Security audit

Nginx Reverse Proxy

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can directly change live nginx and TLS configuration with root privileges without enough validation or approval gates.

Review carefully before installing. Only use this skill on hosts where you intend an agent to make privileged nginx and certificate changes, and require manual validation of the domain, target, generated config, destination path, certbot command, and reload step before anything is run.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:10
Finding: Unvalidated User Input Enables Shell, Path, and Nginx Configuration Injection
Content: View full analysis
/dev/null <<'EOF' EOF sudo nginx -t && sudo systemctl reload nginx ``` ```bash sudo certbot --nginx -d {domain} ``` ### Technical Analysis The `{domain}` and `{target}` placeholders originate in an untrusted user request. The skill provides no hostname, address, port, character-set, or le ...[truncated 3024 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to write to /etc/nginx/conf.d and reload nginx, but it provides no warning that these are privileged, service-affecting operations. This is dangerous because a user may trigger production-impacting changes without understanding that the skill will modify system config and restart or reload a critical network service.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 91% confidence
Finding: The chained command couples validation and service reload in a single privileged execution path, which reduces opportunities for review and makes it easier for a successful syntax check to immediately push risky changes live. In agent systems, command chaining increases the blast radius of one trigger by combining multiple sensitive actions atomically.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
sudo tee /etc/nginx/conf.d/{domain}.conf > /dev/null <<'EOF' EOF sudo nginx -t && sudo systemctl reload nginx

text
5. If SSL needed, also run:

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases are broad enough that ordinary requests about domain binding or nginx configuration could activate a skill that writes privileged system configuration and reloads nginx. In an agent setting, loose activation increases the chance of unintended execution of sensitive admin actions without explicit user confirmation.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 95% confidence
Finding: This command uses sudo to write directly into /etc/nginx/conf.d based on user-supplied values, enabling privileged modification of web server configuration. In an agent context, root-level file writes driven by unvalidated input can break service availability or be abused to introduce malicious nginx directives if placeholders are not strictly sanitized.
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Execute:

bash
sudo tee /etc/nginx/conf.d/{domain}.conf > /dev/null <<'EOF' <config> EOF sudo nginx -t && sudo systemctl reload nginx

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 93% confidence
Finding: Running nginx -t and reloading nginx under sudo gives the skill immediate privileged control over live web service state. A malformed or attacker-influenced configuration can cause service disruption, and reloading applies the change right away without a human checkpoint.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
sudo tee /etc/nginx/conf.d/{domain}.conf > /dev/null <<'EOF' EOF sudo nginx -t && sudo systemctl reload nginx

text
5. If SSL needed, also run:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The certbot step can obtain or modify live TLS certificate configuration, potentially changing server behavior, ACME challenge handling, and certificate state. Without warning or approval, users may unintentionally cause certificate issuance attempts, rate-limit problems, or unexpected edits to nginx configuration.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 89% confidence
Finding: Executing certbot with sudo allows the skill to obtain certificates and potentially modify nginx configuration with root privileges. In an automated agent flow, this can make externally visible changes, consume certificate issuance quotas, and alter service behavior without sufficient operator awareness.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

If SSL needed, also run:

bash
sudo certbot --nginx -d {domain}

Report success with domain and target info.

Static analysis

No suspicious patterns detected.