Security audit

opengis-skills

Security checks for vulnerabilities and agentic risk

Overview

This is a broad documentation skill set, but it needs review because some examples tell agents to run unverified installers and perform powerful admin actions without enough safety guardrails.

Review before installing or using with an autonomous agent. Do not run the BillionMail curl-to-bash installer as written; prefer a pinned release or Docker Compose flow after inspecting code. Change GeoServer default credentials before any network exposure, require confirmation and backups before recurse deletes, sandbox OpenClaw or disable shell by default, and treat geocoding, RAG uploads, webhooks, and API calls as potentially sending sensitive data to external services.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: others/billionmail/SKILL.md:47
Finding: Unverified Remote Installer Is Piped Directly into Bash
Content: View full analysis
Vulnerability Details

File Location: others/billionmail/SKILL.md, line 47
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Complete Code Snippet:

bash
curl -sSL https://www.billionmail.com/install.sh | bash

Technical Analysis

The deployment instructions retrieve a shell script from an external URL and pass the response directly to Bash. This makes the effective code executed by the Skill mutable after review: the remote server, its DNS or hosting infrastructure, or the delivery path could later serve different content.

HTTPS authenticates the connection to the domain under normal certificate assumptions, but it does not establish that the downloaded script is a reviewed, immutable release artifact. The command does not pin a release, verify a cryptographic checksum or signature, save the script for inspection, or request explicit approval after displaying its contents.

Although the URL is associated with the documented BillionMail project, executing a remote response without integrity verification exceeds the minimum privileges necessary to explain or deploy the platform. The same file already provides a safer Docker Compose workflow based on cloning a named repository and reviewing local configuration.

Attack Path

A user or automation agent follows the one-line installation instruction.

curl requests the current response from https://www.billionmail.com/install.sh.

The website, DNS account, certificate issuance path, CDN, or deployment pipeline is compromised, or the publisher changes the script.

The server returns attacker-controlled shell commands.

The pipeline sends those commands directly to Bash without local review or integrity verification.

The commands execute with the privileges of the invoking account. If the user invokes the command as root or the script obtains elevated privileges, system-wide compromise is possi ...[truncated 800 chars]
Remediation: View remediation
Remediation Suggestions

Remove the direct curl | bash pipeline from the Skill.

Prefer the documented Docker Compose installation procedure, and pin the repository to a reviewed release tag or commit rather than an unfixed branch.

If the installer must be supported, use a staged process such as:

Download a versioned installer to a local file.

Obtain its expected SHA-256 digest or signature through a separately authenticated release channel.

Verify the digest or publisher signature.

Review the downloaded script and its requested privileges.

Execute it only after explicit user confirmation.

Publish immutable, versioned installer artifacts and signed checksums in the official release system.

Avoid running the installer as root unless a reviewed operation specifically requires elevation. Use narrowly scoped privilege escalation for individual commands.

Document the ports, directories, services, users, and configuration files that the installer will modify before execution.

Run deployment in an isolated virtual machine or disposable environment first, especially for internet-facing mail infrastructure.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (171)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
每个技能以独立的 `SKILL.md` 文件组织，AI 工具可按需加载，作为「领域知识」注入到对话上下文，从而获得更准确的 API 调用、代码生成、错误排查和最佳实践建议。

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ai/dify/SKILL.md (reported line 36)May include surrounding context.
bash
git clone https://github.com/znlgis/hermes-agent cd hermes-agent cp .env.example .env docker compose up -d # 或本地： pip install -r requirements.txt # 或 pnpm install

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ai/hermes-agent/SKILL.md (reported line 30)May include surrounding context.
bash
git clone https://github.com/znlgis/hermes-agent cd hermes-agent cp .env.example .env docker compose up -d # 或本地： pip install -r requirements.txt # 或 pnpm install

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ai/hermes-agent/SKILL.md (reported line 179)May include surrounding context.
bash
git clone https://github.com/znlgis/hermes-agent cd hermes-agent cp .env.example .env docker compose up -d # 或本地： pip install -r requirements.txt # 或 pnpm install

