CitrineOS Assistant

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:09 PM UTC
• Version: 1.0.1

Overview

The skill is coherent for installing and operating CitrineOS, but it gives high-impact deployment and EV charging operations guidance with under-scoped safety controls.

Review this skill carefully before installing. It is not deceptive, but it can guide an agent to make privileged host changes, run unpinned upstream code, start or stop infrastructure services, and call EV charging operations APIs. Use it only in a test or controlled deployment unless you pin reviewed versions, keep backend ports private, require explicit confirmation for operational actions, and verify authentication and firewall settings.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: skill.md:40
• Finding: Unpinned Remote Source and Dependencies Are Built and Executed## Vulnerability Details **File Location**: `skill.md`, lines 40-42 **Vulnerability Type**: Remote payload retrieval and insecure dependency execution **Risk Level**: High **Complete Code Snippet**: ```bash 1. Clone: `git clone https://github.com/citrineos/citrineos-core` 2. Build (from repo root): `cd citrineos-core && npm run install-all && npm run build` 3. Start: `cd Server && docker-compose -f docker-compose.yml up -d` ``` ### Technical Analysis The installation procedure clones the mutable default branch of an external Git repository without pinning or verifying a reviewed release, tag, or commit hash. It then invokes `npm run install-all`, which may download third-party packages and execute package lifecycle scripts, before building the retrieved code and starting its Docker services. The effective code executed by this skill can therefore change after the skill itself has been reviewed. HTTPS authenticates the connection to GitHub but does not establish that the current repository contents or transitive dependencies match a previously audited version. No commit verification, release-signature verification, lockfile enforcement, dependency integrity review, or container image digest verification is required by the instructions. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or a transitive npm dependency. 2. The attacker adds malicious code to the default branch, an installation script, a package lifecycle hook, or a dependency release. 3. A user asks the skill to install CitrineOS. 4. The skill clones the current mutable upstream content. 5. `npm run install-all` downloads dependencies and may execute attacker-controlled lifecycle scripts. 6. The resulting code is built, and Docker Compose starts the affected services. 7. Malicious code executes with the permissions available to the invoking user, npm process, or containers. ### Impact Asse ...[truncated 768 chars]
• Remediation: ## Remediation Suggestions 1. Pin installation to a reviewed release tag and immutable commit SHA rather than cloning the default branch. 2. Verify that the checked-out commit exactly matches the expected SHA before running any npm or Docker command. 3. Where upstream signing is available, verify signed release tags or artifacts against a documented trusted maintainer key. 4. Require a committed lockfile and use a lockfile-enforcing installation command such as `npm ci` instead of an unconstrained dependency installation. 5. Review package lifecycle scripts and consider disabling them during installation with `--ignore-scripts`, enabling only explicitly required scripts after review. 6. Pin container images by immutable digest and verify signatures or provenance where supported. 7. Run builds in an isolated, non-privileged environment without production credentials or sensitive host mounts. 8. Document the exact reviewed CitrineOS version, dependency-lockfile hash, and expected artifact checksums.

