Security audit

iDRAC

Security checks for vulnerabilities and agentic risk

Overview

Review recommended: this skill is for Dell iDRAC server management, but it handles powerful credentials with unsafe TLS and persistent plaintext caching.

Install only if you understand it will access out-of-band server management APIs. Prefer a least-privileged iDRAC account, avoid production use with curl -k, use trusted certificates or pinning, do not cache 1Password or environment credentials into plaintext files, and inspect the config file because it is executed as shell code.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/idrac.sh:76
Finding: TLS Certificate Verification Disabled for Authenticated iDRAC Requests
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/idrac.sh:39
Finding: Environment and 1Password Credentials Persisted in a Plaintext Cache
Content: View full analysis
&2 op item get "$op_item" --fields username,password --format json | \ jq -r '"\(.[0].value):\(.[1].value)"' > "$CREDS_FILE" chmod 600 "$CREDS_FILE" fi ;; env) if [ -z "${IDRAC_USER:-}" ] || [ -z "${IDRAC_PASS:-}" ]; then echo "Error: IDRAC_USER and IDRAC_PASS must be set for CREDS_SOURCE=env" >&2 exit 1 fi # Write ephemeral creds file for curl echo "${IDRAC_USER}:${IDRAC_PASS}" > "$CREDS_FILE" chmod 600 "$CREDS_FILE" ;; ``` ### Technical Analysis Both the `1password` and `env` credential sources write the username and password in cleartext to the persistent path `~/.idrac-credentials`. The environment path describes the file as “ephemeral,” but the script neither creates a temporary file nor registers a cleanup trap. The file therefore remains after the command terminates. Mode `600` limits routine access to the owning user, but it does not provide encryption or lifecycle control. The credential remains available to any later process running as that user, malware that compromises the account, administrative users, filesystem backups, or forensic recovery. The 1Password integration also undermines just-in-time secret retrieval by converting a vault-managed secret into a long-lived plaintext cache. The environment path additionally overwrites the shared credential file. A later invocation using `CREDS_SOURCE=file` can silently reuse credentials that were originally intended only for an environment-based invocation. ### Attack Path 1. The user selects `CREDS_SOURCE=env` or `CREDS_SOURC ...[truncated 1060 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/idrac.sh:7
Finding: Arbitrary Shell Execution Through Sourced Configuration File
Content: View full analysis
&2 echo "Create it with:" >&2 echo " mkdir -p ~/.config/idrac-skill" >&2 echo " cat > ~/.config/idrac-skill/config <&2 echo ' IDRAC_IP=""' >&2 echo ' CREDS_SOURCE="file" # or "1password" or "env"' >&2 echo " EOF" >&2 exit 1 fi # shellcheck source=/dev/null source "$CONFIG_FILE" ``` ### Technical Analysis The configuration is presented as a set of simple key/value assignments, but the script loads it with Bash `source`. Sourcing a file executes all shell syntax in that file, including command substitutions, function calls, redirections, external commands, and arbitrary scripts. The configuration path can also be replaced through the `IDRAC_CONFIG` environment variable. The script does not validate that the selected file is owned by the invoking user, is not writable by other users, resides in an expected directory, or contains only approved keys. Any command in the selected file executes during startup before the requested iDRAC command is processed. Exploitation requires an attacker to modify the configured file or influence the invocation environment so that `IDRAC_CONFIG` references an attacker-controlled file. Under those conditions, this becomes arbitrary code execution with the privileges of the user running the helper. ### Attack Path 1. An attacker gains write access to `~/.config/idrac-skill/config`, places a malicious file at a path selected through `IDRAC_CONFIG`, or influences a wrapper, service, or a ...[truncated 1131 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 89% confidence
Finding: The workflow permits direct curl access to a management API using Basic Auth or session tokens, and the skill supports destructive operations like power control. Without strict parameter validation and hard-coded endpoint/method allowlisting, a prompt-influenced agent could be steered into issuing unintended Redfish actions, exposing credentials to subprocess context, or performing unauthorized state changes on infrastructure.
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
md
3. **Determine operation type:** - **Read-only** (status, health, logs, inventory) → Execute directly - **Destructive** (power off, restart, BIOS changes) → Confirm with user first 4. **Query Redfish API** via curl + Basic Auth (or session token for batch ops) 5. **Parse JSON** with jq 6. **Surface findings** to user in natural language 7. **Never expose credentials** in responses

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Using curl with -k disables TLS certificate verification, allowing a man-in-the-middle attacker on the network to intercept or modify Redfish API traffic. Because these examples also use Basic Auth credentials, an attacker could steal administrator credentials or inject malicious responses while the operator believes they are communicating with the real iDRAC.
Content: Scanner excerpt · references/endpoints.md (reported line 5)May include surrounding context.
All examples use the helper script's api_get pattern. For raw curl:

bash
curl -k -s -u "$(cat "$CREDS_FILE")" "https://${IDRAC_IP}/redfish/v1${ENDPOINT}"