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ai/oh-my-openagent/SKILL.md (reported line 32)May include surrounding context.
bash
git clone https://github.com/znlgis/hermes-agent cd hermes-agent cp .env.example .env docker compose up -d # 或本地： pip install -r requirements.txt # 或 pnpm install

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ai/openclaw/SKILL.md (reported line 35)May include surrounding context.
bash
git clone https://github.com/znlgis/hermes-agent cd hermes-agent cp .env.example .env docker compose up -d # 或本地： pip install -r requirements.txt # 或 pnpm install

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · csharp/admin-net-frontend/SKILL.md (reported line 73)May include surrounding context.
bash
git clone https://github.com/znlgis/hermes-agent cd hermes-agent cp .env.example .env docker compose up -d # 或本地： pip install -r requirements.txt # 或 pnpm install

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · others/billionmail/SKILL.md (reported line 39)May include surrounding context.
bash
git clone https://github.com/znlgis/hermes-agent cd hermes-agent cp .env.example .env docker compose up -d # 或本地： pip install -r requirements.txt # 或 pnpm install

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · others/billionmail/SKILL.md (reported line 188)May include surrounding context.
bash
git clone https://github.com/znlgis/hermes-agent cd hermes-agent cp .env.example .env docker compose up -d # 或本地： pip install -r requirements.txt # 或 pnpm install

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · ai/hermes-agent/SKILL.md (reported line 159)May include surrounding context.
bash
GET /sessions/{id}/messages?limit=50 DELETE /sessions/{id}

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The combined setting ALLOW_SHELL=true with SHELL_BLACKLIST=rm -rf /,sudo,format signals that arbitrary shell access is expected and protected only by substring-style deny rules. In an autonomous agent that can read tasks and act on them, this greatly increases the chance of prompt-driven destructive commands, bypasses, or misuse against the host environment.
Content: Scanner excerpt · ai/openclaw/SKILL.md (reported line 46)May include surrounding context.
SCREEN_WIDTH=1920 SCREEN_HEIGHT=1080 ALLOW_SHELL=true SHELL_BLACKLIST=rm -rf /,sudo,format SANDBOX_MODE=docker

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The combined setting ALLOW_SHELL=true with SHELL_BLACKLIST=rm -rf /,sudo,format signals that arbitrary shell access is expected and protected only by substring-style deny rules. In an autonomous agent that can read tasks and act on them, this greatly increases the chance of prompt-driven destructive commands, bypasses, or misuse against the host environment.
Content: Scanner excerpt · ai/openclaw/SKILL.md (reported line 46)May include surrounding context.
SCREEN_WIDTH=1920 SCREEN_HEIGHT=1080 ALLOW_SHELL=true SHELL_BLACKLIST=rm -rf /,sudo,format SANDBOX_MODE=docker

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · ai/openclaw/SKILL.md (reported line 140)May include surrounding context.
md
- **沙箱模式**：`docker` / `firejail` / `vm` - **目录白名单**：仅允许读写 `WORKDIR` - **shell 黑名单**：默认禁止 `rm -rf /`、`sudo`、`format` 等 - **网络白名单**：仅允许配置的域名 - **审计日志**：每条操作记录 + 截图

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · ai/openclaw/SKILL.md (reported line 140)May include surrounding context.
md
- **沙箱模式**：`docker` / `firejail` / `vm` - **目录白名单**：仅允许读写 `WORKDIR` - **shell 黑名单**：默认禁止 `rm -rf /`、`sudo`、`format` 等 - **网络白名单**：仅允许配置的域名 - **审计日志**：每条操作记录 + 截图

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · cad/libredwg/SKILL.md (reported line 43)May include surrounding context.
源码

git clone https://github.com/LibreDWG/libredwg ./autogen.sh && ./configure --enable-write && make && sudo make install

text
---

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · cad/libredwg/SKILL.md (reported line 176)May include surrounding context.
md
## 性能与精度 1. 大文件用 `--no-check`、`-O DXFB`（二进制 DXF）减小体积 2. 读取后通过 `dwg_get_BLOCKS_HEADER` 等高层 API，避免遍历所有 objects 3. 写入时显式设置 `dwg.header.version` 4. 检查 `dwg_errstrings` 与 `dwg_set_loglevel` 排查

