DevOps Agent

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:23 PM UTC
• Version: 1.0.1

Overview

This DevOps skill is not clearly malicious, but it can make persistent privileged system changes and includes unsafe scripts that could be abused during backups, monitoring setup, or rollback.

Install only in a disposable or carefully controlled environment unless you are prepared to audit and harden the scripts first. Before use, remove curl-to-shell and apt-key patterns, require non-default Grafana credentials, validate backup and rollback inputs, verify downloaded binaries, bind monitoring endpoints conservatively, and review every cron/systemd/sudo action before approving it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup-generator.sh:35

Finding

Unvalidated backup parameters enable generated-script and cron command injection

Content

View full analysis

/dev/null | grep -v "$SCRIPT_PATH"; echo "$SCHEDULE $SCRIPT_PATH >> ${LOG_FILE} 2>&1") | crontab - echo -e "${GREEN}[✓]${NC} cron 任务已添加" fi ``` ### Technical Analysis The generator accepts backup type, target, destination, schedule, retention, output directory, and notification type as arbitrary strings. Several values are interpolated directly into executable shell source inside double-quoted assignments. Embedded quotes, command substitutions, shell metacharacters, or newline characters can break out of the intended assignment and add commands to the generated backup script. The cron schedule and generated script path are also inserted directly into crontab text. In particular, a newline in `SCHEDULE` or `SCRIPT_PATH` can create an additional cron entry. The resulting payload persists and is executed by cron with the privileges of the user wh ...[truncated 1234 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/rollback.sh:110

Finding

Untrusted rollback metadata can direct destructive and privileged file operations

Content

View full analysis

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/preflight-check.sh:124

Finding

Preflight guidance recommends executing mutable remote content directly in a shell

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:316

Finding

Monitoring executables are installed without integrity or authenticity verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/systemd-templates.md:307

Finding

Prometheus and node_exporter listen on all network interfaces by default

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:426

Finding

Grafana automation uses default administrative credentials and exposes them in command arguments

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (125)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill advertises safety-first deploy/monitor/backup/diagnose behavior, but the documented behavior also includes generating executable backup scripts, installing cron jobs, enabling services, and transferring data to remote destinations that are not clearly reflected in the high-level description. This mismatch can cause users to grant trust or invoke the skill without understanding that it can establish persistence and move data off-host.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill advertises safety-first deploy/monitor/backup/diagnose behavior, but the documented behavior also includes generating executable backup scripts, installing cron jobs, enabling services, and transferring data to remote destinations that are not clearly reflected in the high-level description. This mismatch can cause users to grant trust or invoke the skill without understanding that it can establish persistence and move data off-host.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Piping a downloaded GPG key directly into 'sudo apt-key add -' chains unverified network input into a privileged trust-establishment command. This pattern is dangerous because it can silently grant package trust to attacker-controlled content if the source is compromised.

Content

Scanner excerpt · SKILL.md (reported line 411)May include surrounding context.

bash

# Ubuntu/Debian
sudo apt-get install -y apt-transport-https software-properties-common
wget -q -O - https://apt.grafana.com/gpg.key | sudo apt-key add -
echo "deb https://apt.grafana.com stable main" | sudo tee /etc/apt/sources.list.d/grafana.list
sudo apt-get update && sudo apt-get install -y grafana

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 412)May include surrounding context.

md

# Ubuntu/Debian
sudo apt-get install -y apt-transport-https software-properties-common
wget -q -O - https://apt.grafana.com/gpg.key | sudo apt-key add -
echo "deb https://apt.grafana.com stable main" | sudo tee /etc/apt/sources.list.d/grafana.list
sudo apt-get update && sudo apt-get install -y grafana

sudo systemctl daemon-reload

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/systemd-templates.md (reported line 26)May include surrounding context.

md

# 环境变量
Environment=NODE_ENV=production
Environment=PORT={{PORT:-3000}}
EnvironmentFile=-{{DEPLOY_DIR}}/.env

# 启动命令
ExecStart=/usr/bin/node {{ENTRY_POINT:-dist/index.js}}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/systemd-templates.md (reported line 75)May include surrounding context.

md

# 环境变量
Environment=NODE_ENV=production
Environment=PORT={{PORT:-3000}}
EnvironmentFile=-{{DEPLOY_DIR}}/.env

# 启动命令
ExecStart=/usr/bin/node {{ENTRY_POINT:-dist/index.js}}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/systemd-templates.md (reported line 126)May include surrounding context.

