Goto Cloudserver Manager

• Outcome: Review
• Latest audit: Jul 10, 2026 · 10:01 AM UTC
• Version: 1.0.6

Overview

This appears to be a genuine cloud/server operations skill, but it needs Review because it handles cloud credentials and can make high-impact infrastructure changes with weak safeguards in several paths.

Install only in a tightly controlled environment with least-privilege, short-lived cloud credentials. Do not paste production secrets into chat; prefer a real secret manager or scoped environment injection. Review every generated plan before confirming, avoid production restores/reboots/firewall changes unless you have backups and a rollback path, and disable or remove the local executor fallback before using this against real infrastructure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (50)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def execute(self, command: str, timeout: int = 60) -> ExecutionResult:
        logger.debug("local_execute", command=command[:80])
        try:
            result = subprocess.run(
                command,
                shell=self._shell,
                capture_output=True,

• Confidence: 96% confidence
• Finding: The executor passes a caller-controlled command string directly to subprocess.run with shell=True, which enables arbitrary shell execution on the local host. In a skill that automates server operations, this is especially dangerous because upstream inputs may be influenced by users, configs, or LLM-generated content, turning this into command injection or unrestricted code execution.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares powerful operational behavior such as writing local configuration, handling environment secrets, and invoking remote execution pathways, but it does not declare corresponding permissions. This creates a transparency and enforcement gap: users or the platform may underestimate the skill’s access, while the skill can still influence files, credentials, and shell-like execution flows through its implementation and dependencies.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The public description frames the skill mainly as database installation, schema management, monitoring, and reporting, but the documented capabilities extend to remote command execution, firewall and security-group modification, WinRM enablement, service restarts, backups/restores, and log access. This mismatch is dangerous because it can mislead users into granting trust to what appears to be a narrower admin tool while it actually has broad infrastructure control over cloud instances and network exposure.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill description emphasizes database installation, schema creation, monitoring, and health reporting, but the dispatcher also exposes host firewall and cloud security-group modification actions. That capability expansion materially changes the trust boundary: an agent expected to do DB ops can also open network access, which can expose databases or management ports to unintended sources. In this context, infrastructure access-control changes are especially sensitive because they can directly enable remote compromise or data exposure.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The dispatcher includes broader infrastructure-control actions such as service restart and instance reboot beyond the stated monitoring/database-management scope. Even if not inherently malicious, this mismatch can mislead operators and upstream agents about the skill's real power, enabling denial-of-service or disruptive changes when only read-only or limited DB automation was expected. Skill-context-wise, this is more dangerous because cloud/server management actions are operationally impactful and often run with elevated privileges.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Falling back to a LocalExecutor gives a remote multi-cloud management skill the ability to execute commands on the machine hosting the skill whenever connection type routing does not match expected remote executors. That creates a severe trust-boundary violation: user-supplied action flows intended for remote servers could be redirected into local execution, risking compromise of the orchestrator host, local secrets, CI runner, or control plane. In this skill context, that is especially dangerous because the host likely stores cloud credentials and has broad management access.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This class provides a general-purpose local command runner that can execute arbitrary host commands, which exceeds the stated scope of multi-cloud server O&M and creates a powerful local execution primitive. In the context of an agent skill, such broad capability can be abused to access files, alter the environment, pivot to other systems, or execute destructive actions on the machine running the agent.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The docstring claims the executor is intended for testing and local debugging, but the implementation contains no enforcement of that restriction. This mismatch can lead to accidental or unintended use in production, where the arbitrary local execution behavior becomes materially more dangerous.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script goes beyond package installation and silently changes PostgreSQL to accept non-local connections by editing postgresql.conf and pg_hba.conf. In an automation skill for multi-cloud server operations, this is especially dangerous because it can expose a newly installed database across a large internal network range without validating the deployment context or expected security controls.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script collects and prints IP addresses, subnet masks, and recent system error log messages, which are sensitive operational details that can aid reconnaissance or expose internal environment information if the output is shared, logged centrally, or returned to an untrusted caller. In a multi-cloud server management skill, health checks are expected, but this output goes beyond minimal status reporting and increases information disclosure risk.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The adapter exposes functionality to modify security group rules by opening ports, which materially expands the skill's operational scope beyond the declared database installation, schema creation, monitoring, and health reporting use cases. In an automation skill, this can weaken network boundaries and create unintended exposure if called with broad CIDRs or unsafe ports, especially because the method is directly reachable from the provider abstraction.