T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/install-server-env.sh:36- Finding
Unverified Remote NodeSource Scripts Are Executed Directly by Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
Auto Deploy
Security checks for vulnerabilities and agentic risk
Overview
This deployment skill fits its stated purpose, but it embeds credentials and uses root-level deployment scripts with unsafe SSH and deletion behavior that require careful review before use.
Do not install this as-is for any reachable or production server. Rotate any exposed Git or SSH/root passwords, remove real credentials from the package and history, use a non-root deploy account, require verified host keys and HTTPS/SSH Git transport, validate all paths and branch/backup inputs, and add explicit approval before deploy or rollback.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (9)
T09 · Insecure Skill Coding Practices
Error
- Location
deploy-config.json:2- Finding
Reusable Git and Root Server Credentials Are Hardcoded in the Skill
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/deploy.sh:17- Finding
Git Credentials Are Sent over Plain HTTP and Embedded in the Clone URL
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/deploy.sh:51- Finding
Unquoted Deployment Inputs Permit Command Injection in a Remote Root Shell
- Content
View full analysis
/tmp/deploy-commit.txt echo "\$COMMIT_MSG" >> /tmp/deploy-commit.txt EOF ``` ```bash BACKUP_NAME="points_$(date +%Y%m%d_%H%M%S)" ssh -i "$SSH_KEY" -p "$SERVER_PORT" "$SERVER_USER@$SERVER_HOST" << EOF mkdir -p $BACKUP_PATH if [ -d "$DEPLOY_PATH" ] && [ "\$(ls -A $DEPLOY_PATH)" ]; then cp -r $DEPLOY_PATH $BACKUP_PATH/$BACKUP_NAME echo "Backup complete: $BACKUP_PATH/$BACKUP_NAME" else echo "First deployment; creating directory..." mkdir -p $DEPLOY_PATH fi EOF ``` ```bash ssh -i "$SSH_KEY" -p "$SERVER_PORT" "$SERVER_USER@$SERVER_HOST" << EOF set -e echo " [1/3] Extracting deployment package..." rm -rf $DEPLOY_PATH/* tar -xzf /tmp/points-deploy.tar.gz -C $DEPLOY_PATH ``` ### Technical Analysis Values read from `deploy-config.json` and the positional branch argument are interpolated locally into unquoted SSH heredocs. The resulting text is then parsed as shell code by the remote server. Shell metacharacters in a branch name or configuration value can therefore terminate the intended command and introduce additional commands. The most dangerous values include the branch argument, deployment path, and backup path. The configured SSH user is `root`, so injected commands execute with unrestricted administrative authority. Unsafe path interpolation also mean ...[truncated 1012 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/rollback.sh:21- Finding
Rollback Version Input Permits Root Command Injection and Unsafe Deletion
- Content
View full analysis
/dev/null || systemctl stop points-service 2>/dev/null || true echo "Restoring backup..." rm -rf $DEPLOY_PATH/* cp -r $BACKUP_PATH/$BACKUP_NAME/* $DEPLOY_PATH/ echo "Starting service..." pm2 start points 2>/dev/null || systemctl start points-service 2>/dev/null || true echo "Rollback complete" EOF ``` ### Technical Analysis `BACKUP_NAME` can come directly from the first command-line argument or from untrusted filenames returned by the remote backup directory. It is interpolated without quoting into an expandable heredoc and parsed by the remote shell. The deployment and backup paths are also used without safe quoting. The script deletes deployment contents before establishing that the requested backup exists, is a directory, is located beneath the approved backup root, and can be restored successfully. User confirmation does not neutralize shell syntax and does not make the operation safe. ### Attack Path 1. An attacker or compromised automation caller supplies a crafted backup name to `rollback.sh`. 2. The operator confirms ...[truncated 700 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.sh:59- Finding
SSH Host Authentication Is Explicitly Disabled During Trust Establishment
- Content
View full analysis
/dev/null; then echo "SSH connection successful" else echo "SSH connection failed; check:" echo " 1. Whether the server IP is correct" echo " 2. Whether the SSH port is open" echo " 3. Whether the public key was added to the server" echo "" read -p "Continue configuration? (y/n): " continue_config if [ "$continue_config" != "y" ]; then exit 1 fi fi ``` The documentation also recommends: ```bash sshpass -p 'zhangjiamin' ssh-copy-id -o StrictHostKeyChecking=no -i ~/.ssh/server_deploy.pub root@192.168.1.168 ``` ### Technical Analysis `StrictHostKeyChecking=no` removes the interactive host-identity verification that protects SSH against server impersonation during initial connection. The unsafe `sshpass` variant combines disabled host verification with a plaintext root password, allowing a man-in-the-middle server to collect that password. Even when a private key is used instead of a password, connecting to an unverified host can disclose operational metadata and cause the deployment key to be installed or used against the wrong destination. ### Attack Path 1. An attacker gains a network position between the deployment client and the configured server or redirects the destination through routing or address manipulation. 2. The attacker presents a different SSH host key. 3. The client accepts it because strict host-key verification is disabled. 4. In the documented password flow, the client sends the roo ...[truncated 470 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
