T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:64- Finding
Mutable Remote Installation Script Is Piped Directly into Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
DevOps Ops Bot
Security checks for vulnerabilities and agentic risk
Overview
This server-monitoring skill is mostly coherent, but it tells users to run mutable remote installers and unpinned packages that could execute changed code.
Review this carefully before installing. Prefer a pinned npm version or immutable container digest from a trusted release, avoid the curl | bash installer, and only enable webhook alerts or restart commands after checking what data is sent and limiting service-control permissions.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:14- Finding
Unversioned npx Command Can Retrieve and Execute a Changed Package
- Content
View full analysis
- Remediation
View remediation
check`. - Prefer `npx --no-install` when the command is expected to use an already installed and verified package. - Use lockfiles and npm integrity metadata in a normal project installation workflow. - Verify package provenance and use signed or provenance-attested releases where supported. - Document the expected package publisher, version, checksum, and update-review process. ]]>
T08 · Insecure Dependencies
Error
- Location
SKILL.md:61- Finding
Unversioned Global npm Installation Exposes Users to Mutable Package Releases
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
SKILL.md:67- Finding
Docker Execution Uses an Unpinned Mutable latest Image
- Content
View full analysis
- Remediation
View remediation
`. - Sign container images and document signature verification using an appropriate tool such as Cosign. - Publish provenance attestations and a software bill of materials for each reviewed image. - Apply explicit runtime restrictions, including read-only filesystems, dropped Linux capabilities, resource limits, and restricted networking where compatible with the functionality. - Never add privileged mode, host filesystem mounts, or Docker socket access unless they are strictly required and separately reviewed. - Update pinned digests only after reviewing and testing the corresponding image. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The
curl ... | bashpattern explicitly chains network retrieval to shell execution, which is a classic high-risk command execution primitive. This is especially dangerous in a skill file because users may copy-paste it verbatim, giving remote content direct execution on their systems without validation.- Content
md npm install -g @gruted/devops-ops-bot # or one-liner curl -fsSL https://raw.githubusercontent.com/gruted/devops-ops-bot/main/install.sh | bash # or Docker docker run --rm ghcr.io/gruted/devops-ops-bot:latest check
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The skill instructs users to run
npx @gruted/devops-ops-botwithout pinning an exact package version. This creates a supply-chain risk because future package updates or a compromised published version could execute unintended code at runtime on the user's system.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill advertises automatic service restart on critical conditions without warning that this can change system state and disrupt running workloads. In a DevOps context, restart commands may affect production services, cause downtime, or mask underlying compromise or instability.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
The Docker example uses
ghcr.io/gruted/devops-ops-bot:latest, which is mutable and not reproducible. If the image is replaced, retagged, or the registry account is compromised, users may run unreviewed code with whatever privileges Docker has on the host.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The webhook alerting feature sends operational data to external Slack or Discord endpoints, but the documentation provides no privacy or data-transmission warning. Users may unknowingly expose hostnames, service health, timing, or environment details to third parties or misconfigured webhooks.
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The one-line installer fetches a remote script and pipes it directly into
bash, eliminating any opportunity for review or integrity verification. If the source repository, network path, or hosting account is compromised, arbitrary shell commands would run immediately on the user's machine.- Content
md npm install -g @gruted/devops-ops-bot # or one-liner curl -fsSL https://raw.githubusercontent.com/gruted/devops-ops-bot/main/install.sh | bash # or Docker docker run --rm ghcr.io/gruted/devops-ops-bot:latest check
Tool Parameter Abuse
Low
- Category
- Tool Misuse
- Confidence
- 15% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
curl -fsSL https://raw.githubusercontent.com/gruted/devops-ops-bot/main/install.sh | bash
or Docker
docker run --rm ghcr.io/gruted/devops-ops-bot:latest check
text ## Links
Static analysis
No suspicious patterns detected.