command line to be invoked as a zero-argument method on the BtPanel object. In the skill context, this is more dangerous because the tool wraps administrative server controls and reads credentials from a local config, so unexpected method exposure or crashes can affect privileged infrastructure operations.
Content
Scanner excerpt · scripts/bt_api.py (reported line 101)May include surrounding context.
python
elif a.cmd in ("site_stop", "site_start"):
out = getattr(bt, a.cmd)(a.id, a.name)
else:
out = getattr(bt, a.cmd)()
print(json.dumps(out, ensure_ascii=False, indent=2))
