home-infra-stewardship

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:46 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it gives broad standing authority to change internal infrastructure and persistent memory without tight approval boundaries.

Install only if you intend this skill to act as a proactive infrastructure steward with authority to make routine changes. Before use, define exact systems, allowed operations, approval gates for packages, permissions, cron/scheduler/sync jobs, and a review process for anything written to long-term memory.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:10

Finding

Unverified Standing Authorization Overrides Normal Approval Boundaries

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-12 and 48-50
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Complete Code Snippet:

markdown

## Standing Authorization

Ryan wants Kevin to regularly and routinely improve NetBox, Zabbix, and other internal cleanup/maintenance areas. Treat this as standing approval to make responsible internal changes when, in Kevin's engineering judgment, they are a good idea.

markdown

## Style

Be practical and proactive. Do not invent ceremony. Do not ask for routine permission that Ryan has already granted. Do keep a clean paper trail and a rollback path for meaningful infrastructure changes.

Technical Analysis

The skill asserts that a named user has granted standing authorization and instructs the agent not to request permission for routine changes. This authorization claim exists only in skill-controlled text and is not verified through a trusted policy, authenticated approval record, or current user confirmation.

When loaded, these instructions can alter the agent's normal approval boundaries and encourage it to perform state-changing infrastructure operations based on its own judgment. Terms such as “responsible,” “routine,” and “a good idea” are subjective and do not provide enforceable technical limits.

The rollback and documentation guidance does not prevent unauthorized changes; it only addresses possible recovery after a change has already occurred.

Attack Path

1. An attacker or untrusted package author supplies the skill to an agent with infrastructure tools.
2. The agent loads the skill and accepts its unverified claim of standing authorization.
3. The instruction not to request routine permission suppresses an expected approval checkpoint.
4. The agent identifies an operation as a “responsible internal change.”
5. The agent changes infrastructure configuration, packages, permissions, monito ...[truncated 702 chars]

Remediation

View remediation

Remediation Suggestions

• Remove identity-specific claims of standing authorization from the skill.
• Treat skill text as procedural guidance rather than an authorization source.
• Require explicit, current user approval before every state-changing operation.
• Present the exact target, proposed command or API action, expected effect, risk, and rollback procedure before requesting approval.
• Define a strict allowlist of read-only inspection operations that may run without confirmation.
• Require separate confirmation for package changes, service restarts, configuration writes, permission changes, and automation changes.
• Enforce authorization through a trusted external policy or authenticated approval mechanism rather than natural-language instructions.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:45

Finding

Skill-Directed Writes to Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21 and 45
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: High

Complete Code Snippet:

markdown

- Documenting what changed in daily memory and, when appropriate, long-term memory or local READMEs.

markdown

8. Record what changed in `memory/YYYY-MM-DD.md`; promote enduring lessons into `MEMORY.md` when appropriate.

Technical Analysis

The skill explicitly instructs the agent to write information into daily memory and promote selected content into long-term MEMORY.md storage. Persistent memory may be consumed by later sessions, so these writes can influence agent behavior after the skill invocation has ended.

No trust boundary, content validation policy, review requirement, or distinction between factual audit records and behavioral instructions is specified. Consequently, content derived from a compromised service, malicious documentation, tool output, or the skill itself could be preserved as trusted long-term context.

The phrase “when appropriate” delegates the promotion decision to the agent but does not constrain what may be stored. This creates a direct channel from skill execution into persistent agent state.

Attack Path

1. The agent loads the skill and performs the prescribed infrastructure review.
2. The workflow encounters attacker-controlled or misleading content in documentation, service metadata, API output, or automation artifacts.
3. The skill instructs the agent to record what it learned in daily memory.
4. The agent classifies some content as an enduring lesson and copies it into MEMORY.md.
5. Future sessions load the stored content as durable context.
6. The poisoned memory influences later decisions or causes malicious instructions to persist beyond the original skill run.

Impact Assessment

The immediate privilege obtained is write access to the agent's persistent state, limi ...[truncated 392 chars]

Remediation

View remediation

Remediation Suggestions

• Prohibit skills from directly modifying global or long-term agent memory.
• Write operational records to a skill-specific, append-only audit log rather than MEMORY.md.
• Require explicit user review before promoting any information into durable memory.
• Restrict stored records to factual fields such as timestamp, approved action, target, result, and rollback status.
• Reject executable instructions, authorization claims, secrets, commands, and policy changes from memory entries.
• Label the provenance and trust level of all retained information.
• Sanitize content obtained from service APIs, logs, documentation, and tool output before storage.
• Provide a review and deletion mechanism for entries produced during skill execution.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:14

Finding

Open-Ended Permission and Scheduled-Execution Changes Enable Privilege Abuse and Persistence

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-21 and 38-45
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation, T06: System Persistence
Risk Level: High

Complete Code Snippet:

markdown

This includes ordinary internal changes such as:

- Updating package/plugin/configuration state for NetBox, Zabbix, and supporting automation.
- Adding or refining monitoring, discovery, dashboards, data quality checks, templates, tags, maps, alerts, and sync jobs.
- Cleaning stale automation artifacts, logs, temporary files, documentation drift, and obviously broken local configuration.
- Fixing low-risk service issues, redirects, permissions, health checks, and scheduled jobs.
- Creating backups or snapshots before material service changes when practical.
- Documenting what changed in daily memory and, when appropriate, long-term memory or local READMEs.

markdown

1. Review durable memory and local docs for the current NetBox/Zabbix state.
2. Inspect the existing NetBox automation before adding new sync paths.
3. Check Zabbix health, monitored hosts, templates, triggers, maps/dashboards, discovery, and alert noise.
4. Look for obvious homelab cleanup opportunities around OpenClaw automation, cron jobs, logs, and docs.
5. Make small-to-medium responsible improvements directly.
6. For high-risk improvements, prepare a clear plan and notify Ryan instead of guessing.
7. Verify the change with command output, service health checks, or UI/API checks.
8. Record what changed in `memory/YYYY-MM-DD.md`; promote enduring lessons into `MEMORY.md` when appropriate.

Technical Analysis

The skill authorizes broad changes to packages, plugins, configurations, permissions, sync jobs, cron jobs, and other scheduled operations. Permission changes can alter access-control boundaries, while cron jobs, sync jobs, and scheduled tasks can execute commands after the current run and t ...[truncated 2153 chars]

Remediation

View remediation

Remediation Suggestions

• Replace open-ended change authority with an explicit allowlist of hosts, services, files, APIs, and read-only checks.
• Categorically prohibit unapproved permission, ownership, ACL, package, plugin, cron, scheduler, sync-job, and startup changes.
• Require operation-specific approval for every access-control or persistent-execution modification.
• Display the exact before-and-after permission state and complete scheduler entry before approval.
• Validate scheduled commands against a strict executable and argument allowlist.
• Run maintenance under a least-privileged service account without unrestricted root, scheduler, or identity-management access.
• Separate read-only health assessment from state-changing remediation.
• Add integrity monitoring for cron files, systemd units, scheduler APIs, automation definitions, and permission changes.
• Require backups, tested rollback steps, post-change verification, and an immutable audit record for approved changes.
• Automatically expire temporary scheduled tasks and access grants unless the user explicitly authorizes permanent retention.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill grants broad standing authorization to make 'responsible internal changes' based largely on the agent's own engineering judgment, without tightly scoped task boundaries or explicit approval checkpoints for many impactful maintenance actions. In an infrastructure-admin context, this ambiguity can let an agent overreach, make unintended changes, or perform risky modifications under the label of routine maintenance.

Content

No source excerpt is available for this finding.