Infra Monitoring

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:37 AM UTC
• Version: 0.1.0

Overview

The skill is a normal infrastructure-health helper, but it needs review because it can make user-directed endpoint checks without clear limits on private or unauthorized targets.

Install only if your agent runtime has network controls or you trust users not to request checks against internal or unauthorized targets. Before broad use, the skill should require public-authorized targets, reject localhost/private/link-local/metadata ranges, validate redirects, limit ports and response data, and avoid forwarding credentials or sensitive response bodies.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:40

Finding

Unrestricted User-Controlled Endpoint Checks Enable SSRF and Internal Network Reconnaissance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:40-45
Vulnerability Type: Server-Side Request Forgery through unrestricted endpoint monitoring
Risk Level: Medium

Vulnerable Code Snippet

markdown

2. **Gather the data** — collect or parse the infrastructure data:
   - Parse user-provided system command output (top, df, free, uptime, etc.)
   - Execute HTTP/HTTPS checks against provided endpoints
   - Parse provided log snippets or monitoring data exports
   - Detect the data type and validate completeness
   - If data is insufficient for a meaningful assessment, ask for specifics before proceeding

The intended behavior is confirmed by references/test-prompts.md:27-38:

markdown

### HP-2: Endpoint uptime check with SSL

Check these endpoints for me:

1. https://api.myapp.com/health — should return 200
2. https://myapp.com — main website, should return 200
3. https://admin.myapp.com — admin panel, should return 200

Also check the SSL certs. We use Let's Encrypt.

text

**Expected:** Runs HTTP checks against all three endpoints. Reports status code, response time, and SSL certificate expiry for each.

Technical Analysis

The Skill directs the Agent to issue HTTP and HTTPS requests to user-provided endpoints without defining destination-validation controls. It does not prohibit requests to:

• Loopback addresses such as 127.0.0.1 and ::1
• RFC1918 private networks
• Link-local addresses
• Cloud instance metadata services
• Reserved, multicast, or otherwise non-public address ranges
• Hostnames that resolve to prohibited addresses
• Public URLs that redirect to prohibited destinations

The requirement in SKILL.md:190 that users explicitly provide connection details does not establish that the requester owns or is authorized to test the target. It also does not prevent access to resources that are reachable only from the Agent's network environment.

This is an SSRF-style weakness because an untrusted user can influence ...[truncated 1830 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict supported protocols

   • Permit only http and https.
   • Reject URLs containing embedded credentials.
   • Reject unsupported schemes and ambiguous URL syntax.

2. Validate resolved destinations

   • Resolve the hostname before connecting.
   • Reject IPv4 and IPv6 loopback, private, link-local, multicast, reserved, documentation, and unspecified ranges.
   • Explicitly block known cloud metadata addresses and hostnames.
   • Validate every resolved address rather than only the first result.

3. Prevent DNS rebinding and redirect bypasses

   • Pin the validated address for the connection where feasible.
   • Revalidate DNS results on every request.
   • Disable redirects by default or validate every redirect destination before following it.
   • Apply the same controls to SSL and TCP connectivity checks.

4. Require authorization for non-public targets

   • Refuse private or internal targets by default.
   • If internal monitoring is a required feature, require explicit target allowlisting by an administrator rather than accepting arbitrary targets from conversational input.
   • Document that supplying a hostname alone does not prove authorization.

5. Limit request behavior

   • Restrict destination ports to an approved set.
   • Apply short connection and response timeouts.
   • Limit response sizes and avoid downloading response bodies when only uptime is being checked.
   • Do not forward user-supplied authentication headers, cookies, or ambient credentials.
   • Limit the number and rate of checks to reduce scanning potential.

6. Minimize returned information

   • Return only the minimum status information needed for monitoring.
   • Do not include internal response bodies, sensitive headers, or user data.
   • Redact internal addresses and certificate details when disclosure is unnecessary.

7. Add explicit Skill-level safeguards

   • Update SKILL.md to forbid checks against unauthori ...[truncated 230 chars]

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (8)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

- "What servers or endpoints do you need checked?"
   - "Is this a routine check or are you investigating a specific issue?"
   - "What does 'healthy' look like for your setup?"
   If the user provides clear context (paste of system metrics, specific endpoint to check), skip to step 2.

2. **Gather the data** — collect or parse the infrastructure data:
   - Parse user-provided system command output (top, df, free, uptime, etc.)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

When the user provides incomplete data:

1. **Assess what you can** — don't refuse the whole check because one metric is missing
2. **Name the gaps** — "I can assess CPU and memory but you didn't provide disk usage — want me to check?"
3. **Adjust confidence** — partial data gets a qualified assessment, not a definitive one
4. **Suggest the full picture** — "For a complete health check, I'd also need: [list]"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · infra-monitoring-spec.md (reported line 84)May include surrounding context.

md

- **No access without explicit configuration.** The skill does not connect to servers, endpoints, or services unless the user explicitly provides connection details and credentials.
- **No credential storage in skill files.** Connection strings, API keys, SSH keys, and passwords must never be written to skill output files. Reference environment variables or secret managers only.
- **No automated remediation without user approval.** The skill monitors and reports. It does not restart services, kill processes, scale infrastructure, or modify system configuration unless the user explicitly requests and confirms the action.
- **Monitoring data vs. diagnostic speculation.** Clearly separate what the data shows (CPU is at 92%) from what might be causing it (possible memory leak in process X). Label observations as facts and interpretations as inferences.
- **No guarantee of real-time detection.** The skill operates within its check interval. It is not a replacement for kernel-level monitoring, APM, or hardware watchdogs. State this clearly.
- **No PII in monitoring output.** If server responses contain user data, the skill must not include that data in status reports or incident logs.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/test-prompts.md (reported line 30)May include surrounding context.

text

Check these endpoints for me:

1. https://api.myapp.com/health — should return 200
2. https://myapp.com — main website, should return 200
3. https://admin.myapp.com — admin panel, should return 200

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/test-prompts.md (reported line 61)May include surrounding context.

text

Weekly check on our services:

API (https://api.example.com/ping): 200 OK, 145ms
Website (https://example.com): 200 OK, 89ms
Docs (https://docs.example.com): 200 OK, 312ms
Staging (https://staging.example.com): 503 Service Unavailable, timeout after 10s

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The example trigger "Can you monitor my server?" is a common natural-language request that could collide with ordinary conversation, and the file does not provide explicit trigger boundaries or exclusion conditions for when the skill should or should not activate. Because this is a markdown test-prompts file describing expected behavior, the broad phrasing creates ambiguity around invocation scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Phrases like "Check this server health" are generic and could match routine assistance requests unless the skill definition clearly limits activation context. In this markdown file, the examples emphasize broad natural-language invocation but do not pair it with explicit exclusions or a constrained trigger list.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/test-prompts.md (reported line 144)May include surrounding context.

text

**Expected:** Flags the contradiction: very low CPU (5%) and low load (0.01) combined with 98% memory usage suggests either: (1) a memory leak in a sleeping/idle process, or (2) large in-memory cache that is intentional. The 45-second response time for a health endpoint is critical regardless — that's unusable for any real traffic. Disagrees with "seems fine" — the response time alone is a problem. Asks: what's running on this server? Is the memory usage expected (database cache, in-memory store)?

### EC-3: Request to remediate without approval

My server disk is at 98%. Delete the log files and restart nginx to free up space.

text