Security audit

Apm Monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill claims to be a Pinpoint/APM monitoring tool, but the inspected artifacts only provide placeholder or generic data commands and silently create local command-history logs.

Review this skill before installing. It does not appear to contain exfiltration, remote code download, privilege escalation, or destructive logic, but its advertised APM purpose does not match the shipped scripts and it can persist command arguments locally. Install only if you are comfortable treating it as an unfinished/generic CLI and avoid passing secrets, tokens, or sensitive paths as arguments.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a functional application performance monitoring tool for distributed systems. However, the supplied code only implements a basic shell command dispatcher with static output for help, info, and status, plus an unimplemented run command. It does not monitor applications, collect telemetry, trace distributed requests, interact with Java, or access any resources consistent with an APM system. This is a material description-versus-behavior mismatch, not merely an incomplete supporting detail.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill is an APM/application performance monitoring tool for large-scale distributed systems, with Java agent and distributed-tracing characteristics. The supplied code instead implements a basic Bash command-line utility that prints placeholder outputs for generic data operations and writes simple usage logs under a local data directory. There is no collection of application metrics, no tracing, no monitoring integrations, no network/system inspection, and no Java-specific logic. This is a material purpose mismatch, not merely an incomplete implementation detail.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script’s actual behavior is a generic local data-processing CLI with simple file logging, which materially conflicts with the declared APM/distributed-tracing purpose in the manifest. This kind of capability mismatch is dangerous because users may grant trust, install, or run the skill under false assumptions, increasing supply-chain and social-engineering risk even if the script is not directly malicious.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documented commands include generic terms like help, run, info, and status, which are common everyday words and are presented without any activation constraints or negative examples. In a markdown skill description, this creates ambiguity about when the skill should be invoked versus when a user is using those words in ordinary conversation.
Content: No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 86% confidence
Finding: The phrase Run any command: apm-monitor <command> [args] advertises unconstrained command execution through the skill without any documented allowlist, validation rules, or safety boundaries. In an agent context, this can encourage arbitrary subcommand/argument invocation and increase the chance of unsafe tool use, unexpected local actions, or abuse of any powerful functionality exposed by the underlying apm-monitor binary.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
md
## Usage Run any command: `apm-monitor <command> [args]` --- 💬 Feedback & Feature Requests: https://bytesagain.com/feedback Powered by BytesAgain | bytesagain.com

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The inline comments and help text explicitly present the script as a generic data-processing toolkit, contradicting the skill metadata that advertises APM monitoring. In security-sensitive ecosystems, contradictory descriptions are a red flag because they can conceal unexpected behavior, mislead reviewers, and undermine informed consent by users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The logging helper records user-supplied command arguments directly into history.log without warning or redaction. If users pass file paths, queries, tokens, identifiers, or other sensitive values as arguments, those secrets can be silently persisted and later exposed to other local users, backups, or support artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script creates a persistent local data directory and log files automatically, but provides no notice that command activity and data may be retained on disk. This can expose sensitive operational inputs on shared systems or developer workstations, especially when users reasonably expect a transient command-line utility.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.