Security audit

Aegis Protocol

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a genuine monitoring and recovery skill, but it can automatically kill sessions, restart services, inspect broad host state, and make external network probes with limited user safeguards.

Install only if you want an agent skill with system-level monitoring and remediation authority. Review the source and configuration first, run `status` or `check` before `heal`, avoid unattended cron-based `heal` on production systems until thresholds and whitelists are validated, and be aware that full mode makes external network probes despite some documentation claiming otherwise.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: def exec_cmd(cmd: str, timeout: int = 30, raise_on_error: bool = False) -> Tuple[int, str, str]: """执行 shell 命令""" try: result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout) if raise_on_error and result.returncode != 0: raise ExternalCommandError(cmd, result.returncode, result.stderr) return result.returncode, result.stdout, result.stderr
Confidence: 98% confidence
Finding: The helper executes arbitrary shell strings with shell=True, creating a generic command-execution sink. In this file, some callers interpolate variable data such as session keys, service names, hosts, and filesystem paths into command strings, so if any of those values are attacker-controlled or malformed, they can trigger shell injection or unintended command chaining.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill presents itself as a stability monitor, but the described behavior reaches well beyond passive monitoring into host inspection, persistent file writes, service management, session termination, and restarts. That mismatch is dangerous because users may invoke it expecting diagnostics while granting a skill broad authority to alter system state and inspect sensitive host context.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The document makes absolute safety claims such as 'No network exfiltration' and 'No external network calls' while also instructing reviewers to verify that socket usage exists for an SSL certificate check. Even if the socket use is limited or localhost-only, the contradictory statements undermine the trustworthiness of the security claims and can mislead reviewers into underestimating network-capable behavior.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The skill presents itself as an AI-agent stability monitor, but full mode performs broad host inspection including SSL, Docker, network, Git, package updates, open files, connections, and backups. This expands the observable system surface and can expose sensitive environmental metadata beyond the declared purpose, violating least privilege and increasing reconnaissance value if the skill is invoked in a shared or untrusted environment.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The code performs outbound network probing, including pinging external IPs/domains and opening TLS connections to a hardcoded domain. In restricted or sensitive deployments, these probes can leak network reachability, trigger policy violations, or be abused as unintended egress and reconnaissance behavior unrelated to the core monitoring promise.

Context-Inappropriate Capability

Low

Confidence: 82% confidence
Finding: Inspecting Git status and package update availability is outside the stated self-healing stability purpose and reveals repository and package-management state. While not directly code execution, this broadens information disclosure and can provide useful host intelligence to an attacker or an over-privileged agent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The guide includes commands that delete published versions and Git tags, but it does not clearly warn that these actions are destructive, potentially irreversible, and may disrupt users or release automation. In an agent-oriented skill ecosystem, such commands could be copied or executed by operators with elevated permissions, increasing the chance of accidental damage.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README advertises automatic recovery actions such as killing sessions and restarting services, but it does not clearly warn users that these operations are disruptive and can terminate active work, interrupt production traffic, or restart the wrong target if detection is inaccurate. In an agent skill context, normalizing autonomous remediation without explicit safety guidance increases the chance of accidental operational damage through user misuse or over-trust.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The quick-start section includes the `heal` command alongside harmless status commands without distinguishing it as potentially destructive. This can mislead users into executing remediation immediately, causing unexpected session termination or service restarts before they understand the consequences or configuration.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The README recommends scheduling unattended `heal` execution via cron every 10 minutes without warning that repeated automatic remediation may continually kill sessions or restart services. In a monitoring/remediation skill, this raises the risk of persistent self-inflicted denial of service, flapping, and repeated disruption if checks are noisy or misconfigured.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Advertising 'Auto Recovery' without a prominent warning obscures that the skill may terminate sessions, restart services, or otherwise change system state. In a monitoring context, users often expect observability rather than remediation, so the omission increases the risk of accidental disruptive execution on production systems.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The `heal` command is presented as a normal command without an explicit notice that it performs potentially disruptive recovery actions affecting availability and process state. This can lead to unintended service restarts or process termination by users who reasonably assume they are running a benign health check.

Missing User Warnings

High

Confidence: 97% confidence
Finding: heal() automatically kills sessions and restarts services based on heuristic checks, with no confirmation, authorization step, dry-run mode, or explicit safety interlock. In an agent context, this can cause denial of service, interrupt legitimate work, destroy session state, and turn false positives into destructive actions on production infrastructure.

Static analysis

No suspicious patterns detected.