Security audit

Prometheus

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Prometheus query tool, but its credential handling is broad enough that users should review it before installing.

Install only if you are comfortable with this skill reading local .env files, storing Prometheus credentials in plaintext config, and using environment Basic Auth credentials as fallbacks for configured instances. Prefer per-instance credentials, restrict config file permissions, avoid running it from untrusted project directories, and do not use --all with mixed-trust Prometheus endpoints until credential scoping is fixed.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/common.js:160
Finding: Global Basic Auth credentials may be disclosed to unrelated Prometheus instances
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/cli.js:126
Finding: The configuration wizard stores passwords in plaintext without enforcing restrictive file permissions
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/common.js:36
Finding: The CLI imports all variables from workspace and current-directory .env files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (31)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
md
node scripts/cli.js init

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.
md
node scripts/cli.js init

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.js (reported line 32)May include surrounding context.
js
} /** * Load environment variables from .env file */ function loadEnvFile() { if (envLoaded) return;

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.js (reported line 66)May include surrounding context.
js
} /** * Load environment variables from .env file */ function loadEnvFile() { if (envLoaded) return;

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.js (reported line 81)May include surrounding context.
js
} /** * Load environment variables from .env file */ function loadEnvFile() { if (envLoaded) return;

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: The code automatically loads a .env file from the workspace root, which may contain secrets, without any trust boundary checks or user opt-in. In an agent/skill context, workspace contents can be influenced by external tasks or repositories, so implicit secret loading can cause credential confusion and unintended use of attacker-supplied Prometheus endpoints or credentials.
Content: Scanner excerpt · scripts/common.js (reported line 39)May include surrounding context.
js
const workspaceDir = getWorkspaceDir(); const envPaths = [ join(workspaceDir, '.env'), join(process.cwd(), '.env'), ];

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: Loading .env from process.cwd() is especially risky because the current working directory is often caller-controlled in CLI/agent environments. An attacker who can place a .env in the execution directory can inject PROMETHEUS_URL, PROMETHEUS_USER, or PROMETHEUS_PASSWORD values, redirecting requests and causing credential disclosure via Basic Auth to an attacker-controlled server.
Content: Scanner excerpt · scripts/common.js (reported line 40)May include surrounding context.
js
const workspaceDir = getWorkspaceDir(); const envPaths = [ join(workspaceDir, '.env'), join(process.cwd(), '.env'), ]; for (const envPath of envPaths) {

Static analysis

No suspicious patterns detected.