server-log-analysis-en

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:47 AM UTC
• Version: 1.0.0

Overview

The skill has a legitimate remote log troubleshooting purpose, but it needs review because its default configuration uses root SSH/password access and keeps downloaded logs by default.

Review before installing. Replace the sample connection with a least-privilege SSH account, remove inline password fields, use a secret manager or environment reference, and change log retention so downloaded snippets are deleted by default or stored in a restricted, per-session location. Do not put real production credentials in config.yaml.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: config.yaml:12
• Finding: SSH Connection Uses an Unrestricted Root Account## Vulnerability Details **File Location**: `config.yaml:12-16` **Vulnerability Type**: Excessive SSH privileges and violation of least privilege **Risk Level**: High **Vulnerable Configuration**: ```yaml connections: default-server: host: hostname port: 22 username: root password: password ``` ### Technical Analysis The Skill is intended to inspect service status and read selected log data. These operations ordinarily require only narrowly scoped read access to designated log directories and, at most, permission to execute a limited set of status and filtering commands. Configuring the SSH connection to use `root` gives the Agent unrestricted control over the target host. This exceeds the minimum permissions required by the declared log-analysis functionality. Although `SKILL.md` instructs the Agent not to modify files or restart services unless requested, that is an instructional restriction rather than an enforceable access-control boundary. Any command-injection flaw, maliciously constructed incident request, incorrect command generation, or compromise of the Agent session would therefore execute within a root-level SSH context. ### Attack Path 1. An operator configures a real host under `default-server` while retaining `username: root`. 2. The Skill initiates an SSH session to perform log checks. 3. An attacker influences a diagnostic command, path, keyword, or other command input, or otherwise compromises the Agent session. 4. The resulting command is executed remotely as `root`. 5. The attacker can access or modify resources unrelated to log diagnosis because no operating-system privilege boundary limits the session. ### Impact Assessment Successful exploitation could provide complete administrative control over the configured remote server. Potential impact includes reading credentials and private application data, modifying services and configuration, accessing unrelated tenants ...[truncated 180 chars]
• Remediation: ## Remediation Suggestions - Replace `root` with a dedicated service account created exclusively for log diagnostics. - Grant read permission only to explicitly approved log paths. - If elevated commands are unavoidable, configure `sudoers` to allow only exact, non-interactive commands with fixed arguments. - Restrict the SSH account using an authorized-key command, source-address restrictions, and disabled port forwarding, agent forwarding, and interactive shell access where practical. - Maintain an allowlist of permitted hosts, log directories, and commands. - Validate and safely quote all user-derived paths, search terms, time ranges, and service names before constructing remote commands. - Record and monitor all diagnostic SSH activity.

T09 · Insecure Skill Coding Practices

Warning

• Location: config.yaml:12
• Finding: Plaintext SSH Password Field in Operations Configuration## Vulnerability Details **File Location**: `config.yaml:12-16` **Vulnerability Type**: Plaintext credential storage pattern **Risk Level**: Medium **Vulnerable Configuration**: ```yaml connections: default-server: host: hostname port: 22 username: root password: password ``` ### Technical Analysis The value appears to be a placeholder rather than a confirmed live credential. Nevertheless, the configuration schema directly models an SSH password as plaintext and encourages operators to replace the placeholder with an actual secret. This contradicts the project's own security guidance. `SKILL.md` requires environment variables, key files, or external secret managers, while `reference.md` states that plaintext passwords must not be included and recommends an `auth.password_env` or key reference. A real password placed in this field would be exposed to every process, user, backup system, source-control system, or Agent context able to read the project directory. Because the same connection is configured with the `root` username, credential disclosure could have particularly severe consequences. ### Attack Path 1. An operator replaces the placeholder value with a valid SSH password. 2. The configuration is committed, archived, copied into an Agent context, included in a diagnostic bundle, or left readable on disk. 3. An attacker or unauthorized local process obtains `config.yaml`. 4. The attacker extracts the host, username, and plaintext password. 5. If network access and SSH policy permit, the attacker authenticates directly to the target server. ### Impact Assessment Exposure of a valid password could permit unauthorized SSH authentication with the privileges of the configured account. Under the current configuration pattern, that account is `root`, so the potential scope is full control of the target host. Even if a lower-privileged account is substituted, the attacker could read all res ...[truncated 89 chars]
• Remediation: ## Remediation Suggestions - Remove the `password` field from the supported configuration schema. - Replace it with a non-secret reference, such as: ```yaml auth: method: password password_env: SERVER_LOG_ANALYSIS_SSH_PASSWORD ``` - Prefer a passphrase-protected, narrowly authorized SSH key or a short-lived certificate issued by an identity system. - Retrieve secrets at runtime from an approved secret manager and prevent them from being printed in logs or responses. - Add configuration validation that rejects `password`, `private_key`, and other inline secret fields. - Add secret scanning to source-control and release workflows. - If a real credential was ever stored in this field, remove it from repository history and backups where possible, rotate it immediately, and review SSH authentication logs.