README.md:98- Finding
Deployment Architecture Grants Excessive Root and Elevated Command Authority
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
scripts/deploy.sh:75- Finding
Unpinned Dependencies and Build Hooks Execute on the Production Server
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/configure-ssh-manual.sh:15- Finding
Manual SSH Configuration Script Starts an Endless Remote Command and Mishandles the Password
- Content
View full analysis
> ~/.ssh/authorized_keys chmod 700 ~/.ssh chmod 600 ~/.ssh/authorized_keys echo "SSH key configuration complete" exit EOF ``` ### Technical Analysis An SSH heredoc supplies standard input to the remote shell only after SSH authentication. It cannot reliably answer SSH’s local interactive host-key or password prompts. If authentication succeeds through an existing method, the first remote command is `yes`, which continuously prints output and does not terminate. The subsequent password and authorization commands will therefore normally never run. If execution somehow proceeds beyond `yes`, the plaintext password is treated as a remote shell command rather than authentication input. This is both functionally incorrect and unsafe. The script also attempts to modify root’s `authorized_keys`, creating broad reusable access rather than a restricted deployment credential. ### Attack Path 1. A user runs the manual configuration script. 2. SSH authentication succeeds through an existing key, agent, or cached mechanism. 3. The remote shell executes `yes`. 4. `yes` emits output indefinitely and prevents later commands in the heredoc from executing. 5. The session consumes network, terminal, and process resources until manually terminated. 6. The intended key configuration remains incomplete or inconsistent. ### Impact Assessment The immediate impact is denial of service for the SSH session, unnecessary remote resource consumption, and failed key provisioning. Operational recovery may lead users to repeat insecure password handling or manually alter root’s authorization files. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (80)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The README advertises that a plain-language request will cause end-to-end development and deployment, but it does not prominently warn users that live systems may be modified. In this context, missing warnings materially increase the chance of accidental production changes, unauthorized deployment, or social-engineered triggering by benign-looking requests.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The README instructs adding a deployment key to root's authorized_keys, granting persistent remote login capability to the root account. In an automation skill with deployment privileges, compromise of the corresponding private key would immediately yield full server control, greatly increasing blast radius.
- Content
方式 B：手动添加
cat ~/.ssh/server_deploy.pub
复制内容，登录服务器后执行：
mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys
text ### 1.3 验证 SSH 连接
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The rollback procedure performs destructive deletion of the deployment directory contents and service interruption without a prominent warning about downtime, data loss, or path-safety requirements. If the path is wrong, empty, or manipulated, the deletion step can destroy critical files on the remote server.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
This exact command, rm -rf /www/wwwroot/points/*, is a destructive operation against a live deployment path. If executed against the wrong host or path, or if the rollback copy step fails after deletion, it can leave the service unavailable and destroy deployed contents irreversibly.
- Content
md # 恢复备份 ssh user@server << EOF systemctl stop points-service rm -rf /www/wwwroot/points/* cp -r /www/backup/$BACKUP/* /www/wwwroot/points/ systemctl start points-service EOF
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
This exact command, rm -rf /www/wwwroot/points/*, is a destructive operation against a live deployment path. If executed against the wrong host or path, or if the rollback copy step fails after deletion, it can leave the service unavailable and destroy deployed contents irreversibly.
