Apm Monitor

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:06 AM UTC
• Version: 2.0.0

Overview

The skill claims to be a Pinpoint/APM monitoring tool, but the inspected artifacts only provide placeholder or generic data commands and silently create local command-history logs.

Review this skill before installing. It does not appear to contain exfiltration, remote code download, privilege escalation, or destructive logic, but its advertised APM purpose does not match the shipped scripts and it can persist command arguments locally. Install only if you are comfortable treating it as an unfinished/generic CLI and avoid passing secrets, tokens, or sensitive paths as arguments.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a functional application performance monitoring tool for distributed systems. However, the supplied code only implements a basic shell command dispatcher with static output for help, info, and status, plus an unimplemented run command. It does not monitor applications, collect telemetry, trace distributed requests, interact with Java, or access any resources consistent with an APM system. This is a material description-versus-behavior mismatch, not merely an incomplete supporting detail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description says this skill is an APM/application performance monitoring tool for large-scale distributed systems, with Java agent and distributed-tracing characteristics. The supplied code instead implements a basic Bash command-line utility that prints placeholder outputs for generic data operations and writes simple usage logs under a local data directory. There is no collection of application metrics, no tracing, no monitoring integrations, no network/system inspection, and no Java-specific logic. This is a material purpose mismatch, not merely an incomplete implementation detail.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script’s actual behavior is a generic local data-processing CLI with simple file logging, which materially conflicts with the declared APM/distributed-tracing purpose in the manifest. This kind of capability mismatch is dangerous because users may grant trust, install, or run the skill under false assumptions, increasing supply-chain and social-engineering risk even if the script is not directly malicious.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The documented commands include generic terms like `help`, `run`, `info`, and `status`, which are common everyday words and are presented without any activation constraints or negative examples. In a markdown skill description, this creates ambiguity about when the skill should be invoked versus when a user is using those words in ordinary conversation.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

## Usage

Run any command: `apm-monitor <command> [args]`
---
💬 Feedback & Feature Requests: https://bytesagain.com/feedback
Powered by BytesAgain | bytesagain.com

• Confidence: 86% confidence
• Finding: The phrase `Run any command: apm-monitor <command> [args]` advertises unconstrained command execution through the skill without any documented allowlist, validation rules, or safety boundaries. In an agent context, this can encourage arbitrary subcommand/argument invocation and increase the chance of unsafe tool use, unexpected local actions, or abuse of any powerful functionality exposed by the underlying `apm-monitor` binary.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The inline comments and help text explicitly present the script as a generic data-processing toolkit, contradicting the skill metadata that advertises APM monitoring. In security-sensitive ecosystems, contradictory descriptions are a red flag because they can conceal unexpected behavior, mislead reviewers, and undermine informed consent by users.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The logging helper records user-supplied command arguments directly into history.log without warning or redaction. If users pass file paths, queries, tokens, identifiers, or other sensitive values as arguments, those secrets can be silently persisted and later exposed to other local users, backups, or support artifacts.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The script creates a persistent local data directory and log files automatically, but provides no notice that command activity and data may be retained on disk. This can expose sensitive operational inputs on shared systems or developer workstations, especially when users reasonably expect a transient command-line utility.

Static analysis

No suspicious patterns detected.