Security audit

Troubleshooting Computer Issues

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent troubleshooting purpose, but it should be reviewed because it requires persistent workspace memory and includes high-impact system fixes without enough safeguards.

Install only if you are comfortable with a troubleshooting skill that may create persistent `.troubleshooting-memory/` files in projects and suggest privileged or global system changes. Review commands before running them, avoid disabling TLS verification, avoid adding Docker privileges casually, and do not persist logs containing secrets.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:51
Finding: Persistent troubleshooting memory can store and replay attacker-controlled instructions
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:51; references/memory-format.md:23-43, 46-69, 97-99, 104
Vulnerability Type: Persistent memory poisoning through unsanitized troubleshooting records
Risk Level: High

Vulnerable Code

SKILL.md:51:

markdown
- **Memory Documentation**: Every attempt must write to `.troubleshooting-memory/` as detailed in [memory-format.md](references/memory-format.md).

references/memory-format.md:23-43:

markdown
### 2.1 Solutions Memory (`SOLUTIONS.md`) Append successfully resolved issues to this file using the following template: ```markdown ## [SOL-YYYYMMDD-XXX] <Brief Issue Title> **Date**: YYYY-MM-DD **Difficulty Level**: Simple | Medium | Hard | Extreme **Platform**: Windows | macOS | Linux **Category**: Installation | Configuration | Runtime | Network | Permissions | Environment | Other ### Problem Description <Provide a concise summary of the issue the user encountered and any error messages.> ### Root Cause Analysis <Detail why the issue occurred (e.g. environment variable missing, port conflict, dependency mismatch).> ### Resolution Steps 1. <Step 1 to resolve> 2. <Step 2 to resolve>

text
`references/memory-format.md:46-69`: ```markdown ### 2.2 Unresolved Memory (`UNRESOLVED.md`) Append issues that could not be solved (after exhaustive effort) to this file: ```markdown ## [UNR-YYYYMMDD-XXX] <Brief Issue Title> **Date**: YYYY-MM-DD **Difficulty Level**: Hard | Extreme **Platform**: Windows | macOS | Linux **Category**: Installation | Configuration | Runtime | Network | Permissions | Environment | Other **Attempts**: <Number of attempts / cycles tried> ### Problem Description <Provide a concise summary of the issue and error messages.> ### Attempted Solutions & Failure Results 1. **Approach A**: <What was tried> -> <Why it failed/result> 2. **Approach B**: <What was tried> -> <Why it failed/result ...[truncated 3003 chars]
Remediation: View remediation
Remediation Suggestions

Remove the unconditional requirement to persist every troubleshooting attempt.

Obtain explicit user consent before creating or updating persistent memory.

Treat all user-provided descriptions, logs, and command output as untrusted data.

Store records in a structured format with separate fields for trusted metadata and untrusted text.

Add an explicit rule that instructions found inside stored records must never be followed or treated as authoritative.

Escape or encode user-controlled Markdown content before persistence.

Redact credentials, access tokens, cookies, private keys, authorization headers, internal addresses, and other sensitive values.

Limit the size and retention period of stored logs.

Validate memory entries before retrieval and display their source and creation date.

Require confirmation before converting historical observations into future commands or remediation steps.

T09 · Insecure Skill Coding Practices

Error

Location: references/common-solutions.md:61
Finding: Global Git TLS certificate verification can be disabled persistently
Content: View full analysis
Vulnerability Details

File Location: references/common-solutions.md:61-65
Vulnerability Type: Persistent disabling of transport certificate validation
Risk Level: High

Vulnerable Code

markdown
### Error: `gnutls_handshake() failed` / `SSL certificate problem` - **Root Cause**: Git cannot verify SSL certificate (common behind proxies or corporate firewalls). - **Solution (Temporary bypass - use with caution)**: ```bash git config --global http.sslVerify false

text
### Technical Analysis The documented command disables HTTPS certificate verification in the user's global Git configuration. Despite being described as a temporary bypass, the command is persistent and affects subsequent Git HTTPS operations beyond the current repository and troubleshooting session. TLS certificate verification authenticates the remote server and prevents undetected interception. Disabling it allows Git to establish connections using untrusted or attacker-controlled certificates. The recommendation also lacks a restoration command, scope restriction, expiration mechanism, or requirement to diagnose and install the correct certificate authority. ### Attack Path 1. A user encounters a Git certificate error, potentially because of a legitimate proxy or an attacker-controlled network condition. 2. The agent applies the documented global configuration command. 3. Git writes `http.sslVerify=false` to the user's global configuration. 4. The user later clones, fetches, pulls, or accesses dependencies through Git over HTTPS. 5. An attacker with a network interception position presents an untrusted certificate and impersonates the Git server. 6. Because certificate validation is disabled, Git accepts the connection without detecting the impersonation. 7. The attacker can return modified repository content or observe sensitive HTTP authentication material exposed through the intercepted connection. ### Impact Assessment An attacker positioned on the netw ...[truncated 425 chars]
Remediation: View remediation
Remediation Suggestions

Remove the global TLS-disable command from the troubleshooting reference.