- Content
md # 恢复备份 ssh user@server << EOF systemctl stop points-service rm -rf /www/wwwroot/points/* cp -r /www/backup/$BACKUP/* /www/wwwroot/points/ systemctl start points-service EOF
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document discloses a plaintext root password and explicitly instructs password-based SSH access, including use of sshpass and disabled host key checking. This creates immediate credential exposure risk, enables unauthorized root access if the file is leaked, and normalizes insecure operational practices in a deployment workflow.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script hardcodes the root SSH password in plaintext and uses it in a security-sensitive workflow. Any user with access to the file, logs, backups, or source repository can recover the credential and use it for unauthorized server access, especially because the target account is root.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh SERVER_IP="192.168.1.168" SERVER_USER="root" SERVER_PASSWORD="zhangjiamin" SSH_KEY_PUB="/home/node/.ssh/server_deploy.pub" # 读取公钥 PUBLIC_KEY=$(cat $SSH_KEY_PUB)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js SERVER_IP="192.168.1.168" SERVER_USER="root" SERVER_PASSWORD="zhangjiamin" SSH_KEY_PUB="/home/node/.ssh/server_deploy.pub" # 读取公钥 PUBLIC_KEY=$(cat $SSH_KEY_PUB)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Appending a key to ~/.ssh/authorized_keys grants persistent SSH access to the remote account, which here is root. In an agent skill context, this is especially dangerous because it establishes durable remote access and closely matches common persistence and backdoor techniques if done without strong operator controls.
- Content
sh yes $SERVER_PASSWORD mkdir -p ~/.ssh echo "$PUBLIC_KEY" >> ~/.ssh/authorized_keys chmod 700 ~/.ssh chmod 600 ~/.ssh/authorized_keys echo "✅ SSH Key 配置完成"
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 98% confidence
- Finding
The script injects a public key into root's authorized_keys on a remote host, creating persistent privileged access. In the absence of safeguards, approvals, host authenticity checks, or any limiting controls, this behavior is highly consistent with backdoor persistence techniques and is especially dangerous in an agent-executable skill.
- Content
sh #!/bin/bash # 使用 SSH 密码连接并配置公钥 SERVER_IP="192.168.1.168" SERVER_USER="root" SERVER_PASSWORD="zhangjiamin" SSH_KEY_PUB="/home/node/.ssh/server_deploy.pub" # 读取公钥 PUBLIC_KEY=$(cat $SSH_KEY_PUB) echo "🔑 正在配置 SSH Key 到服务器..." echo "" # 使用 ssh 命令配合密码输入 ssh ${SERVER_USER}@${SERVER_IP} << EOF yes $SERVER_PASSWORD mkdir -p ~/.ssh echo "$PUBLIC_KEY" >> ~/.ssh/authorized_keys chmod 700 ~/.ssh chmod 600 ~/.ssh/authorized_keys echo "✅ SSH Key 配置完成" exit EOF
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md mkdir -p ~/.ssh echo "$PUBLIC_KEY" >> ~/.ssh/authorized_keys chmod 700 ~/.ssh chmod 600 ~/.ssh/authorized_keys echo "✅ SSH Key 配置完成" exit EOF
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md mkdir -p ~/.ssh echo "$PUBLIC_KEY" >> ~/.ssh/authorized_keys chmod 700 ~/.ssh chmod 600 ~/.ssh/authorized_keys echo "✅ SSH Key 配置完成" exit EOF
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh mkdir -p ~/.ssh echo "$PUBLIC_KEY" >> ~/.ssh/authorized_keys chmod 700 ~/.ssh chmod 600 ~/.ssh/authorized_keys echo "✅ SSH Key 配置完成" exit EOF
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh mkdir -p ~/.ssh echo "$PUBLIC_KEY" >> ~/.ssh/authorized_keys chmod 700 ~/.ssh chmod 600 ~/.ssh/authorized_keys echo "✅ SSH Key 配置完成" exit EOF
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script hardcodes a root SSH password and uses Expect to automate password-based authentication for
ssh-copy-id. Storing and transmitting privileged credentials in plaintext makes secret disclosure likely through source control, logs, backups, or local file access, and compromise of this password grants direct root access to the target host.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
A hardcoded password is embedded directly in the script and then used for authentication. Plaintext secrets in code are highly exposed to anyone with repository, filesystem, backup, or artifact access, and here the secret protects a root account, making the blast radius especially severe.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The script executes rm -rf $DEPLOY_PATH/* on the remote host without quoting or validating DEPLOY_PATH. If deploy-config.json is incorrect, maliciously modified, or contains shell metacharacters/command substitutions, this can delete unintended paths or lead to command injection on the target server, making the deployment context significantly more dangerous because it runs over SSH against production infrastructure.
