Linux Security Guardian

• Outcome: Review
• Latest audit: Jul 14, 2026 · 10:15 AM UTC
• Version: 1.6.0

Overview

This skill is a disclosed Linux security automation tool, but it needs Review because it can run high-impact root SSH actions across multiple client servers on a permanent schedule with weak bulk-approval and data-boundary controls.

Install only if you intend to grant a skill recurring root-level SSH administration over the listed servers. Before enabling it, replace the shared root key model with least-privilege accounts where possible, disable automatic write actions until tested, remove or restrict APPROVE ALL, review email recipients, decide whether package inventory may be sent to OSV/NVD/CISA, and set retention/access controls for generated audit reports and backups.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (40)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares broad shell-based execution and remote administration behavior but does not expose an explicit permissions model in the manifest. That creates a trust gap: operators may install a skill capable of running audit and remediation commands over SSH without clear permission scoping or least-privilege constraints.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The document claims all commands go through SSH MCP and prohibits local execution, yet separately authorizes local CVE scanning with curl on the guardian host. This inconsistency can bypass expected control boundaries, create undeclared egress from the local host, and confuse reviewers about where code executes and what system is exposed.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This profile explicitly authorizes automatic state-changing actions such as restarting security services and locking accounts, but provides no explicit operator warning in the consumed profile itself. In an autonomous root-level SSH auditing skill, silent remediation increases the chance of accidental outages, lockouts, or unexpected system modifications across multiple client servers.

Missing User Warnings

Medium

• Confidence: 74% confidence
• Finding: The guidance recommends account-locking actions such as passwd -l or usermod -L based on audit findings without clearly requiring validation that the account is non-service-critical. In an autonomous multi-client environment, this can disable legitimate admin or service accounts and cause operational disruption or lockouts if classification is wrong.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The module instructs the agent to auto-start fail2ban when it is not running, which modifies a live security service on production servers. In this skill context, autonomous SSH-based fleet administration increases the risk because starting or restarting fail2ban can alter access behavior, interfere with existing controls, or cause lockout/operational issues if assumptions about whitelisting or jail configuration are wrong.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The recommended PAM and password policy changes can directly affect authentication behavior and may lock out users, administrators, or automation if applied incorrectly. In a skill designed for autonomous multi-client Linux security management over SSH, undocumented or under-warned PAM changes are especially dangerous because a bad rollout can simultaneously disrupt access across many servers.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The module explicitly instructs automatically enabling and starting auditd, which modifies system state during what is framed as an audit step. In a multi-client autonomous SSH security skill, automatic service changes can cause unintended operational impact, bypass change-control expectations, and create trust/safety issues if applied without explicit owner approval and rollback handling.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The module explicitly writes per-server scan reports and per-CVE advisory files containing package names, installed versions, severity, and potentially client/server identifiers, but the skill description does not clearly warn users that this security telemetry will be stored. In a multi-client security automation context, that omission creates privacy and confidentiality risk because sensitive asset and vulnerability intelligence may persist on disk or be forwarded later without informed consent.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The module states that installed package names and versions are collected and then queried against external services such as OSV.dev and NVD via curl from the remote server, but it lacks an explicit privacy/integrity warning or consent boundary for that external transmission. This can expose internal software inventory to third parties and creates supply-chain trust risk if external results influence remediation decisions without clear user approval.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The module instructs the agent to auto-apply `chmod 1777 /tmp`, which changes live system state without an explicit safety warning or mandatory validation. In a multi-client autonomous SSH security skill, automatic permission changes can break nonstandard environments or mask deeper filesystem misconfiguration if `/tmp` is not the real target or is unexpectedly mounted.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: This module instructs the agent to make outbound connections to each configured domain using openssl s_client and nmap ssl-enum-ciphers without any operator-facing notice, consent gate, or rate-limiting guidance. In a multi-client autonomous security skill, those probes can generate detectable scan traffic, trigger IDS/WAF alerts, or violate customer expectations if domains are third-party hosted or out of scope.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The module provides commands that overwrite files under /etc/sysctl.d/ using shell redirection and then immediately applies the settings with sysctl -p, but the warning only mentions possible application breakage and does not clearly warn that this changes live system networking behavior and replaces file contents. In an autonomous SSH-based security skill, this is more dangerous because operators may treat the content as safe to auto-apply across multiple servers, causing unexpected loss of IPv6 connectivity or service disruption.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The ip6tables example changes live INPUT/FORWARD default policies to DROP and persists the rules, but it does not explicitly warn that this can immediately sever remote access or break production IPv6 traffic if required allowances are incomplete. Given this skill's multi-client autonomous server-administration context, presenting live firewall changes without a strong connectivity-impact warning increases the chance of accidental lockout at scale.

