DevOps Ops Bot

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:01 AM UTC
• Version: 1.0.0

Overview

This server-monitoring skill is mostly coherent, but it tells users to run mutable remote installers and unpinned packages that could execute changed code.

Review this carefully before installing. Prefer a pinned npm version or immutable container digest from a trusted release, avoid the curl | bash installer, and only enable webhook alerts or restart commands after checking what data is sent and limiting service-control permissions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64
• Finding: Mutable Remote Installation Script Is Piped Directly into Bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:64` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://raw.githubusercontent.com/gruted/devops-ops-bot/main/install.sh | bash ``` ### Technical Analysis The installation instruction downloads a shell script from the mutable `main` branch of an external GitHub repository and pipes it directly into Bash. The script is neither included in the audited project nor pinned to an immutable commit, so its effective behavior can change after this Skill has been reviewed. No checksum, cryptographic signature, release pin, or manual inspection step is required before execution. Bash receives the response body immediately, allowing any commands supplied by the remote endpoint to execute with the permissions of the user running the installation command. This behavior is not necessary for the declared server-monitoring functionality. A versioned package or a downloaded and verified installation artifact would provide the same installation capability with substantially less supply-chain risk. ### Attack Path 1. An attacker compromises the upstream repository, its maintainer account, the relevant branch, or the script publication workflow. 2. The attacker modifies `install.sh` on the mutable `main` branch to include malicious shell commands. 3. A user follows the installation instruction in `SKILL.md`. 4. `curl` retrieves the current attacker-controlled response. 5. The response is passed directly to Bash without inspection or integrity verification. 6. The malicious commands execute with all permissions available to the invoking user. ### Impact Assessment Successful exploitation provides arbitrary command execution as the invoking account. The payload could access that user's files, configuration, tokens, SSH material, and environment variables; alter application files; install user-level persistence; or des ...[truncated 339 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `curl | bash` installation method. - Publish versioned releases through a trusted package or release channel. - Pin installation artifacts to an immutable version or commit rather than `main`. - Publish and require verification of a SHA-256 checksum or cryptographic signature. - If a shell installer remains necessary, download it to a local file first, verify its integrity, and instruct users to inspect it before execution. - Ensure the installer operates without elevated privileges unless a narrowly defined operation genuinely requires them. - Include the reviewed installer in the Skill package when feasible so its behavior is available for static audit. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:14
• Finding: Unversioned npx Command Can Retrieve and Execute a Changed Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14` **Vulnerability Type**: Unpinned executable npm dependency **Risk Level**: High ### Vulnerable Code ```bash npx @gruted/devops-ops-bot check ``` ### Technical Analysis The documented `npx` command does not specify a reviewed package version. Depending on the local environment and package availability, `npx` can retrieve the current package release from the npm registry and execute it. Because neither a version nor an integrity value is specified, the code executed by this instruction may differ from the code originally reviewed. Compromise of the publisher account, package publication workflow, or registry artifact could therefore turn an apparently routine health check into arbitrary code execution. ### Attack Path 1. An attacker compromises the npm publisher account, package publication workflow, or upstream package contents. 2. The attacker publishes a malicious release under `@gruted/devops-ops-bot`. 3. A user executes the documented unversioned `npx` command. 4. `npx` resolves and downloads the current package when a suitable trusted local copy is unavailable. 5. Package lifecycle behavior or the invoked CLI executes attacker-controlled code with the user's permissions. ### Impact Assessment A malicious package can execute commands as the invoking user and access files, environment variables, credentials, webhook configuration, and other resources available to that account. Because the advertised tool is intended for server monitoring and service recovery, users may run it under operational accounts with access to sensitive host information or service-control capabilities. The audited project does not contain the npm package implementation, so its actual runtime behavior cannot be verified locally. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the package to a specific reviewed version, such as `npx @gruted/devops-ops-bot@<reviewed-version> check`. - Prefer `npx --no-install` when the command is expected to use an already installed and verified package. - Use lockfiles and npm integrity metadata in a normal project installation workflow. - Verify package provenance and use signed or provenance-attested releases where supported. - Document the expected package publisher, version, checksum, and update-review process. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:61
• Finding: Unversioned Global npm Installation Exposes Users to Mutable Package Releases<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:61` **Vulnerability Type**: Unpinned globally installed npm dependency **Risk Level**: High ### Vulnerable Code ```bash npm install -g @gruted/devops-ops-bot ``` ### Technical Analysis The global installation command omits a package version and therefore installs whichever release the registry currently resolves. The reviewed Skill contains no lockfile, integrity hash, vendored implementation, or other mechanism tying the installed code to a known artifact. npm packages may execute lifecycle scripts during installation. Consequently, compromise of the package or its publication process could result in code execution during installation, before the user explicitly invokes the monitoring CLI. ### Attack Path 1. An attacker gains control over the package publisher account, release pipeline, or package contents. 2. A malicious package version is published. 3. A user runs the documented unversioned global installation command. 4. npm resolves the malicious version and downloads it. 5. Malicious lifecycle scripts can execute during installation, and the installed global CLI can execute additional attacker-controlled behavior when invoked. ### Impact Assessment The malicious package receives the privileges of the account running npm. It could read or modify user-accessible files, collect credentials or environment variables, replace the globally installed CLI, and persist malicious behavior across subsequent CLI invocations. Global npm installation is sometimes performed using an elevated account depending on system configuration. If a user voluntarily runs the command with elevated privileges, the potential impact expands to system-wide package paths and other administrator-accessible resources. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the installation to a specific reviewed package version. - Provide integrity and provenance information for the selected release. - Avoid recommending elevated execution or `sudo` for npm installation. - Prefer a project-local dependency with a lockfile over a global mutable installation. - Review package lifecycle scripts and consider installation controls that disable scripts where they are unnecessary. - Establish an explicit review process before updating the documented package version. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:67
• Finding: Docker Execution Uses an Unpinned Mutable latest Image<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:67` **Vulnerability Type**: Mutable, unverified container dependency **Risk Level**: High ### Vulnerable Code ```bash docker run --rm ghcr.io/gruted/devops-ops-bot:latest check ``` ### Technical Analysis The Docker command uses the mutable `latest` tag rather than an immutable image digest. The image executed by this command can consequently change without any corresponding change to `SKILL.md`. The project provides no image digest, signature-verification procedure, software bill of materials, or local Dockerfile from which the documented artifact can be independently assessed. Compromise of the container registry credentials, image build pipeline, or mutable tag could cause users to execute an attacker-controlled image. The shown command does not mount host directories or request privileged container mode, which limits direct host access under normal container isolation. Nevertheless, the image can execute arbitrary code inside the container and use any network access and runtime capabilities granted by the Docker configuration. ### Attack Path 1. An attacker compromises the image publisher, container build pipeline, registry account, or `latest` tag. 2. The attacker publishes a malicious image under `ghcr.io/gruted/devops-ops-bot:latest`. 3. A user executes the documented Docker command. 4. Docker resolves and retrieves the current image associated with `latest`. 5. The malicious image runs with the container's configured capabilities and network access. ### Impact Assessment The attacker obtains arbitrary execution inside the launched container. This can enable network scanning, outbound data transfer, abuse of host resources, or attacks against services reachable from the container. The documented command does not itself expose host files, the Docker socket, or privileged mode, so direct host compromise is not established by the audited evidence. The practical scope depends on the l ...[truncated 117 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the image by immutable digest, for example `ghcr.io/gruted/devops-ops-bot@sha256:<verified-digest>`. - Sign container images and document signature verification using an appropriate tool such as Cosign. - Publish provenance attestations and a software bill of materials for each reviewed image. - Apply explicit runtime restrictions, including read-only filesystems, dropped Linux capabilities, resource limits, and restricted networking where compatible with the functionality. - Never add privileged mode, host filesystem mounts, or Docker socket access unless they are strictly required and separately reviewed. - Update pinned digests only after reviewing and testing the corresponding image. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Chaining Abuse