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: The AI guidance explicitly recommends --no-check as a general acceleration option without restricting it to trusted inputs. Disabling integrity/sanity checks on complex binary formats like DWG can increase exposure to parser crashes, malformed-file handling bugs, or denial-of-service conditions when an agent processes attacker-supplied files.
Content: Scanner excerpt · cad/libredwg/SKILL.md (reported line 198)May include surrounding context.
md
## AI 使用建议 - **推荐工作流模式**：AI 助手应根据场景选择 LibreDWG 的使用层级——简单转换用 CLI（`dwg2dxf`/`dwgread`），数据提取用 JSON/GeoJSON 输出，复杂处理用 C API 或 Python 绑定。写入功能仍在完善，写 DWG 前考虑先写 DXF 再转换。 - **关键注意事项**：① 高版本 DWG（R2021+）不被支持，先用 ODA File Converter 转为 R2010/R2018；② 中文文字编码默认为 ANSI/CP936，读取时可用 `dwgread -c utf8`；③ 写入需编译时启用 `--enable-write`；④ 大文件用 `--no-check` 加速读取。 - **常用代码模式**：CLI 转换：`dwg2dxf -y input.dwg` / `dwgread -O JSON input.dwg -o out.json` / `dwg2SVG input.dwg > out.svg`。C API：`dwg_read_file("input.dwg", &dwg)` → `dwg_get_first_object(&dwg, DWG_TYPE_BLOCK_HEADER)` → 遍历实体 → `dwg_free(&dwg)`。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · csharp/admin-net-frontend/SKILL.md (reported line 74)May include surrounding context.
├── eslint.config.mjs # ESLint 配置 ├── .prettierrc.cjs # Prettier 配置 ├── .env # 通用环境变量 ├── .env.development # 开发环境变量 └── .env.production # 生产环境变量

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · csharp/admin-net-frontend/SKILL.md (reported line 75)May include surrounding context.
├── .prettierrc.cjs # Prettier 配置 ├── .env # 通用环境变量 ├── .env.development # 开发环境变量 └── .env.production # 生产环境变量

text
---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gis/gdal/SKILL.md (reported line 820)May include surrounding context.
md
| `GDAL_VSI_CURL_ALLOWED_EXTENSIONS` | 允许的远程文件扩展名 | `.tif,.tiff,.vrt` | | `AWS_ACCESS_KEY_ID` | AWS 密钥 ID | 用于 S3 访问 | | `AWS_SECRET_ACCESS_KEY` | AWS 密钥 | 用于 S3 访问 | | `GOOGLE_APPLICATION_CREDENTIALS` | Google Cloud 凭证文件 | `/path/to/credentials.json` | ### 使用环境变量

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill advertises network.geocode with provider and user_agent parameters but does not warn that submitted addresses may be transmitted to third-party geocoding services. In an AI-agent context, this can cause unintentional exfiltration of sensitive location data, internal addresses, or user-supplied identifiers to external providers without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The deployment instructions explicitly advertise GeoServer's default administrative credentials admin/geoserver and do not warn users to change them immediately. In a server deployment skill, this is dangerous because users may copy-paste the setup and expose an internet-reachable admin interface with known credentials, enabling full administrative takeover.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The note recommending ?recurse=true for deleting a Workspace or Store mentions a destructive operation without warning about its cascading effects. In GeoServer administration context, this can lead users to unintentionally delete dependent layers, styles, and published resources, causing outages or irreversible data/configuration loss.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · gis/geotools/SKILL.md (reported line 65)May include surrounding context.
md
</properties> <dependencies>  <dependency> <groupId>org.geotools</groupId> <artifactId>gt-main</artifactId>

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly documents and repeatedly uses the default GeoServer administrative credentials admin:geoserver without a strong warning to change them. This normalizes insecure defaults and can directly enable unauthorized administration if users deploy sample configurations unchanged or expose the service beyond localhost.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Ae1

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Chaining Abuse

源码

Tool Parameter Abuse

Tool Parameter Abuse

Credential Access

Credential Access

Credential Access

Missing User Warnings

Missing User Warnings

Missing User Warnings

Hidden Instructions

Missing User Warnings

Static analysis