- Content
sh set -e echo " [1/3] 解压部署包..." rm -rf $DEPLOY_PATH/* tar -xzf /tmp/points-deploy.tar.gz -C $DEPLOY_PATH echo " [2/3] 停止旧服务..."
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md fi # 清理临时文件 rm /tmp/points-deploy.tar.gz EOF log_info "部署完成"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh fi # 清理临时文件 rm /tmp/points-deploy.tar.gz EOF log_info "部署完成"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh COMMIT_MSG=$(echo "$COMMIT_INFO" | tail -1) # 清理 ssh -i "$SSH_KEY" -p "$SERVER_PORT" "$SERVER_USER@$SERVER_HOST" "rm -f /tmp/deploy-commit.txt" # 部署完成摘要 echo ""
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The script interpolates unquoted variables into a remote shell here-document and then executes a destructive command,
rm -rf $DEPLOY_PATH/*. Ifdeploy-config.jsonor the backup name is malformed, empty, or attacker-controlled, shell expansion or path confusion could cause deletion of unintended directories on the remote host; the same issue affects the restore copy command using$BACKUP_NAME. The skill context makes this more dangerous because it is an operational deployment script that runs against production-like infrastructure over SSH with file deletion and service control privileges.- Content
sh pm2 stop points 2>/dev/null || systemctl stop points-service 2>/dev/null || true echo "恢复备份..." rm -rf $DEPLOY_PATH/* cp -r $BACKUP_PATH/$BACKUP_NAME/* $DEPLOY_PATH/ echo "启动服务..."
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
sh echo "✅ 使用现有 SSH Key" fi else echo "生成新的 SSH Key..." ssh-keygen -t ed25519 -C "openclaw-server" -f ~/.ssh/server_deploy -N "" fi echo "" echo "📋 公钥内容（复制添加到服务器）：" echo "----------------------------------------" cat ~/.ssh/server_deploy.pub echo "----------------------------------------" echo "" echo "请登录服务器执行：" echo " mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys" echo " 然后粘贴上面的公钥内容，按 Ctrl+D 结束" echo "" read -p "按回车继续..." # 步骤 2：配置服务器信息 echo "" echo "📌 步骤 2/4: 配置服务器信息" echo "" read -p "服务器 IP 地址： " SERVER_IP read -p "SSH 端口（默认 22）： " SERVER_PORT SERVER_PORT=${SERVER_PORT:-22} read -p "SSH 用户（默认 root）： " SERVER_USER SERVER_USER=${SERVER_USER:-root} read -p "部署路径（默认 /www/wwwroot/points）： " DEPLOY_PATH DEPLOY_PATH=${DEPLOY_PATH:-/www/wwwroot/points} read -p "�
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script hardcodes a root username, server IP, and plaintext password, then prints them along with instructions for logging in and installing an SSH key for persistent access. Even on a private LAN, exposing privileged credentials and encouraging root-level key enrollment creates a serious risk of credential leakage, unauthorized access, and later persistence.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
Appending a key into ~/.ssh/authorized_keys is a direct mechanism for establishing trusted remote access. In this script, the operation is explicitly tied to a root login workflow, making it a privileged persistence vector if performed by an unauthorized user or under misleading instructions.
- Content
js console.log('2️⃣ 在服务器上执行:'); console.log(' mkdir -p ~/.ssh'); console.log(' echo "' + publicKey + '" >> ~/.ssh/authorized_keys'); console.log(' chmod 700 ~/.ssh'); console.log(' chmod 600 ~/.ssh/authorized_keys'); console.log(' exit');