Security audit
Security checks for vulnerabilities and agentic risk
This system-monitoring skill does what it says, with no evidence of hidden persistence, network exfiltration, destructive actions, or deceptive instructions.
Install only if you are comfortable with the agent reading local system metrics and process information. Avoid sharing JSON or process output publicly, because command lines can include file paths, usernames, host details, or secrets passed as arguments.
The skill invokes local Python scripts via shell commands and implicitly requires file access, but it does not declare any tool scope or permissions boundaries. This creates an authorization gap where an agent may run shell/file operations without explicit least-privilege constraints, increasing the risk of unintended command execution or access beyond what a reviewer expects.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"""Get disk usage for mounted partitions."""
try:
import subprocess
result = subprocess.run(['df', '-B1', '-T'], capture_output=True, text=True)
lines = result.stdout.strip().split('\n')[1:] # Skip header
disks = []
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"""Get top processes by CPU usage."""
try:
import subprocess
result = subprocess.run(
['ps', 'aux', '--sort=-%cpu'],
capture_output=True, text=True
)
A system monitor is expected to read system metrics, but invoking subprocesses introduces executable capability beyond straightforward metric collection. While used here for monitoring, spawning external commands is a broader operational capability than the manifest explicitly conveys.
The code enumerates process owners, PIDs, CPU/memory usage, and full command lines, which can reveal sensitive operational details such as application names, arguments, file paths, tokens passed on the command line, or customer-specific workloads. While process monitoring fits the skill's purpose, exposing full commands increases the risk of unintended information disclosure beyond basic system metrics.
Displaying process command lines without warning can leak secrets embedded in argv, internal hostnames, file paths, usernames, or operational details to whoever can access the skill output. In a monitoring skill this capability is contextually plausible, but the lack of disclosure and minimization makes the data exposure risk more significant.