Security audit

Perf Profiler

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate Linux performance troubleshooting skill, but it includes high-privilege tracing and mutable source installation paths without enough scoping or safety controls.

Review before installing. Use a pinned, verified perf-prof commit or release, build it in an unprivileged isolated environment, and require exact approval for any root/CAP_* tracing, /proc/kcore use, dynamic probes, network push/pull, or expression command execution. Avoid running this on production or multi-user systems unless scope, duration, output storage, and cleanup are explicitly controlled.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:23
Finding: Mutable Remote Source Is Downloaded, Compiled, and Executed Without Integrity Verification
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/kprobe_events.md:121
Finding: Privileged Global Tracing State Can Be Modified Without Mandatory Scope and Cleanup Controls
Content: View full analysis
/sys/kernel/debug/tracing/kprobe_events echo 'r:myretprobe do_sys_open $retval' >> /sys/kernel/debug/tracing/kprobe_events cat /sys/kernel/debug/tracing/events/kprobes/myprobe/format echo 1 > /sys/kernel/debug/tracing/events/kprobes/myprobe/enable echo 1 > /sys/kernel/debug/tracing/events/kprobes/myretprobe/enable echo 1 > /sys/kernel/debug/tracing/tracing_on cat /sys/kernel/debug/tracing/trace echo 0 > /sys/kernel/debug/tracing/tracing_on echo '-:myprobe' >> /sys/kernel/debug/tracing/kprobe_events echo > /sys/kernel/debug/tracing/kprobe_events ``` Related privileged capabilities documented elsewhere include: ```bash perf-prof task-state --ptrace -p 3479 ``` ```bash echo 'p /bin/bash:0x4245c0' > /sys/kernel/debug/tracing/uprobe_events echo 'r /bin/bash:0x4245c0' >> /sys/kernel/debug/tracing/uprobe_events ``` The main Skill also identifies a profiler that reads kernel memory through `/proc/kcore`. ### Technical Analysis The documentation directs the Agent to write directly to global `tracefs`/`debugfs` control files. These interfaces generally require elevated tracing capabilities or root privileges and affect system-wide kernel tracing state. The final command truncates the complete `kprobe_events` control file. This can remove probes created by administrators, monitoring products, or another concurrent diagnostic session rather than only removing probes created by this Skill. Enabling and disabling the global `tracing_on` switch can likewise interfere with unrelated tracing consumers. Kernel probes, uprobes, `ptrace`, process `/proc` data, and `/proc/kcore` can expose sensitive information across process and privilege boundaries. These c ...[truncated 1609 chars]
Remediation: View remediation
/sys/kernel/debug/tracing/kprobe_events ``` 8. Restore the prior `tracing_on` state rather than unconditionally enabling or disabling it. 9. Use shell traps or equivalent cleanup handlers so the Skill restores state after interruption or failure. 10. Avoid `/proc/kcore` unless no safer source can answer the diagnostic question, and require separate informed consent when it is necessary. 11. Store trace output with restrictive permissions and define a retention and deletion policy. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/expr.md:77
Finding: Expression Engine Exposes an Unrestricted Command-Execution Primitive
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (31)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The expression language explicitly exposes a built-in system(const char *format, ...) function that formats and executes shell commands. In a profiling/analysis skill, this enables arbitrary command execution from what should be a data-processing context, greatly expanding the attack surface and making command injection or abuse possible if expressions are user-supplied or derived from event fields.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly presents kcore as a way to read kernel memory but does not warn that this can expose highly sensitive in-memory data, typically requires elevated privileges, and can bypass normal application-level data boundaries. In a troubleshooting skill, omission of these cautions can lead an operator to collect or disclose secrets, credentials, or other sensitive kernel-resident data without understanding the risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instructions for manually writing to /sys/kernel/debug/tracing/kprobe_events and /sys/kernel/debug/tracing/uprobe_events describe modifying live tracing configuration without warning that this changes kernel tracing state, can increase overhead, and may destabilize production observability or system behavior if misused. Because these actions affect a running system and often require elevated privileges, users may apply them in sensitive environments without understanding rollback, blast radius, or performance consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation advertises system() as a normal built-in capability but provides no warning that it executes shell commands. This omission increases the chance that users treat expressions as safe computation, when in fact they can trigger command execution, leading to accidental misuse, unsafe sharing of expressions, or injection through untrusted inputs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document explicitly teaches use of hardware breakpoints to trace memory accesses and capture full register state for both kernel and user-space contexts, but it does not clearly warn that this can expose highly sensitive data such as pointers, stack contents, keys, credentials, or proprietary in-memory state. In a performance/debugging skill, that omission increases the chance of unsafe collection, storage, or sharing of sensitive runtime data by legitimate users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The write-value decoding section documents reading kernel instructions from kcore to reconstruct writes, but it lacks an explicit warning that this requires elevated privileges and touches highly sensitive kernel memory interfaces. Without that warning, operators may use the feature on production systems without understanding the integrity, confidentiality, and compliance implications of exposing kernel code/data paths.