部署故障分析及解决助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:17 AM UTC
• Version: 1.2.1

Overview

This skill fits a deployment troubleshooting assistant, but it needs review because it embeds database passwords and persistently stores sensitive logs and incident records.

Install only in a controlled deployment-support environment after removing and rotating the embedded MySQL passwords, replacing shell-built SQL with parameterized queries or safe wrapper scripts, making raw-log and Excel/MySQL retention explicit opt-in, redacting secrets before storage, and limiting Docker, database, and /data/scripts access to the minimum needed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:41

Finding

Hard-Coded MySQL Credentials Expose Database and Administrative Access

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:276

Finding

Mandatory Unredacted Archival of User Logs Creates Persistent Sensitive-Data Exposure

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:487

Finding

Untrusted Log Keywords Can Be Interpolated into MySQL Query Templates

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

声明强调的是“故障分析助手”工作流，核心能力应包括：1) 优先查询 MySQL 故障知识库；2) 未命中时检索 /data/scripts/；3) 支持交互式单条更新故障库；4) 生成 Word 报告。代码中仅明显实现了第4项的一部分，并额外实现了日志 JSON 解析、错误模式分类、去重归并、批量多故障报告生成以及向 Excel 文件追加记录。没有任何 MySQL 连接/查询代码，没有对 /data/scripts/ 目录的检索逻辑，也没有交互式更新流程。虽然“生成 Word 分析报告”与声明部分一致，但整体主用途和关键资源访问方式与声明不符，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

→ decide_cluster_type（扩容节点类型） → get_expand_type（扩展现有 pool 或新建 pool） → IsEbs001MixNode()（mix 扩容时检查 ebs0001 是否 mix 节点） → ceph-deploy gatherkeys → 新节点 init（装包、拷 keyring、清盘） → DeployOsds() → CheckExpandResult()

text

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill documentation includes a database initialization command using root credentials and a root password embedded directly in the instructions. This exceeds the needs of a fault-analysis assistant and normalizes privileged administrative actions that could be abused to alter or destroy database contents if the skill or operator follows them. Because the credentials are hardcoded and broadly exposed in the skill file, compromise of the skill content or outputs could leak database admin access.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence

Finding

The skill describes capabilities that read user files and local paths, but it does not declare an explicit tool/permission scope. That creates an overbroad trust boundary: an agent may access files or paths beyond what users expect, especially because the skill also references absolute host paths like /data/scripts and local home directories. In a log-analysis assistant, undeclared file-read capability is risky because uploaded logs and adjacent files often contain secrets, credentials, and infrastructure details.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description and the operational guidance are entirely written to require Chinese-centric behavior, including fixed Chinese summary/report templates and trigger phrases, with no indication that users may choose another language. This can violate language or locale policy when the skill implicitly forces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs that all new problems be accumulated into Excel and optionally synchronized to MySQL, again without an upfront warning that user-provided incident data will be persistently stored. Incident reports often include sensitive operational and customer environment details, so turning every interaction into a knowledge-base entry creates unnecessary data collection and secondary-use risk. In this context, persistence is not incidental; it is built into the core workflow, which increases exposure.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to continuously accumulate new user problems into Excel and optionally a database creates a long-lived repository of sensitive incident data. Over time this aggregates not just isolated secrets but patterns about environments, failures, usernames, versions, and infrastructure, increasing both breach impact and insider misuse risk. The skill context makes this more dangerous because the collection appears automatic and embedded in the normal troubleshooting path.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill directs the agent to use docker exec and host-side scripts as a primary mechanism, which broadens it from log analysis into host command execution. Even when intended for troubleshooting, this creates a larger attack surface because adversarial user inputs could influence what paths, queries, or scripts are invoked, and the referenced environment contains production-like infrastructure assets. In context, this makes the skill more dangerous than a pure offline parser because it is coupled to operational tooling on the host.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Requiring archival of all raw user inputs and uploaded logs creates a broad sensitive-data retention surface. The stored content can include secrets, infrastructure topology, stack traces, and customer identifiers, and because the workflow saves the original unfiltered artifacts, any compromise of the host account or skill directory exposes high-value operational data. This is particularly dangerous in a fault-analysis context where users are likely to submit precisely the most sensitive debugging evidence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill mandates archiving every raw user input and uploaded log to local storage before analysis, without clear user-facing notice or consent. Logs and pasted error text commonly contain tokens, passwords, internal hostnames, IPs, stack traces, and customer data, so automatic retention materially increases confidentiality risk and breach impact. The context makes this more dangerous because the retention path is persistent under the operator's home directory rather than ephemeral processing.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 625)May include surrounding context.

md

| 配置错误 | 对比配置模板 → 校验参数值 | 修正配置文件、重启服务、验证参数生效 |
| 资源不足 | free/df -h/ulimit -n 检查 → top 定位占用进程 | 清理磁盘、扩容、调大 ulimit、重启服务释放泄漏 |
| 服务异常 | systemctl status → journalctl 查崩溃原因 | 重启服务、检查依赖服务状态、排查 OOM killer |
| 权限问题 | ls -l / id / 检查 sudo | 修正文件权限(chmod/chown)、添加 sudo 授权 |
| 依赖缺失 | rpm -qa / pip list → 对比版本要求 | 安装缺失包、版本降级/升级 |
| 数据异常 | 检查数据完整性 → 对比 schema | 数据修复、迁移、回滚 |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains natural-language guidance stating features such as '中文错误模式自动分类', and the implementation later hard-codes Chinese category labels and Chinese-centric parsing behavior. That effectively imposes a specific language/locale on outputs and operation without any user opt-in or documented regional justification, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Manifest 将该技能描述为接收日志/报错文本进行分析，并生成 Word 分析报告；虽然整体技能提到支持单条更新故障库，但这个文件自身的模块说明与 CLI 描述都定位为“报告生成器”。代码却实现了 append_to_excel/batch_append_excel，并在 CLI 中根据 --xlsx 直接写入知识库文件，实际行为不只是报告生成。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

技能描述强调的是“交互式单条更新故障库”，而这里的 batch_append_excel 文档字符串明确写的是“批量追加多条记录”，CLI 还会把 faults 整批写入 xlsx。这里不是简单的信息缺失，而是文档/意图强调单条交互更新，但实现提供了批量写库路径。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation states '本流程仅写入 MySQL，不修改 Excel', which strongly suggests the update flow’s side effect is limited to MySQL. However, the very next steps direct saving a draft JSON file under the skill directory, so the documentation understates actual write side effects in a way that contradicts the claimed behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code performs persistent file writes via json.dump(), doc.save(), and wb.save(), including appending to an Excel knowledge base, but provides no explicit warning message about modifying or creating files other than generic CLI parameter help. For a code file, file-write operations should have some visible disclosure, confirmation, or clearly documented warning, especially for the optional Excel append behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.