cert lifecycle harness

• Outcome: Review
• Latest audit: May 28, 2026 · 9:03 AM UTC
• Version: 1.0.0

Overview

The skill is a real certificate-renewal helper, but it needs Review because some templates can change or delete live certificate assets and its credential/file-write boundaries are not consistently scoped.

Install only for a controlled certificate-change workflow. Before using it on production, remove or separately gate delete/cleanup steps, especially the JKS delete-first template; do not paste long-lived cloud credentials into chat; prefer user-run read-only exports or short-lived least-privilege tokens; and require backups, dry-runs, explicit human approvals, rollback validation, and maintenance-window review before any sudo, kubectl, service reload, or cloud write action.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The template performs an explicit `keytool -delete` against the live keystore before the replacement import succeeds, directly contradicting the skill’s stated guarantee to never execute Delete operations. This creates a destructive intermediate state where the alias is absent or the keystore is left unusable if import fails, which can immediately cause TLS outage in production.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The runbook frames the procedure as a controlled hot rollover, but its own documented sequence knowingly introduces a hazardous intermediate state in which the old alias is removed before the new material is confirmed live. That mismatch can mislead operators into trusting a workflow that has built-in outage potential, especially in a production certificate rotation context.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The guide explicitly documents and authorizes an irreversible deletion step for old certificate files, which conflicts with the skill's stated safety invariant that it should never execute Delete. In certificate operations, deletion can destroy rollback material and forensic evidence, turning a recoverable rollout issue into a prolonged outage or compliance incident.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: Marking cleanup-old.sh as an allowed delayed-delete exception directly undermines the manifest claim that the harness never executes Delete. That contradiction weakens operator trust boundaries and can normalize destructive actions inside a workflow that users may adopt specifically because they believe deletes are excluded.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This checklist expands a 'self-review' document into operational instructions that require the agent to write files to disk, create executable scripts, and change permissions. That materially increases the agent's authority and can normalize filesystem mutation without fresh user approval, which is risky in a production certificate workflow where generated artifacts may later be executed.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The checklist tells the agent to proactively ask for cloud read-only API credentials during topology identification, which broadens the skill from review into credential acquisition and environment reconnaissance. Even read-only credentials are sensitive and can expose infrastructure inventory, certificates, DNS, and network topology, creating avoidable data-exposure risk if the request is unnecessary or mishandled.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The document first prohibits wording that implies agent auto-execution, then later defines a process for agent-executed write APIs. That contradiction weakens safety boundaries and can confuse both agent and user about when autonomous mutation is permitted, increasing the chance that write actions are taken under an internal checklist exception rather than a clearly separated, explicit approval flow.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The file is written entirely in Chinese and directs the agent to operate in Chinese without offering the user a language choice or fallback. This can exclude users who are not proficient in Chinese, increasing the risk of misunderstanding certificate-renewal steps, approvals, and safety constraints in a high-impact operational workflow.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The template performs an in-place TLS Secret replacement and may restart the ingress controller, both of which can cause transient traffic disruption or broader blast-radius effects if the Secret is shared or the controller restart is not harmless in that environment. Although this is an operational runbook rather than autonomous code, the lack of a prominent user-facing warning and explicit pre-execution confirmation increases the chance of an unsafe production change being executed without understanding outage risk.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This file is written entirely in Chinese and prescribes Chinese-language interaction patterns without offering any user-language choice or documenting a legitimate locale restriction. In a safety-critical certificate lifecycle skill, forcing a language can cause operator misunderstanding, missed confirmations, and incorrect execution of review or approval steps, increasing the chance of outages or misconfiguration.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The skill instructs the agent to proactively ask for cloud read-only credentials at the very start of the workflow. Even if limited to Describe/STS access, normalizing credential collection in chat increases the risk of credential exposure, overbroad grants, accidental secret retention in logs, and phishing-like behavior by the agent; the certificate-management context makes this more sensitive because cloud inventory often reveals production topology and security-relevant assets.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.