Security audit

minecraft-server-admin

Security checks across malware telemetry and agentic risk

Overview

This is a powerful but disclosed Minecraft RCON administration skill for servers the user controls, with sensitive credentials and command authority that require careful use.

Install only for Minecraft servers you control. Treat the RCON password as full administrator access, restrict RCON network exposure, review every command before confirming destructive or privilege-changing actions, and be aware that log analysis and audit memory can expose or retain player activity and admin history.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The documented scope expands from in-game RCON administration into host-level log file access via MC_SERVER_LOG. Reading local server logs can expose filesystem content, player identifiers, chat, IP-related data, plugin errors, and other sensitive operational details beyond the stated purpose of sending Minecraft admin commands.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill documentation instructs shell-style log access using a command such as tail against a path from MC_SERVER_LOG, introducing host command/file interaction not justified by pure RCON administration. Even if intended for diagnostics, this widens the attack surface from controlled RCON commands to local file access and potentially unsafe shell usage patterns around path handling.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The reference includes server maintenance and lifecycle commands such as /save-off and /stop even though the skill description explicitly says it does not handle full server lifecycle operations. This scope drift is dangerous because it can cause the agent or user to treat destructive server-ops actions as approved in-scope behavior, increasing the chance of accidental outage or data-loss-related misuse.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The documentation directly contradicts the manifest by presenting /stop and save-control commands as part of the available command set. In an agent setting, contradictions between manifest and reference material can lead to unsafe capability expansion, where the model performs shutdown or save-state operations that the skill was not supposed to expose.

Missing User Warnings

High

Confidence: 88% confidence
Finding: World-altering commands such as /fill, /setblock, and /clone can irreversibly modify large areas of the server world and are documented without any cautionary guidance. In an agent-driven RCON context, the lack of warnings or guardrails materially increases the risk of accidental griefing, mass block replacement, or destructive edits on production worlds.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The maintenance section includes risky operations like /save-off, /stop, and debugging/performance commands without adequate warnings, and some of these can cause service interruption or increase risk of data inconsistency if misused. Because this skill operates through remote console administration, undocumented risk around these commands can translate directly into production outages or unsafe server state changes.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:53