Security audit

free-oracle-arm-skill

Security checks across malware telemetry and agentic risk

Overview

This skill is coherent, but it needs Review because it guides an agent through SSH and Oracle Cloud credential setup, persistent cloud automation, and anti-reclaim steps with weak safety boundaries.

Review carefully before installing. Use a dedicated least-privilege OCI user, do not paste private keys, SendKeys, or full OCI config contents into chat, verify SSH host keys instead of disabling checks, understand that the script can keep making cloud API calls until it creates an instance, and avoid CPU-load keepalive tactics if they violate Oracle policy. Stop the screen session and any cron jobs when done, and rotate credentials if they were exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill clearly instructs shell command execution, SSH usage, package installation, and cloud CLI operations, yet no declared permissions are indicated. That creates a trust and governance gap: users or platforms may not realize the skill can perform sensitive system and cloud actions.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The SSH test command uses StrictHostKeyChecking=no, which disables host authenticity verification and makes man-in-the-middle attacks significantly easier. In this skill's context, the command is used before handling cloud credentials and remote administration, so compromise of the session could expose sensitive infrastructure access.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill recommends artificial CPU load tools specifically to avoid Oracle idle-reclamation policies, which encourages policy evasion and unnecessary persistent workloads. While not a direct exploit, it can lead to account action, wasted resources, and normalizing persistence behaviors that resemble abuse patterns.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README instructs users to configure OCI API keys, run a long-lived polling workflow, and send notifications through a third-party WeChat push service, but it does not warn about sensitive credential handling, least-privilege IAM practices, secure storage, or the privacy implications of outbound notifications. In a skill designed for low-experience users and AI-assisted execution, this omission increases the chance that users expose cloud API credentials, overprovision permissions, or transmit operational details to external services without understanding the risks.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The README explicitly instructs users to let the AI guide OCI CLI installation, API key configuration, and deployment of a continuously polling script, but it does not warn about the sensitivity of OCI credentials, least-privilege IAM setup, storage permissions, logging exposure, or the cost/abuse implications of persistent API calls. In an AI-skill context aimed at beginners, this omission is risky because users may paste secrets into chat, overprovision permissions, or leave unattended automation running without understanding the security implications.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill asks for sensitive SSH and OCI-related material in plain conversation without strong handling boundaries. Even requesting a private key path can steer users toward exposing secrets or granting the agent access to highly privileged authentication assets.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The command sequence disables SSH host key checking without warning users about impersonation risk. Because this occurs during initial connectivity validation, an attacker on-path could intercept the connection and influence later administrative or credential-related steps.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill advises opening firewall ports and running keepalive workloads but does not explain the security or policy implications. That can leave services exposed to the internet unnecessarily and can push users into risky persistence configurations without understanding the consequences.

Ssd 3

High

Confidence: 97% confidence
Finding: The skill instructs collection of highly sensitive access material, including SSH private key path details and cloud identity information, through a conversational workflow. In context, this is especially dangerous because the same skill then uses that access to administer systems and configure OCI authentication.

Ssd 3

High

Confidence: 98% confidence
Finding: The skill tells the user to copy out OCI authentication details such as fingerprint, user OCID, and tenancy OCID and place them into configuration, creating a plain-language credential onboarding flow. Even though some fields are not secrets by themselves, bundling them with API key setup and remote shell guidance meaningfully increases the chance of account misuse or accidental disclosure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.