Security audit

Shadow Traffic Tester

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for shadow traffic testing, but its instructions can mirror full production requests and clone production deployment privileges without enough safeguards.

Review before installing or using in production. Only use with explicit approval from the service owner and security/privacy stakeholders; restrict mirrored routes, sample traffic, strip credentials and cookies, isolate the shadow service with separate low-privilege credentials and read-only dependencies, and avoid storing raw production logs in shared temporary files.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:121
Finding: Shadow Deployment Inherits Production Credentials and Privileges
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:66
Finding: Unfiltered Production Requests Are Mirrored to a Less-Trusted Shadow Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:178
Finding: Production Logs Are Written to Predictable Shared Temporary Files
Content: View full analysis
/dev/null > /tmp/prod-access.log # Collect shadow access logs echo "=== Gathering shadow access logs ===" kubectl logs -l app="$SERVICE_NAME",traffic-role=shadow -n "$NAMESPACE" \ --tail=1000 --since=1h 2>/dev/null > /tmp/shadow-access.log echo "Production log lines: $(wc -l < /tmp/prod-access.log)" echo "Shadow log lines: $(wc -l < /tmp/shadow-access.log)" ``` ### Technical Analysis The procedure writes access logs to fixed filenames in the shared `/tmp` directory. It does not securely create the files, establish restrictive permissions, validate their ownership or file type, or delete them after analysis. Shell redirection follows symbolic links. On a system where another local user can create entries in `/tmp`, that user can pre-create `/tmp/prod-access.log` or `/tmp/shadow-access.log` as a symbolic link. When a more privileged operator runs the command, the shell opens and truncates the symlink target using the operator's permissions. The fixed paths can also cause separate audit runs or users to overwrite one another's data. Access logs may contain request paths, identifiers, IP addresses, error details, or application-specific sensitive information and can remain on disk after the analysis completes. ### Attack Path 1. A local attacker predicts the fixed temporary filename. 2. The attacker creates `/tmp/prod-access.log` or `/tmp/shadow-access.log` as a symbolic link to a file writable by the future operator, or waits for logs from another user's run. 3. A privileged operator executes the analysis commands. ...[truncated 783 chars]
Remediation: View remediation
"$PROD_LOG" kubectl logs -l app="$SERVICE_NAME",traffic-role=shadow -n "$NAMESPACE" \ --tail=1000 --since=1h >"$SHADOW_LOG" ``` ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly saves recent production and shadow access logs to /tmp files for later analysis, but it provides no warning or safeguards for potentially sensitive contents such as user identifiers, URLs, tokens, cookies, headers, or internal error details. In a shadow-traffic context this is particularly risky because mirrored production requests often reflect real user traffic, so local log collection can create an unauthorized secondary store of sensitive data on the operator's machine or execution environment.
Content: No source excerpt is available for this finding.