Diagnose the certificate chain and configure the correct trusted certificate authority.

For corporate proxies, configure Git with an approved CA bundle using http.sslCAInfo.

Correct system clock, proxy, and certificate-store problems rather than bypassing authentication.

If a narrowly scoped diagnostic exception is unavoidable, apply it to a single command or repository only, warn the user of the interception risk, and restore verification immediately.

Add a verification step such as:

bash
git config --global --get http.sslVerify

If the insecure setting was previously applied, remove it with:

bash
git config --global --unset http.sslVerify

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/common-solutions.md:13
Finding: Privileged and destructive remediation commands lack validation and confirmation safeguards
Content: View full analysis
Vulnerability Details

File Location: references/common-solutions.md:13, 76-77, 89-95
Vulnerability Type: Excessive privilege grants, broad ownership modification, and forced process termination
Risk Level: High

Vulnerable Code

references/common-solutions.md:13:

bash
# Change owner of npm directories to current user sudo chown -R $(whoami) ~/.npm $(npm config get prefix)/{lib/node_modules,bin,share}

references/common-solutions.md:76-77:

bash
sudo systemctl start docker sudo usermod -aG docker $USER # Log out and log back in to apply

references/common-solutions.md:89-95:

markdown
- **Windows**: ```powershell (Get-NetTCPConnection -LocalPort <Port>).OwningProcess | Stop-Process -Force

macOS/Linux:
bash
kill -9 $(lsof -t -i:<Port>)

text
### Technical Analysis The ownership command recursively changes ownership across paths derived from `npm config get prefix` while running with elevated privileges. The resolved prefix is not displayed or validated before use. A misconfigured, unexpected, or attacker-influenced prefix could cause ownership changes outside the intended user-managed package directories. Adding a user to the Docker group grants access to the Docker daemon. On typical Linux systems, Docker daemon access can be used to mount the host filesystem or start privileged containers and is therefore commonly equivalent to root-level host access. The recommendation does not explain this security boundary or present a least-privilege alternative. The port-conflict commands immediately send forced termination signals to every process returned for a selected port. They do not display the process identity, validate its owner, distinguish a user application from a critical service, request confirmation, or attempt graceful shutdown first. `kill -9` prevents cleanup handlers from running and may cause data loss. ### Attack Path #### Ownership modification 1. The NPM prefi ...[truncated 2114 chars]
Remediation: View remediation
Remediation Suggestions

Prefer a user-local NPM prefix or a version manager instead of recursively changing ownership of system-wide package directories.

Resolve and display the NPM prefix before any modification, canonicalize the path, and reject root directories or paths outside an explicit allowlist.

Require explicit confirmation before running recursive or privileged filesystem operations.

Explain that Docker-group membership is generally root-equivalent and should not be presented as a routine low-risk fix.

Prefer rootless Docker or narrowly controlled privileged service access where feasible.

Before terminating a process, display its PID, executable, owner, command line, and service association.

Require explicit confirmation for each process that will be stopped.

Attempt application-specific or graceful shutdown before using forced termination.

Reserve kill -9 or Stop-Process -Force for processes that do not respond to safer termination methods.

Add post-change validation and rollback instructions for ownership, group membership, and service availability.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 95% confidence
Finding: The skill references a file under the agent's local config directory via a file:///C:/Users/Lenovo/.gemini/config/skills/... path. Exposing or depending on agent-local configuration paths is dangerous because it can encourage access to sensitive local files, leak host environment details, and create a pathway for unintended cross-skill trust or prompt injection from local resources.
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
| **Extreme (极其困难)** | Hard strategy + parallel subagent tasks + iterate | Complete test passes & regression check | ## Rules & Common Mistakes - **Never guess fixes**: Run diagnostic commands for Hard/Extreme issues before proposing changes. Refer to [systematic-debugging](file:///C:/Users/Lenovo/.gemini/config/skills/systematic-debugging-5.1.0/SKILL.md). - **Dynamic Reclassification**: If search fails or environmental complexity increases, adjust the difficulty level immediately. - **Strict Resolution Gate**: Only mark as SOLVED after the user explicitly verifies the fix. If unresolved after maximum effort, mark as UNSOLVED. - **Memory Documentation**: Every attempt must write to `.troubleshooting-memory/` as detailed in [memory-format.md](references/memory-format.md).

