modelaudit-llamafile-devtcp-c2-blindspot-poc

PoC - modelaudit llamafile scanner /dev/tcp fileless-C2 blind spot (BL-0116)

Coordinated disclosure PoC for huntr (Protect AI MFV). Benign, localhost-only markers.

• Scanner: modelaudit==0.2.49 (llamafile_scanner.py). Format: Llamafile (.llamafile, an APE polyglot executable + GGUF).
• modelaudit scan evasion_devtcp_revshell.llamafile -> Clean / exit 0: the APE shell stub establishes C2 via bash /dev/tcp (the canonical fileless reverse-shell primitive), which produces neither a command nor a network signal, because the scanner's NETWORK_TOKENS list omits /dev/tcp and /dev/udp. The byte-equivalent intent as curl ... | sh (control_curl_pipe_sh.llamafile) is correctly flagged CRITICAL - positive control. nc -e reverse shells are missed the same way.
• Root cause: llamafile_scanner.py:389-395 NETWORK_TOKENS omits /dev/tcp,/dev/udp; :362-372 command indicators miss socket-FD shells; :3055-3066 _runtime_text_signals returns (False,False) -> no finding.
• Benign: the stub connects to 127.0.0.1 only and sends a marker; no external egress. Distinct from GGUF findings (this is the executable-stub runtime analysis, not the embedded model).

Files: evasion_devtcp_revshell / evasion_devtcp_exfil / evasion_nc_revshell (bypass), control_curl_pipe_sh / control_bash_dash_c (fire), baseline_clean (true-negative). Full report in huntr submission.