Security audit

ops-maintenance

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate operations-maintenance tool, but it grants broad server, command, credential, file-transfer, and notification access with weak guardrails and unsafe command handling.

Use this only in a controlled ops environment with explicit, least-privilege SSH keys and trusted inputs. Avoid broad cluster targets, do not store sensitive webhook or SMTP secrets until persistence is hardened, and treat upload/download, config snapshots, and command-based diagnostics as Review-worthy until confirmation gates, path restrictions, and shell-safe subprocess handling are added.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (41)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares only Bash and Read tools, but its documented behavior clearly relies on network access, shell execution, environment-sensitive data, SSH, SFTP, and external webhooks. This under-declaration weakens user consent and security review because operators may approve a skill believing it has narrower capabilities than it actually uses.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents the skill as an operations assistant, but the documented commands expand into remote command execution across clusters, file transfer, server inventory management, network probing, Docker/systemd inspection, and other administrative actions. That mismatch can cause users and reviewers to underestimate the breadth of privileged behavior and approve a more dangerous skill than intended.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill is presented primarily as a monitoring/auditing assistant, but it also includes SFTP upload/download and remote directory browsing capabilities that materially expand it into remote file manipulation. That broader capability increases risk because it enables modification or exfiltration of files on managed systems beyond passive inspection, especially if exposed to higher-level agent workflows without explicit operator approval.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This function executes local system commands based on input, which is a powerful capability that exceeds a typical read-only ops assistant and can directly affect the host environment. Although a validator is present, the surrounding code frequently constructs shell-style commands with pipes and redirections elsewhere, so any weakness or bypass in validation could lead to arbitrary code execution on the local machine.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The tracker stores full file contents in each snapshot, not just hashes or minimal metadata. For the listed targets such as sshd_config, nginx.conf, resolv.conf, and crontab, this can retain secrets, internal network details, usernames, or operational settings in a secondary location under the user's home directory, expanding the exposure surface beyond simple change tracking.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The code attempts to ensure the configuration directory exists by calling writeFile(configDir, ''), which writes to the directory path instead of creating a directory. This can break key creation and key persistence, causing encryption/decryption failures and potentially leading to loss of access to stored credentials or fallback to insecure operational behavior.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This file constructs shell commands by interpolating untrusted host, server, count, maxHops, and port values directly into ping, dig, nslookup, traceroute, nc, and mtr command strings before passing them to exec. In an ops-assistant context these parameters are likely user-controlled, so an attacker can inject shell metacharacters to achieve arbitrary command execution and turn the diagnostics feature into a local or remote SSRF/reconnaissance primitive.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The code calls validateCommand(cmd) but ignores its result, and the adjacent comment explicitly says the command may not be whitelisted and will be executed anyway. That defeats the apparent security control and signals that unsafe execution paths were knowingly left in place, making shell injection and policy bypass easier.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The container inspection path returns mount source/destination data and environment variable names, which can reveal filesystem layout, secret naming conventions, internal service topology, and operational details beyond basic health monitoring. In an ops assistant with remote and multi-host support, this metadata materially increases reconnaissance value and can expose sensitive infrastructure information even if values are masked.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The module relies on child_process.exec to build shell commands from runtime values such as search patterns, log paths, unit names, and time ranges. Because exec invokes a shell, any unescaped metacharacters in those inputs can lead to command injection and arbitrary command execution under the privileges of the process.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The code silently falls back to reading the operator's default private key from ~/.ssh/id_rsa when no explicit credential is supplied. That expands credential access beyond the caller's stated configuration and can cause unintended use of a highly privileged key against remote systems, especially in an ops/cluster-management skill that can target many hosts.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The fallback OpenSSL check builds a shell command by interpolating untrusted domain and port values directly into a string passed to exec(). If an attacker can influence those inputs, they can inject shell metacharacters and execute arbitrary commands on the host running the monitoring tool, which is especially serious in an ops/maintenance context.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill exposes upload, download, and remote listing features without an explicit warning that files may be transferred to or from remote systems, potentially overwriting local or remote data. In an ops context, these actions can move sensitive configuration, logs, keys, or application data with little user awareness.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The notification examples include Slack, DingTalk, Feishu, WeChat, generic webhooks, and SMTP credentials, but they do not warn that alerts and operational metadata may be sent to third-party services. This creates a real risk of leaking infrastructure details, incident data, or embedded credentials outside trusted boundaries.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Local command execution occurs without any user-facing warning, approval gate, or distinction between read-only and potentially mutating commands. In an agent setting, this increases the chance that a prompt-influenced or mistaken action will be executed on the host before the operator realizes the scope of access.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: Remote command execution over SSH gives the skill the ability to run commands across managed servers, but there is no user-visible consent or checkpoint before execution. In an agentic context this is dangerous because a bad prompt, compromised workflow, or validator weakness could trigger impactful actions fleet-wide on remote infrastructure.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Uploading files over SFTP performs a remote write operation, which can alter configuration, deploy binaries, or place unauthorized content on target systems. Without an explicit user-facing warning or approval barrier, this is a strong misuse primitive in an otherwise ops-focused skill.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Downloading files over SFTP writes to a local path and can overwrite local files or stage sensitive remote data onto the operator host. Without user confirmation, path restrictions, or overwrite protections, the function creates both integrity and confidentiality risks.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The code persists the full alert manager configuration to disk, including webhook URLs and SMTP credentials, in a predictable path under the user's home directory. Storing secrets in plaintext increases the chance of credential disclosure through local compromise, backups, logs, shared environments, or overly permissive file permissions; in an ops-maintenance skill this is especially sensitive because the credentials can enable outbound messaging abuse and access to internal notification infrastructure.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Snapshot files are written as plaintext JSON containing the full monitored configuration content, with no disclosure, redaction, or encryption. In an ops/security auditing context, the monitored files are especially likely to contain sensitive infrastructure details, making this more dangerous because the tool silently creates a concentrated archive of high-value configuration data.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code constructs shell commands with unquoted, user-influenced container identifiers and executes them via child_process.exec, which invokes a shell. An attacker controlling nameOrId, lines, or since could inject shell metacharacters and execute arbitrary commands locally or through the remote executor, making this a command injection risk rather than merely a disclosure/confirmation issue.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: Service-management methods build systemctl and journalctl command strings from serviceName, lines, and since, then execute them through exec or a remote executor. Because these parameters are inserted directly into shell commands, a crafted service name or time string can trigger arbitrary command execution on local or remote hosts.

Missing User Warnings

High

Confidence: 76% confidence
Finding: These methods expose direct remote file and recursive directory deletion over SFTP with no built-in guardrails such as path restrictions, confirmation hooks, or safety checks against dangerous targets. In an ops skill that can act on remote hosts and clusters, misuse or prompt-influenced invocation could cause immediate destructive impact, including wiping critical application or system directories.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: searchJournalctl interpolates user-influenced unit, since, pattern, and lines values directly into a shell command. An attacker controlling any of these inputs can break out of quoting or inject shell syntax, causing arbitrary command execution in addition to reading sensitive system logs.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The bulk analyze method constructs grep/journalctl shell pipelines from user-supplied logPaths and pattern values, then executes them with exec. In an ops tool that may run with elevated filesystem or host access, this enables arbitrary command execution and broad exposure of sensitive logs across multiple sources.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: src/utils/ssl-monitor.ts:185