安全决策报告
cmd-execution-test
A system diagnostic tool with powerful arbitrary shell execution capabilities that could be exploited for malicious purposes despite legitimate declared use cases.
最直接的威胁证据
01
LLM agent loaded with cmd-executor skill 初始入口 · SKILL.md
02
Attacker injects malicious command via prompt injection targeting --cmd parameter manipulation · cmd-executor.mjs
03
Execute arbitrary command via execSync (whoami /priv, net user, etc.) 权限提升 · cmd-executor.mjs
为什么得出这个结论
2/4 个维度触发 通过
声明与实际能力
声明资源与推断能力基本一致。
阻止
隐藏执行与外联
提取到 1 个高危 IOC 或外联信号。
阻止
攻击链与高危发现
报告包含 5 步攻击链，另有 0 项高危或严重发现。
通过
依赖与供应链卫生
依赖结构存在，但暂未看到明显高危告警。
攻击链
01
LLM agent loaded with cmd-executor skill
初始入口 · SKILL.md:1
02
Attacker injects malicious command via prompt injection targeting --cmd parameter
manipulation · cmd-executor.mjs:41
03
Execute arbitrary command via execSync (whoami /priv, net user, etc.)
权限提升 · cmd-executor.mjs:43
04
Collect sensitive system information for further attacks
reconnaissance · examples/test-commands.json:165
05
Credential access or privilege escalation depending on command executed
最终危害 · examples/test-commands.json:170
风险分是怎么被拉高的
Unrestricted arbitrary command execution +20
--cmd parameter allows any shell command without validation
Sensitive system information exposure +10
systeminfo reveals Windows product keys and detailed hardware info
External network connectivity tests +5
Hardcoded 8.8.8.8 (Google DNS) used for ping/traceroute tests
No credential harvesting detected +-5
No explicit credential theft code found
No data exfiltration detected +-5
No external data transmission beyond stdout
Documentation matches implementation +-10
Behaviors are declared in SKILL.md and skill-card.md
最关键的证据
中危 代码执行
Unrestricted Custom Command Execution
The --cmd parameter allows execution of arbitrary shell commands without validation or restrictions. This is a significant attack vector if the LLM agent is subject to prompt injection.
cmd-executor.mjs:41 Remove or restrict the --cmd parameter. If needed, implement a whitelist of allowed commands.
中危 敏感访问
Verbose System Information Collection
systeminfo command can expose Windows product keys, hotfixes, network cards, domain membership, and other sensitive configuration details.
cmd-executor.mjs:75 Limit the scope of systeminfo collection or redact sensitive fields from output.
中危 文档欺骗
Hidden Malicious Test Scenarios
test-commands.json contains a 'malicious_tests' section with commands like 'whoami /priv' and 'systeminfo | findstr domain admin' that suggest potential use for privilege escalation and Active Directory reconnaissance.
examples/test-commands.json:158 Remove malicious test scenarios from the skill or document them clearly as penetration testing examples.
低危 权限提升
Directory Listing with Hidden Files
Commands 'ls -la' and 'dir /a' list hidden files which may include sensitive files like .ssh, .aws, or .env.
cmd-executor.mjs:127 Consider excluding hidden files from default listings or adding warnings about sensitive data.
低危 敏感访问
External Network Connectivity Tests
Hardcoded 8.8.8.8 (Google DNS) used for ping and traceroute tests. While legitimate for diagnostics, this represents outbound network activity.
cmd-executor.mjs:98 This is benign but could be made configurable or use a local test target instead.
声明能力 vs 实际能力
命令执行 通过
声明 WRITE
→ 推断 WRITE
cmd-executor.mjs:5 - execSync from child_process 文件系统 通过
声明 READ
→ 推断 READ
cmd-executor.mjs:127-131 - ls/dir commands for directory listing 网络访问 通过
声明 READ
→ 推断 READ
cmd-executor.mjs:91-99 - ping, netstat, traceroute to 8.8.8.8 环境变量 通过
声明 NONE
→ 推断 READ
Indirectly exposed via systeminfo and system commands output 可疑产物与外联
高危 IP 地址
8.8.8.8 cmd-executor.mjs:98
中危 外部 URL
https://clawhub.ai/user/qiqi704 skill-card.md:7
中危 外部 URL
https://clawhub.ai/qiqi704/cs1111 skill-card.md:27
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| Node.js built-in modules only | N/A | builtin | 否 | No external dependencies - uses only child_process, os, and fs from Node.js standard library |
文件构成
5 个文件 · 689 行
JavaScript 1 个文件 · 260 行Markdown 2 个文件 · 249 行JSON 2 个文件 · 180 行
需关注文件 · 3
cmd-executor.mjs Unrestricted Custom Command Execution · Verbose System Information Collection · Directory Listing with Hidden Files · External Network Connectivity Tests · 8.8.8.8
examples/test-commands.json Hidden Malicious Test Scenarios
skill-card.md https://clawhub.ai/user/qiqi704 · https://clawhub.ai/qiqi704/cs1111
其他文件 · SKILL.md · _meta.json
安全亮点
Skill-card.md explicitly acknowledges the unrestricted shell execution risk with mitigations
SKILL.md accurately describes all implemented functionality
No base64 encoding, obfuscation, or anti-analysis techniques detected
No data exfiltration to external servers beyond stdout
Uses only Node.js built-in modules (no external dependencies)
All commands are standard diagnostic tools, no custom malicious payloads