Missing User Warnings

High

• Confidence: 89% confidence
• Finding: The purpose text states the audit will 'auto-fix safe issues' but does not prominently warn that the nightly job performs automatic system modifications across multiple clients and servers. In a high-privilege SSH-based fleet management context, insufficient warning and consent boundaries can lead to unintended configuration changes, service disruption, or silent policy drift at scale if operators misunderstand the cron's behavior.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill collects sensitive operational and security data from servers, compiles per-server and master reports, and sends them via an email plugin, yet it provides no explicit privacy, minimization, or secure-transmission warning. Because findings may include package inventories, open ports, vulnerabilities, usernames, firewall state, and other sensitive metadata across multiple clients, emailing them without clear safeguards can expose confidential infrastructure details.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill collects sensitive operational and security data from servers, compiles per-server and master reports, and sends them via an email plugin, yet it provides no explicit privacy, minimization, or secure-transmission warning. Because findings may include package inventories, open ports, vulnerabilities, usernames, firewall state, and other sensitive metadata across multiple clients, emailing them without clear safeguards can expose confidential infrastructure details.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The restore path overwrites active skill files and historical state immediately with no confirmation, backup of the current state, integrity check, or dry-run. In a root-owned security-management skill, a mistaken or maliciously planted backup could silently replace operational instructions or audit artifacts, degrading the trustworthiness of future security actions.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The fallback behavior searches all pending-confirm directories when an ID is not found in the expected client/server path, allowing a loosely specified or ambiguous identifier to resolve to an action on a different tenant or host. In a multi-client SSH automation skill, this creates an authorization and scope-confusion risk where an owner reply could approve, deny, or skip the wrong action, potentially leading to unintended remote changes on another server.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The bulk command "APPROVE ALL" authorizes execution of every pending action with no stated scoping, filtering, per-action review, or secondary confirmation. Given this skill can make SSH-mediated security changes across multiple clients and server fleets, a single message could trigger mass changes, including disruptive patching or firewall actions, if pending items are misclassified, stale, or queued for the wrong owner context.

External Transmission

Medium

• Category: Data Exfiltration

Content

# No API key. No rate limits. Always works with curl.
# Best method: matches by package + ecosystem + version.
#
# curl -s -X POST "https://api.osv.dev/v1/querybatch" \
#   -H "Content-Type: application/json" \
#   -d '{"queries":[
#     {"package":{"name":"openssl","ecosystem":"Debian"},"version":"3.0.2"},

• Confidence: 95% confidence
• Finding: The curl example includes a JSON body with concrete package/version identifiers, demonstrating actual outbound exfiltration of software inventory rather than a purely informational link. This is sensitive in security operations because it can help third parties infer vulnerable components and platform details.

External Transmission

Medium

• Category: Data Exfiltration

Content

# ═══════════════════════════════════════════════════════════════
# METHOD 7: OSV.dev — open source vuln DB [CURL] ✅
# ═══════════════════════════════════════════════════════════════
# POST https://api.osv.dev/v1/query (single)
# POST https://api.osv.dev/v1/querybatch (batch — up to 1000)
# No API key. No rate limits. Always works with curl.
# Best method: matches by package + ecosystem + version.

• Confidence: 89% confidence
• Finding: Referencing and using the OSV.dev API indicates intended communication with an external service for vulnerability lookups. In this skill's context, that means operational security data from client systems may leave the environment, which is sensitive even if the destination is legitimate.

External Transmission

Medium

• Category: Data Exfiltration

Content

# METHOD 7: OSV.dev — open source vuln DB [CURL] ✅
# ═══════════════════════════════════════════════════════════════
# POST https://api.osv.dev/v1/query (single)
# POST https://api.osv.dev/v1/querybatch (batch — up to 1000)
# No API key. No rate limits. Always works with curl.
# Best method: matches by package + ecosystem + version.
#

• Confidence: 89% confidence
• Finding: The querybatch capability is specifically designed to submit many package/version tuples, increasing the volume and completeness of data disclosed externally. In a multi-client fleet management skill, this can expose broad inventory across tenants if not carefully controlled.

External Transmission

Medium

• Category: Data Exfiltration

Content

# No API key. No rate limits. Always works with curl.
# Best method: matches by package + ecosystem + version.
#
# curl -s -X POST "https://api.osv.dev/v1/querybatch" \
#   -H "Content-Type: application/json" \
#   -d '{"queries":[
#     {"package":{"name":"openssl","ecosystem":"Debian"},"version":"3.0.2"},

• Confidence: 95% confidence
• Finding: The curl example includes a JSON body with concrete package/version identifiers, demonstrating actual outbound exfiltration of software inventory rather than a purely informational link. This is sensitive in security operations because it can help third parties infer vulnerable components and platform details.

External Transmission

Medium

• Category: Data Exfiltration

Content

CVE scan commands run via `ssh_exec(op="run", sessionId, command="...")` on the remote server:
- `dpkg-query -W -f='${Package}\t${Version}\n'` → installed packages
- `curl -s 'https://www.cisa.gov/...'` → CISA KEV fetch
- `curl -s -X POST 'https://api.osv.dev/v1/querybatch'` → OSV.dev query
- `curl -s 'https://services.nvd.nist.gov/rest/json/cves/2.0?...'` → NVD query
Results parsed locally, advisories written to `cve/<client>/<server>/advisories/<CVE-ID>.md`.
Scan report to `cve/<client>/<server>/scan-results/YYYY-MM-DD.md`.

• Confidence: 98% confidence
• Finding: This line operationalizes the external transmission by combining installed package enumeration with POST requests to OSV.dev and queries to NVD/CISA, confirming that real client-server package inventory is sent off-host during scanning. Because the skill is autonomous and multi-client, the lack of explicit consent and data-boundary controls makes the exposure more dangerous than a one-off manual lookup.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Rule 5 — Auto-Actions Whitelist Only

Agent can ONLY auto-execute actions listed in SERVER_PROFILE.md under `Auto-Actions Allowed`.
Anything not explicitly whitelisted → queue for confirmation.
No exceptions. Owner preference > agent judgment.

• Confidence: 91% confidence
• Finding: The skill explicitly authorizes autonomous execution of server changes based on a whitelist in SERVER_PROFILE.md. Even with a 'safe-first' framing and pre/post checks, this is dangerous because a compromised, incorrect, or overly broad whitelist can cause configuration drift, outages, or unintended security-impacting changes across multiple clients without contemporaneous human approval.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.