other
- Location
SKILL.md:74- Finding
Overly Broad Host and Infrastructure Reconnaissance Without Explicit Scope Controls
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 74-84 and 121-124
Vulnerability Type: Unrestricted environment reconnaissance
Risk Level: MediumVulnerable Instructions
md | 2 | Git sync: local vs remote | | 3 | Uncommitted sensitive files | | 4 | .env in .gitignore | | 5 | Public endpoints enumeration | | 6 | Authentication requirements mapping | | 7 | Rate limiting coverage | | 8 | Exposed ports (host/container) | | 9 | Hidden services discovery | | 10 | Cron jobs and scheduled tasks | | 11 | Environment variable audit | | 12 | Docker environment check |md | 71-75 | Network security (ports, firewall, isolation) | | 76-78 | TLS/SSL (cert validity, ciphers, HSTS) | | 79-81 | SSH security (key auth, config hardening) | | 82-85 | Database security (SSL, permissions, access) |Technical Analysis
The skill directs an agent performing a project audit to inspect host-level and infrastructure-level resources, including environment variables, hidden services, scheduled tasks, exposed ports, SSH configuration, and database configuration. These targets can extend substantially beyond the supplied project directory.
The instructions do not establish an explicit authorization boundary, require user consent before examining host resources, limit environment inspection to variable names, prohibit access to private keys or credential stores, or require sensitive-value redaction. Consequently, an agent following the skill may place unrelated credentials and infrastructure details into its working context or the generated
.ralph-report.md.This is not evidence of intentional exfiltration, privilege escalation, or persistence. No remote transmission mechanism or executable malicious payload was found. The risk arises from excessive collection and retention of sensitive operational information.
Attack Path
- A user invokes the skill to audit a project directory.
...[truncated 1252 chars]
- Remediation
View remediation
Remediation Suggestions
- Restrict all default audit activity to the user-supplied project directory.
- Require explicit, informed user consent before inspecting host services, containers, scheduled tasks, network configuration, SSH configuration, or databases.
- Define an allowlist of approved commands, paths, hosts, ports, and configuration files for infrastructure checks.
- Audit environment-variable names and configuration structure by default, but never read or report secret values.
- Explicitly prohibit access to private keys, credential stores, cloud metadata endpoints, shell history, unrelated home-directory files, and production databases unless separately authorized.
- Redact passwords, tokens, private keys, connection strings, cookies, and authorization headers from all output and report files.
- Ask the user to confirm the scope before each host-level phase and mark checks as not applicable when authorization is absent.
- Store reports with restrictive permissions and document their retention and deletion requirements.
- Add a mandatory safety rule stating that reconnaissance must not cross repository, host, account, or network boundaries not explicitly approved by the user.