md

# 环境变量
Environment=NODE_ENV=production
Environment=PORT={{PORT:-3000}}
EnvironmentFile=-{{DEPLOY_DIR}}/.env

# 启动命令
ExecStart=/usr/bin/node {{ENTRY_POINT:-dist/index.js}}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/systemd-templates.md (reported line 172)May include surrounding context.

md

# 环境变量
Environment=NODE_ENV=production
Environment=PORT={{PORT:-3000}}
EnvironmentFile=-{{DEPLOY_DIR}}/.env

# 启动命令
ExecStart=/usr/bin/node {{ENTRY_POINT:-dist/index.js}}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/systemd-templates.md (reported line 217)May include surrounding context.

md

# 环境变量
Environment=NODE_ENV=production
Environment=PORT={{PORT:-3000}}
EnvironmentFile=-{{DEPLOY_DIR}}/.env

# 启动命令
ExecStart=/usr/bin/node {{ENTRY_POINT:-dist/index.js}}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 62% confidence

Finding

The generic service template combines a broad EnvironmentFile with fully parameterized ExecStartPre/ExecStart/ExecStartPost commands. In a templating agent context, this increases the chance that sensitive values from .env are consumed by arbitrary shell commands or leaked through process listings, wrapper scripts, or logs if untrusted input reaches these placeholders.

Content

Scanner excerpt · references/systemd-templates.md (reported line 260)May include surrounding context.

md

Group={{SERVICE_GROUP:-www-data}}
WorkingDirectory={{DEPLOY_DIR}}

EnvironmentFile=-{{DEPLOY_DIR}}/.env

ExecStartPre={{PRE_START_CMD}}
ExecStart={{START_CMD}}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

BACKUP_DIR in the generated script is overridable via the BACKUP_BASE_DIR environment variable, and cleanup executes rm -f "${BACKUP_DIR}/.tmp_backup_*" on exit. An attacker or confused operator can point BACKUP_BASE_DIR at an arbitrary location, causing deletion of matching files outside the intended backup directory; in a privileged execution context this becomes a meaningful integrity risk.

Content

Scanner excerpt · scripts/backup-generator.sh (reported line 121)May include surrounding context.

sh

send_notification "❌ 备份失败: ${BACKUP_TYPE} - ${TARGET}" "exit code: $exit_code"
    fi
    # 清理临时文件
    rm -f "${BACKUP_DIR}/.tmp_backup_*" 2>/dev/null || true
}
trap cleanup EXIT

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The | sudo pattern indicates a recommendation to pipe unreviewed remote content directly into a privileged shell. Even though this script does not execute the pipeline, embedding such a one-liner in an operational assistant materially increases the chance that an operator will run a dangerous command with elevated privileges.

Content

Scanner excerpt · scripts/preflight-check.sh (reported line 127)May include surrounding context.

sh

docker)     echo "curl -fsSL https://get.docker.com | sh" ;;
                nginx)      echo "sudo apt install nginx  # 或 sudo yum install nginx" ;;
                certbot)    echo "sudo apt install certbot python3-certbot-nginx" ;;
                node|nodejs) echo "curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt install -y nodejs" ;;
                python3)    echo "sudo apt install python3 python3-pip python3-venv" ;;
                go)         echo "wget https://go.dev/dl/go1.22.0.linux-$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz && sudo tar -C /usr/local -xzf go*.tar.gz" ;;
                git)        echo "sudo apt install git" ;;

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The | sudo pattern indicates a recommendation to pipe unreviewed remote content directly into a privileged shell. Even though this script does not execute the pipeline, embedding such a one-liner in an operational assistant materially increases the chance that an operator will run a dangerous command with elevated privileges.

Content

Scanner excerpt · scripts/preflight-check.sh (reported line 127)May include surrounding context.

sh

docker)     echo "curl -fsSL https://get.docker.com | sh" ;;
                nginx)      echo "sudo apt install nginx  # 或 sudo yum install nginx" ;;
                certbot)    echo "sudo apt install certbot python3-certbot-nginx" ;;
                node|nodejs) echo "curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt install -y nodejs" ;;
                python3)    echo "sudo apt install python3 python3-pip python3-venv" ;;
                go)         echo "wget https://go.dev/dl/go1.22.0.linux-$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz && sudo tar -C /usr/local -xzf go*.tar.gz" ;;
                git)        echo "sudo apt install git" ;;