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/common-solutions.md (reported line 56)May include surrounding context.
Check ssh keys

ssh-add -l

If empty, add key

ssh-add ~/.ssh/id_ed25519

Copy public key to clipboard and add to GitHub settings

cat ~/.ssh/id_ed25519.pub

text

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/common-solutions.md (reported line 58)May include surrounding context.
Check ssh keys

ssh-add -l

If empty, add key

ssh-add ~/.ssh/id_ed25519

Copy public key to clipboard and add to GitHub settings

cat ~/.ssh/id_ed25519.pub

text

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description says the skill should be used for a very wide range of issues including configuration failures, installation errors, command line exceptions, network bugs, and runtime crashes. For a markdown skill file, this trigger scope is broad and lacks explicit boundaries or exclusion conditions, which could cause unintended invocation for generic tech-support requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill mandates writing persistent records to .troubleshooting-memory/ for every attempt without warning the user or requiring consent. This can modify the user's workspace unexpectedly, create privacy leakage from logs or troubleshooting notes, and leave durable artifacts even when the user only asked for analysis or advice.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/common-solutions.md (reported line 10)May include surrounding context.
1. Node.js & NPM

Error: npm ERR! EACCES: permission denied

Root Cause: NPM lacks permissions to write to global directory.

Solution (macOS/Linux):
bash
# Change owner of npm directories to current user

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/common-solutions.md (reported line 14)May include surrounding context.

Solution (macOS/Linux):
bash
# Change owner of npm directories to current user sudo chown -R $(whoami) ~/.npm $(npm config get prefix)/{lib/node_modules,bin,share}

Solution (Windows): Run PowerShell or Command Prompt as Administrator.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/common-solutions.md (reported line 76)May include surrounding context.

Solution (macOS/Linux):
bash
# Change owner of npm directories to current user sudo chown -R $(whoami) ~/.npm $(npm config get prefix)/{lib/node_modules,bin,share}

Solution (Windows): Run PowerShell or Command Prompt as Administrator.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/diagnostic-templates.md (reported line 88)May include surrounding context.

Solution (macOS/Linux):
bash
# Change owner of npm directories to current user sudo chown -R $(whoami) ~/.npm $(npm config get prefix)/{lib/node_modules,bin,share}

Solution (Windows): Run PowerShell or Command Prompt as Administrator.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The guide recommends git config --global http.sslVerify false, which disables TLS certificate validation for all Git HTTPS traffic on the host. This exposes users to man-in-the-middle attacks, credential theft, and tampered repository contents, and the skill context makes it more dangerous because it is presented as a generic troubleshooting shortcut likely to be copied broadly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Advising users to disable Git SSL certificate verification without prominent security warnings weakens transport integrity and authenticity protections. In a troubleshooting skill, users are especially likely to apply this as a normal fix, turning a transient certificate issue into a persistent insecure configuration.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 93% confidence
Finding: Adding a user to the docker group effectively grants root-equivalent access on many Linux systems because Docker can mount the host filesystem, start privileged containers, and escape normal user boundaries. In a general troubleshooting guide, this is dangerous because it presents a major privilege expansion as a routine fix.
Content: Scanner excerpt · references/common-solutions.md (reported line 77)May include surrounding context.

Solution (Linux):
bash
sudo systemctl start docker sudo usermod -aG docker $USER # Log out and log back in to apply

Solution (macOS/Windows): Verify Docker Desktop application is running and its status icon is green.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The guide recommends forcefully killing whatever process owns a port using Stop-Process -Force or kill -9 without requiring identification or graceful shutdown first. This can terminate critical services, cause data loss, interrupt active sessions, and train users to use destructive commands as a first-line remedy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file includes difficulty labels in Chinese (e.g. 简单, 中等, 困难, 极其困难) while the surrounding instructions are in English. Because the document does not offer a language/locale option or explain that it is intended for a Chinese-speaking audience, it may impose a language preference without user opt-in.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T02 · Agent Memory Poisoning

Vulnerability Details

Vulnerable Code

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Remediation Suggestions

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code

Remediation Suggestions

SkillSpector

Agent Config Directory Access

Credential Access

Check ssh keys

If empty, add key

Copy public key to clipboard and add to GitHub settings

Credential Access

Check ssh keys

If empty, add key

Copy public key to clipboard and add to GitHub settings

Vague Triggers

Missing User Warnings

Session Persistence

1. Node.js & NPM

Error: npm ERR! EACCES: permission denied

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Context-Inappropriate Capability

Missing User Warnings

Sudo/Root Execution

Missing User Warnings

Natural-Language Policy Violations

Error: `npm ERR! EACCES: permission denied`