Security audit

Trace Debuger

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for trace debugging, but it can send raw operational logs and repository context into Codex without enough scoping, redaction, or user control.

Install only if you are comfortable with trace logs and selected repository context being processed by Codex and written into a local Markdown report. Use sanitized logs, avoid production secrets or customer data, restrict Jaeger and Elasticsearch URLs to trusted endpoints, and delete generated reports yourself if they should not persist.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/trace_debuger.py:149
Finding: Unredacted Elasticsearch Logs Are Forwarded to an External-Capable Analysis Process
Content: View full analysis
Tuple[Optional[str], Optional[str]]: if not repo_path or not os.path.isdir(repo_path): return None, "repo_path 不存在，跳过 codex 分析" # 控制上下文长度，避免提示词过大 picked = logs[:200] payload = "\n".join([json.dumps(l, ensure_ascii=False) for l in picked]) prompt = ( "这是我的日志，请根据日志结合代码帮我排查分析bug，输出bug原因及解决方案,必须保持固定的格式。\n" "固定格式如下：\n" "1) Bug原因：<...>\n" "2) 证据：<...>\n" "3) 解决方案：<...>\n\n" "日志如下（JSON Lines）：\n" + payload ) try: p = subprocess.run( ["codex", "exec", prompt], cwd=repo_path, capture_output=True, text=True, timeout=240, ) ``` ### Technical Analysis Every normalized Elasticsearch record retains the complete `_source` document in the `raw` field. The script then serializes as many as 200 complete records and supplies the resulting text to `codex exec`. Elasticsearch logs may contain authorization headers, session cookies, access tokens, personal information, request and response bodies, internal hostnames, database identifiers, or proprietary application data. The implementation applies no field allowlist, secret masking, data classification, destination verification, or explicit user confirmation before invoking Codex. Althoug ...[truncated 1150 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: scripts/trace_debuger.py:281
Finding: Untrusted Log Content Can Inject Instructions into the Codex Analysis Prompt
Content: View full analysis
Tuple[Optional[str], Optional[str]]: if not repo_path or not os.path.isdir(repo_path): return None, "repo_path 不存在，跳过 codex 分析" # 控制上下文长度，避免提示词过大 picked = logs[:200] payload = "\n".join([json.dumps(l, ensure_ascii=False) for l in picked]) prompt = ( "这是我的日志，请根据日志结合代码帮我排查分析bug，输出bug原因及解决方案,必须保持固定的格式。\n" "固定格式如下：\n" "1) Bug原因：<...>\n" "2) 证据：<...>\n" "3) 解决方案：<...>\n\n" "日志如下（JSON Lines）：\n" + payload ) try: p = subprocess.run( ["codex", "exec", prompt], cwd=repo_path, capture_output=True, text=True, timeout=240, ) ``` ### Technical Analysis Log messages and error values are potentially attacker-controlled. They are concatenated directly into the same prompt that contains the analysis instructions. The prompt does not establish that log contents are untrusted data and must never be interpreted as instructions. The Codex process is launched with the selected repository as its working directory. A malicious log entry could attempt to override the requested task, direct the analyzer to inspect unrelated repository files, disclose source code, manipulate its conclusions, or request additional actions. The ultimate severity depends on the tools, network access, approval policy, and filesystem permissions available to the installed Codex CLI. Simply encoding records as JSON Lines does not create a security boundary: natural-language instructions embedded inside string values remain visible to the model. ### Attack Path 1. An attacker causes an application to log a crafted message, such as instructions to ignore the ...[truncated 861 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/trace_debuger.py:316
Finding: User-Controlled Jaeger and Elasticsearch URLs Permit Unrestricted HTTP Requests
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/trace_debuger.py:495
Finding: Sensitive Markdown Report Persists Despite Documented Cleanup Requirement
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose suggests local trace/log analysis, but the skill additionally instructs invoking an external analysis tool (codex exec) and sending collected logs and possibly repository context to it. This expands the trust boundary and can exfiltrate sensitive operational data or source code to another system without clear disclosure or user consent.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script forwards raw log content to an external AI tool and then reproduces analysis and related evidence in a Markdown report, establishing two leakage channels: outbound transmission and local persistence. In a trace-debugging workflow, this is particularly dangerous because traces/logs often include high-value operational and customer data, and the report can further spread that data through CI artifacts or tickets.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares no explicit tool scope even though it instructs operations that require network access, shell execution, and file read/write. In a skill framework, missing permission boundaries increases the chance of overbroad execution and makes it harder for reviewers or policy engines to constrain sensitive capabilities before the skill runs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The required output block uses Chinese field labels, and the analysis prompt is also hard-coded in Chinese. This forces a specific language/locale without opt-in or explanation, which violates the language-choice policy for natural-language behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill instructs creation and later deletion of a local Markdown report without clearly warning about the destructive cleanup step. While limited in scope, undeclared deletion can surprise users, interfere with auditing or forensics, and remove artifacts they expected to keep.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Logs are packaged into a prompt and sent to an external analysis tool without any explicit user-facing warning, consent, or redaction step. Because operational logs frequently contain credentials, tokens, customer data, stack traces, and internal endpoints, this creates a significant confidentiality risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Natural-language strings for the Codex prompt and generated report/output are written in Chinese only, which imposes a specific language on users without opt-in. The file does not indicate that this is a region-specific tool or provide any mechanism to select another language.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This skill explicitly sends repository-context analysis to an external Codex CLI, combining local code access with production trace/log data. In a debugging skill, that is especially sensitive because traces and logs often contain secrets, identifiers, internal topology, and source details that should not be disclosed to third-party services without strong controls.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 95% confidence
Finding: The script invokes an external codex CLI and passes it a prompt built from collected logs while setting cwd to the local repository. This creates a code-and-data exfiltration boundary: sensitive logs and repository context can be exposed to an external tool or model, and the trustworthiness of that downstream tool is not verified or constrained here.
Content: Scanner excerpt · scripts/trace_debuger.py (reported line 297)May include surrounding context.
python
) try: p = subprocess.run( ["codex", "exec", prompt], cwd=repo_path, capture_output=True,

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The script performs broad repository walking and extracts code lines based on log-derived caller paths, which goes beyond a narrow 'optional local repository context' expectation. That increases exposure of unrelated source files and can unintentionally include sensitive code fragments in the final report or in downstream AI analysis.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The code creates parent directories and writes a report file containing trace, log, and analysis data, which could include sensitive operational details. Although the output path is configurable, there is no visible prompt, warning comment, or user-facing notice that the script persists this data to disk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.