High

• Category: Tool Misuse

Content

npm install -g @gruted/devops-ops-bot

# or one-liner
curl -fsSL https://raw.githubusercontent.com/gruted/devops-ops-bot/main/install.sh | bash

# or Docker
docker run --rm ghcr.io/gruted/devops-ops-bot:latest check

• Confidence: 98% confidence
• Finding: The `curl ... | bash` pattern explicitly chains network retrieval to shell execution, which is a classic high-risk command execution primitive. This is especially dangerous in a skill file because users may copy-paste it verbatim, giving remote content direct execution on their systems without validation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The skill instructs users to run `npx @gruted/devops-ops-bot` without pinning an exact package version. This creates a supply-chain risk because future package updates or a compromised published version could execute unintended code at runtime on the user's system.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill advertises automatic service restart on critical conditions without warning that this can change system state and disrupt running workloads. In a DevOps context, restart commands may affect production services, cause downtime, or mask underlying compromise or instability.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: The Docker example uses `ghcr.io/gruted/devops-ops-bot:latest`, which is mutable and not reproducible. If the image is replaced, retagged, or the registry account is compromised, users may run unreviewed code with whatever privileges Docker has on the host.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The webhook alerting feature sends operational data to external Slack or Discord endpoints, but the documentation provides no privacy or data-transmission warning. Users may unknowingly expose hostnames, service health, timing, or environment details to third parties or misconfigured webhooks.

External Script Fetching

Low

• Category: Supply Chain

Content

npm install -g @gruted/devops-ops-bot

# or one-liner
curl -fsSL https://raw.githubusercontent.com/gruted/devops-ops-bot/main/install.sh | bash

# or Docker
docker run --rm ghcr.io/gruted/devops-ops-bot:latest check

• Confidence: 97% confidence
• Finding: The one-line installer fetches a remote script and pipes it directly into `bash`, eliminating any opportunity for review or integrity verification. If the source repository, network path, or hosting account is compromised, arbitrary shell commands would run immediately on the user's machine.

Tool Parameter Abuse

Low

• Category: Tool Misuse

Content

curl -fsSL https://raw.githubusercontent.com/gruted/devops-ops-bot/main/install.sh | bash

# or Docker
docker run --rm ghcr.io/gruted/devops-ops-bot:latest check
```

## Links

• Confidence: 15% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Static analysis

No suspicious patterns detected.