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md

certbot)    echo "sudo apt install certbot python3-certbot-nginx" ;;
                node|nodejs) echo "curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt install -y nodejs" ;;
                python3)    echo "sudo apt install python3 python3-pip python3-venv" ;;
                go)         echo "wget https://go.dev/dl/go1.22.0.linux-$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz && sudo tar -C /usr/local -xzf go*.tar.gz" ;;
                git)        echo "sudo apt install git" ;;
                curl)       echo "sudo apt install curl" ;;
                wget)       echo "sudo apt install wget" ;;

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 413)May include surrounding context.

md

certbot)    echo "sudo apt install certbot python3-certbot-nginx" ;;
                node|nodejs) echo "curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt install -y nodejs" ;;
                python3)    echo "sudo apt install python3 python3-pip python3-venv" ;;
                go)         echo "wget https://go.dev/dl/go1.22.0.linux-$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz && sudo tar -C /usr/local -xzf go*.tar.gz" ;;
                git)        echo "sudo apt install git" ;;
                curl)       echo "sudo apt install curl" ;;
                wget)       echo "sudo apt install wget" ;;

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/preflight-check.sh (reported line 129)May include surrounding context.

sh

certbot)    echo "sudo apt install certbot python3-certbot-nginx" ;;
                node|nodejs) echo "curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt install -y nodejs" ;;
                python3)    echo "sudo apt install python3 python3-pip python3-venv" ;;
                go)         echo "wget https://go.dev/dl/go1.22.0.linux-$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz && sudo tar -C /usr/local -xzf go*.tar.gz" ;;
                git)        echo "sudo apt install git" ;;
                curl)       echo "sudo apt install curl" ;;
                wget)       echo "sudo apt install wget" ;;

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The rollback logic uses attacker-controllable snapshot metadata (nginx_site.txt) to construct a privileged file deletion target: /etc/nginx/sites-enabled/$site_name. In a DevOps rollback skill, snapshots may be treated as trusted operational artifacts, which makes this more dangerous: a tampered snapshot can transform a routine recovery workflow into arbitrary root-level file deletion and potentially system compromise or denial of service.

Content

Scanner excerpt · scripts/rollback.sh (reported line 257)May include surrounding context.

sh

else
                # 如果之前没有配置，删除新建的
                run_cmd sudo rm -f "$nginx_conf"
                run_cmd sudo rm -f "/etc/nginx/sites-enabled/$site_name"
            fi

            run_cmd sudo nginx -t && run_cmd sudo systemctl reload nginx

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

allowed-tools:
  - Bash
  - Read
  - Write
  - Edit
  - Glob
  - Grep

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill promises never to print secrets, yet later instructs use of curl with HTTP basic auth containing the Grafana admin password on the command line. Command-line credentials can be exposed through shell history, process listings, audit logs, or debugging output, undermining the stated secret-handling guarantee.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill claims all commands support dry-run mode, but many documented flows directly perform package installation, file writes, service enablement, cron creation, network requests, and other state changes without a defined non-executing branch. In a privileged DevOps skill, a missing dry-run path can lead to unintended production changes despite user expectations of preview-only behavior.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 309)May include surrounding context.

md

2. **必需工具检查**：根据命令所需检查 docker/nginx/certbot/node/python 等
3. **网络连通性**：检测外网访问、DNS 解析
4. **磁盘空间**：确保目标分区剩余空间 > 1GB
5. **权限检查**：当前用户、sudo 可用性

---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

2. **必需工具检查**：根据命令所需检查 docker/nginx/certbot/node/python 等
3. **网络连通性**：检测外网访问、DNS 解析
4. **磁盘空间**：确保目标分区剩余空间 > 1GB
5. **权限检查**：当前用户、sudo 可用性

---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 843)May include surrounding context.

md

2. **必需工具检查**：根据命令所需检查 docker/nginx/certbot/node/python 等
3. **网络连通性**：检测外网访问、DNS 解析
4. **磁盘空间**：确保目标分区剩余空间 > 1GB
5. **权限检查**：当前用户、sudo 可用性

---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 935)May include surrounding context.

md

2. **必需工具检查**：根据命令所需检查 docker/nginx/certbot/node/python 等
3. **网络连通性**：检测外网访问、DNS 解析
4. **磁盘空间**：确保目标分区剩余空间 > 1GB
5. **权限检查**：当前用户、sudo 可用性

---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/systemd-templates.md (reported line 377)May include surrounding context.

md

2. **必需工具检查**：根据命令所需检查 docker/nginx/certbot/node/python 等
3. **网络连通性**：检测外网访问、DNS 解析
4. **磁盘空间**：确保目标分区剩余空间 > 1GB
5. **权限检查**：当前用户、sudo 可用性

---