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:57
• Finding: Cloud Guidance May Lead Users to Expose Sensitive Backend Services## Vulnerability Details **File Location**: `skill.md`, lines 57-64 **Vulnerability Type**: Unsafe network and cloud firewall configuration guidance **Risk Level**: Medium **Complete Code Snippet**: ```markdown ### Path C: Cloud Hosting (AWS, GCP, Azure, VPS) - **VPS (DigitalOcean, Linode, Vultr):** Create droplet → SSH in → install Docker → follow Path A - **AWS EC2:** Launch Ubuntu instance → install Docker → clone and run - **Railway / Render / Fly.io:** These support Dockerfile deployments; check if CitrineOS has a Dockerfile and guide accordingly For cloud, always remind about: firewall rules (ports 8080, 8081, 8082, 5432, 5672), security groups, and env vars. ``` ### Technical Analysis The cloud deployment instructions identify application ports alongside PostgreSQL port `5432` and RabbitMQ port `5672` but do not distinguish public endpoints from private backend services. They also do not specify source-address restrictions, private subnet placement, transport encryption, authentication requirements, or deny-by-default firewall rules. A user with limited infrastructure experience could interpret the listed ports as ports that should all be opened in a cloud security group. This can expose the database or message broker directly to the public Internet. The same file also identifies additional management services, including RabbitMQ management, MinIO, and Hasura, but provides no explicit rule that these interfaces must remain private. ### Attack Path 1. A user follows the cloud-hosting instructions and deploys CitrineOS to a public virtual machine. 2. The user creates an inbound firewall or security-group rule covering all ports listed by the skill. 3. PostgreSQL on port `5432` or RabbitMQ on port `5672` becomes reachable from untrusted networks. 4. An attacker scans the public address and identifies the exposed service. 5. The attacker attempts credential guessing, exploits weak/default credentials, abuses a s ...[truncated 878 chars]
• Remediation: ## Remediation Suggestions 1. Explicitly state that PostgreSQL, RabbitMQ, MinIO, Hasura, and all management interfaces must not be exposed to the public Internet. 2. Place backend services on a private Docker network or private cloud subnet and remove public security-group rules for ports such as `5432`, `5672`, `15672`, `8090`, `9000`, and `9001`. 3. Expose only application and OCPP endpoints that are operationally required, using narrowly scoped source CIDRs whenever possible. 4. Put public HTTP and WebSocket traffic behind an authenticated, TLS-enabled reverse proxy or load balancer. 5. Apply deny-by-default host firewall and cloud security-group policies. 6. Require unique, strong credentials for every backend service and store them in an appropriate cloud secret manager rather than plaintext environment files. 7. Enable TLS for database and broker connections where traffic can cross host or trust boundaries. 8. Restrict administrative interfaces to a VPN, bastion host, or identity-aware access proxy. 9. Add post-deployment verification steps that inspect listening sockets, published Docker ports, and effective cloud firewall rules.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Chaining Abuse

High

• Category: Tool Misuse

Content

**Windows:** Docker Desktop — https://docs.docker.com/get-docker/ or `winget install Docker.DockerDesktop`
**macOS:** `brew install --cask docker` or download from docker.com
**Linux:** Use the official package manager or follow https://docs.docker.com/engine/install/ — e.g. Ubuntu: `sudo apt-get update && sudo apt-get install -y docker.io` (prefer package manager over remote script execution)

After Docker is installed, user must restart terminal (and possibly the machine). Then proceed with Path A.

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list includes broad terms such as 'charging' and 'install system' that can match many unrelated user requests, causing the skill to activate outside its intended EV/OCPP context. Over-broad activation increases the chance that shell/http/filesystem-capable guidance is applied to the wrong task, which can lead to unintended command execution or unsafe operational advice.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Windows:** Docker Desktop — https://docs.docker.com/get-docker/ or `winget install Docker.DockerDesktop`
**macOS:** `brew install --cask docker` or download from docker.com
**Linux:** Use the official package manager or follow https://docs.docker.com/engine/install/ — e.g. Ubuntu: `sudo apt-get update && sudo apt-get install -y docker.io` (prefer package manager over remote script execution)

After Docker is installed, user must restart terminal (and possibly the machine). Then proceed with Path A.

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- **Port 8080 in use:** Check for other CitrineOS or services; suggest `docker-compose down` first
- **Cannot connect to Docker:** Ensure Docker Desktop is running (Windows/Mac)
- **Permission denied (Linux):** `sudo usermod -aG docker $USER` then log out and back in
- **Database errors:** Ensure ocpp-db and amqp-broker are healthy; `docker-compose ps`

## Examples

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The skill recommends `docker-compose down` to stop services without warning that it will immediately interrupt the charging backend and dependent services. In an EV charging infrastructure context, abrupt service shutdown can disrupt station communications, transactions, and operational availability.

Static analysis

No suspicious patterns detected.