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This file implements security group enumeration and modification, which expands the skill's capabilities beyond the declared scope of database installation, schema creation, monitoring inspection, and health reporting. In an agentic environment, undeclared network-control functionality is dangerous because it can be used to alter host exposure and create persistence or lateral-movement paths that a user may not expect from this skill.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The README explicitly instructs users to paste cloud AccessKey/Secret values into a chat interface, which can expose secrets through conversation history, client/server logs, screenshots, telemetry, or other agents with chat access. In the context of an ops skill that manages multi-cloud servers, compromise of these credentials could enable broad unauthorized access to infrastructure and downstream systems.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README normalizes automatic writing of cloud credentials into a local `.env` file without discussing that `.env` is plaintext and may be readable by other local users, accidentally committed to source control, included in backups, or exposed via support bundles. Because the skill is for cloud/server administration, plaintext storage of infrastructure credentials materially increases the blast radius if the workstation or repository is compromised.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger keywords include broad phrases such as cloud server, install database, create table, health report, and log analysis that may appear in ordinary discussion. In a skill capable of infrastructure changes and remote execution, overly broad triggers increase the chance of accidental activation, unintended plan generation, or users being funneled into risky operations without realizing this skill was selected.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill is explicitly marketed as usable through unrestricted natural-language dialogue, yet it includes capabilities that can alter cloud instances, databases, firewall rules, and remote-management settings. Without strong activation boundaries, natural-language ambiguity, prompt injection through surrounding conversation, or simple misunderstanding can lead to selection of a highly privileged skill in contexts where the user intended only discussion or advice.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The file states that the system can trigger complete operational workflows directly by task name, but it does not define strict trigger constraints, authorization boundaries, or exclusions for high-risk tasks. In this skill, task names map to sensitive actions such as database installation, firewall changes, user creation, schema application, and backups, so ambiguous invocation semantics could let a user or upstream agent invoke destructive or privileged workflows too easily.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script accepts the MySQL password as a positional argument and passes it to mysqldump via -p on the command line. Command-line arguments can be exposed to other local users through process listings, shell history, orchestration logs, or audit systems, which can leak database credentials in an ops environment where this skill is likely to run unattended or under automation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script accepts the MySQL password as a positional argument and passes it to mysql via -p<password>, which can expose credentials through process listings, shell history, audit logs, or orchestration tooling. In an automation/ops skill that may run on shared bastions or CI/CD runners, this increases the chance of credential disclosure and subsequent database compromise.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The restore logic performs destructive operations (`pg_restore --clean --if-exists` or replaying arbitrary SQL with `psql -f`) without any confirmation, dry-run mode, or environment guardrails. In an automation skill for multi-cloud server operations, a wrong database name, wrong backup file, or accidental invocation could overwrite or drop existing objects and cause data loss.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script passes the Redis password via the command line using `redis-cli -a`, which can expose the secret to other local users through process listings, shell history, job control output, or audit logs. In an automated multi-cloud ops skill, this is more dangerous because credentials are likely to be reused across production environments and invoked by orchestration tooling where process arguments may be captured centrally.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script performs a forced database restore with `REPLACE` after setting the target database to `SINGLE_USER WITH ROLLBACK IMMEDIATE`, which can terminate active sessions and overwrite an existing database without any confirmation, dry-run mode, or protective checks. In an automation skill for multi-cloud server operations, this is especially dangerous because a wrong parameter, stale backup path, or accidental invocation can cause immediate destructive data loss and service interruption.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The SQL helper builds shell command strings by interpolating SQL directly into command-line invocations such as mysql, psql, sqlcmd, and redis-cli. Escaping is inconsistent and incomplete across database types, so attacker-controlled SQL or database command text can break shell quoting or inject additional shell arguments/commands, leading to arbitrary command execution or destructive database actions in a high-privilege automation context.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The WinRM session explicitly sets server_cert_validation='ignore', which disables TLS certificate validation and makes the connection vulnerable to man-in-the-middle interception and host impersonation. In a multi-cloud server management skill that executes administrative commands, this can expose credentials and allow an attacker to tamper with remote operations at high privilege.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The script prints the MySQL root password to stdout at the end, whether it was generated automatically or supplied by the caller. In automation environments, stdout is commonly captured by CI/CD logs, orchestration systems, shell history wrappers, or remote execution consoles, which can expose a privileged database credential far beyond the intended operator.

Static analysis

No suspicious patterns detected.