Aegis Protocol

• Outcome: Review
• Latest audit: May 29, 2026 · 9:31 PM UTC
• Version: 0.12.9

Overview

This appears to be a genuine monitoring and recovery skill, but it can automatically kill sessions, restart services, inspect broad host state, and make external network probes with limited user safeguards.

Install only if you want an agent skill with system-level monitoring and remediation authority. Review the source and configuration first, run `status` or `check` before `heal`, avoid unattended cron-based `heal` on production systems until thresholds and whitelists are validated, and be aware that full mode makes external network probes despite some documentation claiming otherwise.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def exec_cmd(cmd: str, timeout: int = 30, raise_on_error: bool = False) -> Tuple[int, str, str]:
    """执行 shell 命令"""
    try:
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
        if raise_on_error and result.returncode != 0:
            raise ExternalCommandError(cmd, result.returncode, result.stderr)
        return result.returncode, result.stdout, result.stderr

• Confidence: 98% confidence
• Finding: result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill presents itself as a stability monitor, but the described behavior reaches well beyond passive monitoring into host inspection, persistent file writes, service management, session termination, and restarts. That mismatch is dangerous because users may invoke it expecting diagnostics while granting a skill broad authority to alter system state and inspect sensitive host context.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The document makes absolute safety claims such as 'No network exfiltration' and 'No external network calls' while also instructing reviewers to verify that socket usage exists for an SSL certificate check. Even if the socket use is limited or localhost-only, the contradictory statements undermine the trustworthiness of the security claims and can mislead reviewers into underestimating network-capable behavior.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The skill presents itself as an AI-agent stability monitor, but full mode performs broad host inspection including SSL, Docker, network, Git, package updates, open files, connections, and backups. This expands the observable system surface and can expose sensitive environmental metadata beyond the declared purpose, violating least privilege and increasing reconnaissance value if the skill is invoked in a shared or untrusted environment.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code performs outbound network probing, including pinging external IPs/domains and opening TLS connections to a hardcoded domain. In restricted or sensitive deployments, these probes can leak network reachability, trigger policy violations, or be abused as unintended egress and reconnaissance behavior unrelated to the core monitoring promise.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: Inspecting Git status and package update availability is outside the stated self-healing stability purpose and reveals repository and package-management state. While not directly code execution, this broadens information disclosure and can provide useful host intelligence to an attacker or an over-privileged agent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide includes commands that delete published versions and Git tags, but it does not clearly warn that these actions are destructive, potentially irreversible, and may disrupt users or release automation. In an agent-oriented skill ecosystem, such commands could be copied or executed by operators with elevated permissions, increasing the chance of accidental damage.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README advertises automatic recovery actions such as killing sessions and restarting services, but it does not clearly warn users that these operations are disruptive and can terminate active work, interrupt production traffic, or restart the wrong target if detection is inaccurate. In an agent skill context, normalizing autonomous remediation without explicit safety guidance increases the chance of accidental operational damage through user misuse or over-trust.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The quick-start section includes the `heal` command alongside harmless status commands without distinguishing it as potentially destructive. This can mislead users into executing remediation immediately, causing unexpected session termination or service restarts before they understand the consequences or configuration.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The README recommends scheduling unattended `heal` execution via cron every 10 minutes without warning that repeated automatic remediation may continually kill sessions or restart services. In a monitoring/remediation skill, this raises the risk of persistent self-inflicted denial of service, flapping, and repeated disruption if checks are noisy or misconfigured.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Advertising 'Auto Recovery' without a prominent warning obscures that the skill may terminate sessions, restart services, or otherwise change system state. In a monitoring context, users often expect observability rather than remediation, so the omission increases the risk of accidental disruptive execution on production systems.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The `heal` command is presented as a normal command without an explicit notice that it performs potentially disruptive recovery actions affecting availability and process state. This can lead to unintended service restarts or process termination by users who reasonably assume they are running a benign health check.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: heal() automatically kills sessions and restarts services based on heuristic checks, with no confirmation, authorization step, dry-run mode, or explicit safety interlock. In an agent context, this can cause denial of service, interrupt legitimate work, destroy session state, and turn false positives into destructive actions on production infrastructure.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.