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file presents all user-facing instructions, examples, and descriptions exclusively in Chinese. Under the policy rules, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: 这是一个 markdown 文件，因此应检查是否缺少会影响系统完整性或可用性的用户告警。文档说明该分析器需要 root 权限并通过 perf/tracepoint 持续跟踪内核与用户态内存分配事件，但只描述了功能和参数，没有明确提醒高权限观测、事件跟踪和较大 ringbuffer 配置可能带来的性能开销或对生产系统的影响。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire skill document is written in Chinese, including the title, usage guidance, options, and examples, with no indication that users may choose another language or that the locale is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents all user-facing instructions and descriptions exclusively in Chinese, including the title, usage guidance, and operational notes. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire skill description, headings, and usage guidance are written in Chinese, beginning with the title at L001, and there is no indication that users may select another language or that the skill is intended only for a Chinese-language audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: SQP-3 applies to all file types and includes language/locale policy violations. The file forces a specific language for all instructions and examples, with no opt-in, alternative language, or explanation that the skill is intended only for a Chinese-language audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The natural-language content of the skill file is entirely in Chinese, which effectively forces a specific language for users reading the skill documentation. No opt-in, alternative language, or justification for a Chinese-only locale constraint is provided.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: 这是一个 markdown 文件，适用 SQP-2。L012 仅说明“需要root权限运行”，但未提醒用户该操作会以高权限采集系统范围的进程/线程系统调用信息，可能影响隐私、系统完整性或生产环境稳定性；后文示例还展示了对所有进程进行跟踪。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation explicitly states that the tool requires root or CAP_SYS_ADMIN privileges, but it does not present a clear user-facing warning about the risks of elevated execution and broad system observability. In a profiling skill, this omission can lead users to run powerful tracing commands without understanding that they may expose sensitive process, syscall, memory, or workload information and increase operational risk on production systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documentation explicitly notes root/CAP_PERFMON requirements and later supports event propagation across hosts, but it does not warn that traced events and call stacks can contain sensitive process, kernel, or workload data. In a privileged tracing tool, omission of these operational security cautions can lead users to expose telemetry over the network or run high-impact tracing without understanding data-leakage and system-stability risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The cross-host push/pull example binds a receiver to 0.0.0.0 and demonstrates transmitting system events over the network without any warning about exposure, authentication, encryption, or firewalling. Because these events may include process names, timing, stack traces, and other sensitive telemetry, users could unintentionally create a remotely reachable observability endpoint or leak privileged runtime data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown template is entirely written in Chinese and all placeholder guidance requires Chinese output, which imposes a specific language on downstream skill authors or users. The file does not provide any opt-in, alternative language option, or justification for a Chinese-only locale requirement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The document includes ready-to-run examples that write to tracing control files, enable uprobes, and capture trace output from user-space functions such as malloc, free, and open-related wrappers, but it does not clearly warn about operational risk or sensitive data exposure. In this performance-analysis context, those commands can degrade system performance, require elevated privileges, and collect process arguments, pointers, filenames, and other potentially sensitive runtime data if copied directly into production use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown skill file presents all instructions and operational guidance exclusively in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. That can violate language/locale policy when a skill forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: markdown 文件需要对可能影响隐私或数据暴露的行为给出警示。这里说明 --comm 会在报告中输出进程名列表，这可能泄露系统上运行的程序名称或工作负载信息，但文档未提醒用户这些输出应谨慎共享或在敏感环境中使用。
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This is a markdown file, so SQP-2 applies to missing safety/privacy warnings in the description. Although L011 notes that root privileges are required, the document does not clearly warn users about the visibility impact of monitoring live process/thread scheduling data or advise caution when running on production or multi-user systems.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: SQP-3 applies to all file types and includes language or locale policy violations. This document presents all user-facing guidance in Chinese and does not indicate that the user can select another language or that the skill is intentionally limited to a Chinese-language audience.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This is a markdown file, so SQP-2 applies to missing user warnings in the skill description. The examples include very high sampling rates and a production-environment example, and the document notes root/CAP_PERFMON requirements, but it does not explicitly warn that profiling can add overhead, affect system performance, or expose process names and call stacks during collection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document explicitly states that running this profiler requires root or CAP_PERFMON, but it does not warn that those privileges enable broad observation of system-wide performance events, kernel activity, and potentially other processes' execution characteristics. In a skill centered on Python-based custom event handling, this omission matters because users may be encouraged to run arbitrary analysis scripts with elevated observability and control without understanding the security implications.
Content: No source excerpt is available for this finding.