Table of Contents

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The session-creation request sends administrator credentials over HTTPS with certificate validation disabled via -k. That makes the authentication exchange vulnerable to interception by an active network attacker, who could capture the username/password and obtain a valid session token to control the server out-of-band.
Content: Scanner excerpt · references/endpoints.md (reported line 138)May include surrounding context.
bash
# Create session (returns X-Auth-Token in headers) SESSION_RESPONSE=$(curl -k -i -X POST \ -H "Content-Type: application/json" \ -d "{\"UserName\":\"${IDRAC_USER}\",\"Password\":\"${IDRAC_PASS}\"}" \ "https://${IDRAC_IP}/redfish/v1/SessionService/Sessions")

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: Using -k on authenticated follow-up requests means the session token is transmitted to any endpoint an attacker can impersonate, enabling session hijacking. An active attacker could also tamper with API responses, misleading operators about system health or inventory and potentially influencing later administrative actions.
Content: Scanner excerpt · references/endpoints.md (reported line 147)May include surrounding context.
md
SESSION_TOKEN=$(echo "$SESSION_RESPONSE" | grep -i "X-Auth-Token:" | awk '{print $2}' | tr -d '\r') # Use session token for subsequent calls curl -k -H "X-Auth-Token: $SESSION_TOKEN" \ "https://${IDRAC_IP}/redfish/v1/Systems/System.Embedded.1" | jq # Delete session when done

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Deleting the session with -k still transmits the active session token without server authentication, so a man-in-the-middle could capture the token even during cleanup. While the delete call itself is less sensitive than login, the insecure transport keeps the management session vulnerable until fully terminated.
Content: Scanner excerpt · references/endpoints.md (reported line 152)May include surrounding context.
Delete session when done

SESSION_URI=$(echo "$SESSION_RESPONSE" | grep -i "Location:" | awk '{print $2}' | tr -d '\r') curl -k -X DELETE -H "X-Auth-Token: $SESSION_TOKEN" "${SESSION_URI}"

text
## Power Operations

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: This power-control example combines a highly sensitive management action with disabled TLS verification and Basic Auth credentials. A network attacker could intercept credentials or alter the request in transit, potentially causing unauthorized power state changes to production servers and creating outage or recovery scenarios.
Content: Scanner excerpt · references/endpoints.md (reported line 162)May include surrounding context.
md
api_get "/Systems/System.Embedded.1" | jq -r '.PowerState' # Power on (if off) curl -k -s -u "$(cat "$CREDS_FILE")" \ -X POST -H "Content-Type: application/json" \ -d '{"ResetType":"On"}' \ "https://${IDRAC_IP}/redfish/v1/Systems/System.Embedded.1/Actions/ComputerSystem.Reset"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 70% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/idrac.sh (reported line 51)May include surrounding context.
sh
echo "Error: IDRAC_USER and IDRAC_PASS must be set for CREDS_SOURCE=env" >&2 exit 1 fi # Write ephemeral creds file for curl echo "${IDRAC_USER}:${IDRAC_PASS}" > "$CREDS_FILE" chmod 600 "$CREDS_FILE" ;;

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The script uses curl -k, disabling TLS certificate verification when connecting to the iDRAC endpoint. In a management-plane tool that handles administrator credentials and can query sensitive hardware state, this allows man-in-the-middle interception or spoofing of the remote host, especially on shared or untrusted networks.
Content: Scanner excerpt · scripts/idrac.sh (reported line 187)May include surrounding context.
sh
# Test 1: Network connectivity echo -n "1. Network connectivity... " if curl -k -s --connect-timeout 5 "https://${IDRAC_IP}/redfish/v1/" > /dev/null 2>&1; then echo "✅ OK" else echo "❌ FAILED (cannot reach ${IDRAC_IP})"

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill exposes shell-based operational capability but does not declare an explicit tool scope or permission boundary. That increases the risk that an agent invokes shell commands more broadly than intended, especially because the skill can perform both read-only and destructive management actions against remote hardware.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 77% confidence
Finding: The skill directs the user to create persistent local configuration under ~/.config/idrac-skill/config, which establishes durable state for future executions. Persistent state is not inherently malicious, but in a security-sensitive skill it can be abused if altered by another local process or used to silently retain sensitive connection targets and behavior across sessions.
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
First-Time Setup