T09 · Insecure Skill Coding Practices

Warning

• Location: config.yaml:3
• Finding: Sensitive Downloaded Logs Are Preserved by Default## Vulnerability Details **File Location**: `config.yaml:3-9`; related instruction at `SKILL.md:114` **Vulnerability Type**: Unsafe retention of sensitive temporary data **Risk Level**: Medium **Vulnerable Configuration and Instruction**: ```yaml analysis: local_temp_dir: temp/server-log-analysis default_time_window: 2h default_tail_lines: 3000 max_download_mb_per_file: 50 prefer_remote_filter: true preserve_downloads: true ``` ```markdown - Unless requested, do not auto-delete downloaded logs. ``` ### Technical Analysis The Skill downloads remote log snippets into the predictable local directory `temp/server-log-analysis` and preserves them by default. Application logs commonly contain authentication tokens, session identifiers, personal data, request contents, internal hostnames, stack traces, database details, and other operationally sensitive information. Persistent retention is not generally required for the declared task once analysis is complete. The reviewed files do not define restrictive file permissions, isolated per-session directories, encryption, automated expiration, secure deletion, or a maximum retention period. The default therefore increases the duration and number of contexts in which downloaded information may be exposed. The Skill does reduce transfer scope through remote filtering and download limits, but those controls do not protect files after they have been written locally. ### Attack Path 1. The Skill connects to a remote service and downloads log snippets for diagnosis. 2. The snippets contain sensitive operational or user information. 3. Files are written under the predictable `temp/server-log-analysis` path. 4. Because `preserve_downloads` is enabled and the instructions discourage automatic deletion, the files remain after the diagnostic session. 5. A later Agent session, local user, process, backup job, artifact collector, or accidental source-control operat ...[truncated 436 chars]
• Remediation: ## Remediation Suggestions - Change the default to `preserve_downloads: false`. - Delete downloaded snippets automatically after analysis unless the user explicitly requests retention. - Create a randomized, per-session temporary directory with owner-only permissions, such as mode `0700`, and files with mode `0600`. - Enforce a short retention limit and implement cleanup for abandoned sessions. - Prevent the temporary directory from being committed or packaged by adding it to ignore and artifact-exclusion rules. - Redact or tokenize credentials, session identifiers, personal data, and other sensitive values before persistent storage or report generation. - Encrypt retained diagnostic artifacts and document who may access them. - Record the source, collection time, sensitivity, and expiration time of intentionally retained logs. - Update `SKILL.md` so preservation requires explicit user opt-in rather than being the default.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Natural-Language Policy Violations

High

• Confidence: 99% confidence
• Finding: The configuration hard-codes privileged SSH credentials, including a root username and plaintext password, directly in the skill manifest. This creates an immediate secret exposure risk and enables full remote compromise of the target server if the file is read, leaked, logged, or reused elsewhere; the danger is amplified because the account is root and the skill is specifically designed to connect to remote systems.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: This manifest lists very broad keywords such as "login", "timeout", and "order" without any narrowing context or exclusion conditions. In a manifest file, such generic triggers can overlap with common incident descriptions and make it unclear when this skill should activate versus when another skill should handle the request.

Scope Creep

Low

• Category: Excessive Agency

Content

4. Inspect recent tail output or keyword matches remotely first.
5. Download only minimal required snippets.
6. Analyze locally.
7. Expand scope only when evidence is insufficient.

## Recommended Download Strategy

• Confidence: 75% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

4. Inspect recent tail output or keyword matches remotely first.
5. Download only minimal required snippets.
6. Analyze locally.
7. Expand scope only when evidence is insufficient.

## Recommended Download Strategy

• Confidence: 75% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.