Security audit

Glances

Security checks across malware telemetry and agentic risk

Overview

This Glances monitoring skill is coherent, but it gives agents examples for network-exposed monitoring, Docker host access, persistent services, cron jobs, and forceful process termination without enough safety boundaries.

Install only if you are comfortable reviewing commands before execution. Prefer localhost binding, avoid exposing Glances Web/API ports to untrusted networks, do not mount docker.sock or use host networking unless necessary, protect any tokens or SMTP passwords, and manually approve systemd, cron, docker group, firewall, and kill -9 commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (17)

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: This section expands the skill from passive monitoring into system administration by creating persistent services and cron-based alert scripts. In an AI-execution context, these instructions can cause lasting system changes and introduce network-exposed or scheduled behaviors that outlive the user session, increasing operational and security risk.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The guide directs package installation and integration with external databases, metrics systems, and SMTP services, which materially broadens the skill's capabilities beyond local monitoring. In an agent setting this can lead to unreviewed software installation, outbound data transfer, and credential handling without adequate safeguards.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill explicitly promotes Web access, REST API exposure, remote server/client mode, and data export, but does not warn that these features can expose sensitive system telemetry, process information, host details, and network-reachable services if bound broadly or used without authentication controls. In an agent context, this is risky because the assistant may help a user enable monitoring endpoints or exports on a live system without highlighting access restrictions, causing unintended information disclosure or expanded attack surface.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The Docker examples grant the container unusually broad host visibility by mounting the Docker/Podman sockets, sharing the host PID namespace, and using host networking, while the documentation does not clearly warn about the trust and exposure implications. In an AI-executed skill context, these commands could be run with minimal user scrutiny, enabling inspection or indirect control of host containers and increasing the blast radius if the image or invocation is compromised.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The quickstart instructs users to start the Glances Web UI on all interfaces using `glances -w` and `--bind 0.0.0.0`, and even provides a remote-access example, but does not place a nearby warning about exposing system monitoring data to the network. This can unintentionally publish host metrics and process information to other machines, and users may assume the default example is safe for general use.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The documentation lists `k` as terminating the selected process with `SIGKILL` but provides no warning that this is an immediate, destructive action that can stop critical services or interrupt writes. In an AI-assisted workflow, a model could suggest or simulate this shortcut without making the user aware of the operational risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide recommends binding the API/web service to 0.0.0.0, exposing system metrics on all network interfaces, but does not pair this with authentication, firewall restrictions, or exposure warnings. That can make sensitive host telemetry reachable by unintended parties on the network.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The REST API examples use unauthenticated HTTP endpoints and include access to complete snapshots and process lists, which may disclose sensitive operational and process information. Without warnings, users or agents may expose or query this data over insecure or reachable interfaces.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The examples append plaintext usernames, passwords, and tokens directly into the Glances configuration file. This encourages insecure secret storage, which can lead to credential theft from shell history, backups, world-readable files, or repository commits.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The Docker example publishes service ports and mounts /var/run/docker.sock while sharing the host PID namespace. Docker socket access is highly sensitive and can enable host-level control through the container, while exposed ports increase attack surface for telemetry access.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The systemd example writes a privileged service file and enables a persistent network service, but does not warn about persistence, port exposure, or change-management impact. In an AI-assisted environment, this can create durable host changes that are difficult for users to notice or roll back.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The alerting section stores SMTP credentials in plaintext in the configuration file without discussing secret handling or file permissions. That risks credential compromise and downstream abuse of the mail account or notification infrastructure.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation explicitly instructs users to bind the Glances web server to 0.0.0.0 for remote access, which exposes the monitoring interface to the network without any warning about authentication, trusted-network restrictions, or firewall scoping. In a system monitoring tool context, this can leak sensitive host telemetry or create an unintended remotely reachable service.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The guide recommends killing whatever is using the port via `lsof -ti :61208 | xargs kill -9` without first identifying the process or warning that SIGKILL is forceful and bypasses graceful shutdown. This can terminate the wrong service, cause data loss, or destabilize a host during troubleshooting.

Missing User Warnings

High

Confidence: 98% confidence
Finding: Adding a user to the `docker` group grants effectively root-equivalent access on many systems because group members can control containers, mount the host filesystem, and escalate privileges. Presenting this as routine troubleshooting without warning can lead users to weaken host security significantly.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The configuration example includes a plaintext token placeholder in a config file example without warning about secret handling, file permissions, or avoiding commits to version control. In practice, users may store real tokens insecurely in world-readable files, shell history, screenshots, or repositories.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The troubleshooting steps advise binding the Glances server to all interfaces and opening the firewall port, which exposes the monitoring service to the network without emphasizing access control or trusted-network limits. For a monitoring service, this increases attack surface and may disclose sensitive operational data if reachable by unauthorized users.

VirusTotal

54/54 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.