Create a config file at ~/.config/idrac-skill/config:

bash
mkdir -p ~/.config/idrac-skill

Session Persistence

Medium

Category: Rogue Agent
Confidence: 92% confidence
Finding: The skill instructs users to store username:password persistently in ~/.idrac-credentials. Even with mode 600, plaintext credential caching materially increases the impact of local compromise, accidental backup/sync leakage, or reuse by other processes, especially since these credentials control remote server management interfaces.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
# OP_ITEM="<1password-item-name>" # # For CREDS_SOURCE="file": # Create ~/.idrac-credentials with contents: username:password # chmod 600 ~/.idrac-credentials # # For CREDS_SOURCE="env":

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/endpoints.md (reported line 138)May include surrounding context.
bash
# Create session (returns X-Auth-Token in headers) SESSION_RESPONSE=$(curl -k -i -X POST \ -H "Content-Type: application/json" \ -d "{\"UserName\":\"${IDRAC_USER}\",\"Password\":\"${IDRAC_PASS}\"}" \ "https://${IDRAC_IP}/redfish/v1/SessionService/Sessions")

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file includes commands for powering on, shutting down, and force restarting a server, which can affect system availability and running workloads. The section labels describe the actions, but there is no explicit warning or caution advising users that these commands are disruptive or potentially service-impacting.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/endpoints.md (reported line 162)May include surrounding context.
md
api_get "/Systems/System.Embedded.1" | jq -r '.PowerState' # Power on (if off) curl -k -s -u "$(cat "$CREDS_FILE")" \ -X POST -H "Content-Type: application/json" \ -d '{"ResetType":"On"}' \ "https://${IDRAC_IP}/redfish/v1/Systems/System.Embedded.1/Actions/ComputerSystem.Reset"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/idrac.sh (reported line 14)May include surrounding context.
sh
load_config() { if [ ! -f "$CONFIG_FILE" ]; then echo "Error: Config not found at $CONFIG_FILE" >&2 echo "Create it with:" >&2 echo " mkdir -p ~/.config/idrac-skill" >&2 echo " cat > ~/.config/idrac-skill/config <<EOF" >&2 echo ' IDRAC_IP="<your-idrac-ip>"' >&2

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Credentials retrieved from 1Password are cached into ~/.idrac-credentials and reused indefinitely until manually removed. This weakens the security benefit of using a secret manager by converting managed secrets into a persistent local plaintext credential file.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
echo "Hydrating credentials from 1Password ($op_item)..." >&2 op item get "$op_item" --fields username,password --format json | \ jq -r '"\(.[0].value):\(.[1].value)"' > "$CREDS_FILE" chmod 600 "$CREDS_FILE" fi ;; env)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
md
echo "Hydrating credentials from 1Password ($op_item)..." >&2 op item get "$op_item" --fields username,password --format json | \ jq -r '"\(.[0].value):\(.[1].value)"' > "$CREDS_FILE" chmod 600 "$CREDS_FILE" fi ;; env)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/idrac.sh (reported line 43)May include surrounding context.
sh
echo "Hydrating credentials from 1Password ($op_item)..." >&2 op item get "$op_item" --fields username,password --format json | \ jq -r '"\(.[0].value):\(.[1].value)"' > "$CREDS_FILE" chmod 600 "$CREDS_FILE" fi ;; env)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/idrac.sh (reported line 53)May include surrounding context.
sh
echo "Hydrating credentials from 1Password ($op_item)..." >&2 op item get "$op_item" --fields username,password --format json | \ jq -r '"\(.[0].value):\(.[1].value)"' > "$CREDS_FILE" chmod 600 "$CREDS_FILE" fi ;; env)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/idrac.sh (reported line 58)May include surrounding context.
sh
echo "Hydrating credentials from 1Password ($op_item)..." >&2 op item get "$op_item" --fields username,password --format json | \ jq -r '"\(.[0].value):\(.[1].value)"' > "$CREDS_FILE" chmod 600 "$CREDS_FILE" fi ;; env)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: When CREDS_SOURCE=env, the script writes IDRAC_USER and IDRAC_PASS into ~/.idrac-credentials on disk. Even with mode 600, this creates unnecessary secret persistence, increasing exposure through backups, endpoint compromise, or later local access by the same account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The markdown shows creating a session by sending username and password and then extracting and reusing an authentication token. While this is expected for the task, the documentation does not warn users that credentials and tokens are sensitive and should be handled carefully, especially when captured in shell variables or command history.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tool Parameter Abuse

Tool Parameter Abuse

Table of Contents

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Delete session when done

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Undeclared Tool Scope

Session Persistence

First-Time Setup

Session Persistence

External Transmission

Missing User Warnings

External Transmission

Session Persistence

Missing User Warnings

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings

Missing User Warnings

Static analysis