Security audit

OPC全领域指南

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent OPC UA guide with a helper script, but users should treat its insecure demo and troubleshooting examples as lab-only guidance.

Install only if you want an OPC UA learning and troubleshooting guide. Do not copy its None security mode, auto-accept certificate, or useSecurity:false examples into production or shared industrial networks; use verified certificates and SignAndEncrypt for real deployments, and protect any generated private keys.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guidance explicitly tells users to select OPC UA 'None' security mode to test connectivity, but does not warn that this disables authentication, signing, and encryption. In an industrial control context, normalizing insecure first-use practices can expose PLC data and sessions to interception or unauthorized access on production or shared networks.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The guide tells users to trust the server certificate during first connection without a strong warning to verify the certificate fingerprint or authenticity first. In OPC UA, blindly trusting certificates can enable man-in-the-middle connections or unauthorized endpoints to be accepted as legitimate, especially if users later apply this habit outside a local lab setup.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The C# example explicitly enables AutoAcceptUntrustedCertificates and unconditionally accepts certificates in the validation callback. This disables a core OPC UA security control and can let attackers present rogue certificates to impersonate servers, undermining authentication and encrypted session trust.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guidance explicitly recommends using OPC UA 'None' security mode for testing network connectivity, but it does not warn that this disables message security and can normalize insecure deployment practices. In a troubleshooting guide, operators may follow the step in production or on live industrial networks, exposing traffic to interception or tampering and masking certificate/configuration issues rather than fixing them safely.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The function generates and stores private keys on disk in both PEM and DER formats without explicitly setting restrictive permissions or warning callers about sensitive-key handling. If the output directory is shared, backed up broadly, or readable by other users/processes, private key disclosure could enable client impersonation or undermine OPC UA trust controls.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/opc-ua-security.md:91