Security audit

Gateway Watchdog

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Gateway log monitor, but it can put raw log snippets into scheduled notifications sent to the last messaging channel.

Review this before installing if your Gateway logs may contain API keys, authorization headers, private messages, user IDs, or channel addresses. Use an explicit administrator notification channel instead of `--channel last`, and prefer aggregate-only alerts or add redaction before using scheduled notifications.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/gateway-watchdog.sh:132
Finding: Unredacted Gateway Log Lines May Be Transmitted Through External Notification Channels
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
bash scripts/gateway-watchdog.sh check # silent unless errors exceed threshold

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
bash scripts/gateway-watchdog.sh check # silent unless errors exceed threshold

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
bash scripts/gateway-watchdog.sh check # silent unless errors exceed threshold

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
bash scripts/gateway-watchdog.sh check # silent unless errors exceed threshold

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The comment at L005 describes the skill as performing "read-only log analysis," but the implementation creates directories and writes both a JSON state file and a history log in save_state(). That is an active contradiction between the documented intent and the actual side effects, not merely omitted detail.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The results section labels the primary alert example as 'Chinese locale' and presents English only as an equivalent, which suggests a default language behavior. The file does not state that users can choose their preferred output language or that Chinese output is limited to a justified region-specific deployment.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest focuses on detecting abnormal error rates in logs and integrating checks into heartbeat monitoring. While log analysis is the core behavior, this code additionally stores historical results and prior counts on disk, expanding the behavior beyond pure monitoring into local stateful persistence that is not mentioned in the manifest description.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.