server-log-analysis-en

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:47 AM UTC
• Version: 1.0.0

Overview

The skill has a legitimate remote log troubleshooting purpose, but it needs review because its default configuration uses root SSH/password access and keeps downloaded logs by default.

Review before installing. Replace the sample connection with a least-privilege SSH account, remove inline password fields, use a secret manager or environment reference, and change log retention so downloaded snippets are deleted by default or stored in a restricted, per-session location. Do not put real production credentials in config.yaml.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: config.yaml:12

Finding

SSH Connection Uses an Unrestricted Root Account

Content

View full analysis

Vulnerability Details

File Location: config.yaml:12-16
Vulnerability Type: Excessive SSH privileges and violation of least privilege
Risk Level: High

Vulnerable Configuration:

yaml

connections:
  default-server:
    host: hostname
    port: 22
    username: root
    password: password

Technical Analysis

The Skill is intended to inspect service status and read selected log data. These operations ordinarily require only narrowly scoped read access to designated log directories and, at most, permission to execute a limited set of status and filtering commands.

Configuring the SSH connection to use root gives the Agent unrestricted control over the target host. This exceeds the minimum permissions required by the declared log-analysis functionality. Although SKILL.md instructs the Agent not to modify files or restart services unless requested, that is an instructional restriction rather than an enforceable access-control boundary.

Any command-injection flaw, maliciously constructed incident request, incorrect command generation, or compromise of the Agent session would therefore execute within a root-level SSH context.

Attack Path

1. An operator configures a real host under default-server while retaining username: root.
2. The Skill initiates an SSH session to perform log checks.
3. An attacker influences a diagnostic command, path, keyword, or other command input, or otherwise compromises the Agent session.
4. The resulting command is executed remotely as root.
5. The attacker can access or modify resources unrelated to log diagnosis because no operating-system privilege boundary limits the session.

Impact Assessment

Successful exploitation could provide complete administrative control over the configured remote server. Potential impact includes reading credentials and private application data, modifying services and configuration, accessing unrelated tenants ...[truncated 180 chars]

Remediation

View remediation

Remediation Suggestions

• Replace root with a dedicated service account created exclusively for log diagnostics.
• Grant read permission only to explicitly approved log paths.
• If elevated commands are unavoidable, configure sudoers to allow only exact, non-interactive commands with fixed arguments.
• Restrict the SSH account using an authorized-key command, source-address restrictions, and disabled port forwarding, agent forwarding, and interactive shell access where practical.
• Maintain an allowlist of permitted hosts, log directories, and commands.
• Validate and safely quote all user-derived paths, search terms, time ranges, and service names before constructing remote commands.
• Record and monitor all diagnostic SSH activity.

T09 · Insecure Skill Coding Practices

Warning

• Location: config.yaml:12

Finding

Plaintext SSH Password Field in Operations Configuration

Content

View full analysis

Vulnerability Details

File Location: config.yaml:12-16
Vulnerability Type: Plaintext credential storage pattern
Risk Level: Medium

Vulnerable Configuration:

yaml

connections:
  default-server:
    host: hostname
    port: 22
    username: root
    password: password

Technical Analysis

The value appears to be a placeholder rather than a confirmed live credential. Nevertheless, the configuration schema directly models an SSH password as plaintext and encourages operators to replace the placeholder with an actual secret.

This contradicts the project's own security guidance. SKILL.md requires environment variables, key files, or external secret managers, while reference.md states that plaintext passwords must not be included and recommends an auth.password_env or key reference.

A real password placed in this field would be exposed to every process, user, backup system, source-control system, or Agent context able to read the project directory. Because the same connection is configured with the root username, credential disclosure could have particularly severe consequences.

Attack Path

1. An operator replaces the placeholder value with a valid SSH password.
2. The configuration is committed, archived, copied into an Agent context, included in a diagnostic bundle, or left readable on disk.
3. An attacker or unauthorized local process obtains config.yaml.
4. The attacker extracts the host, username, and plaintext password.
5. If network access and SSH policy permit, the attacker authenticates directly to the target server.

Impact Assessment

Exposure of a valid password could permit unauthorized SSH authentication with the privileges of the configured account. Under the current configuration pattern, that account is root, so the potential scope is full control of the target host. Even if a lower-privileged account is substituted, the attacker could read all res ...[truncated 89 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the password field from the supported configuration schema.

• Replace it with a non-secret reference, such as:

  yaml

  auth:
    method: password
    password_env: SERVER_LOG_ANALYSIS_SSH_PASSWORD
  

• Prefer a passphrase-protected, narrowly authorized SSH key or a short-lived certificate issued by an identity system.

• Retrieve secrets at runtime from an approved secret manager and prevent them from being printed in logs or responses.

• Add configuration validation that rejects password, private_key, and other inline secret fields.

• Add secret scanning to source-control and release workflows.

• If a real credential was ever stored in this field, remove it from repository history and backups where possible, rotate it immediately, and review SSH authentication logs.

T09 · Insecure Skill Coding Practices

Warning

• Location: config.yaml:3

Finding

Sensitive Downloaded Logs Are Preserved by Default

Content

View full analysis

Vulnerability Details

File Location: config.yaml:3-9; related instruction at SKILL.md:114
Vulnerability Type: Unsafe retention of sensitive temporary data
Risk Level: Medium

Vulnerable Configuration and Instruction:

yaml

analysis:
  local_temp_dir: temp/server-log-analysis
  default_time_window: 2h
  default_tail_lines: 3000
  max_download_mb_per_file: 50
  prefer_remote_filter: true
  preserve_downloads: true

markdown

- Unless requested, do not auto-delete downloaded logs.

Technical Analysis

The Skill downloads remote log snippets into the predictable local directory temp/server-log-analysis and preserves them by default. Application logs commonly contain authentication tokens, session identifiers, personal data, request contents, internal hostnames, stack traces, database details, and other operationally sensitive information.

Persistent retention is not generally required for the declared task once analysis is complete. The reviewed files do not define restrictive file permissions, isolated per-session directories, encryption, automated expiration, secure deletion, or a maximum retention period. The default therefore increases the duration and number of contexts in which downloaded information may be exposed.

The Skill does reduce transfer scope through remote filtering and download limits, but those controls do not protect files after they have been written locally.

Attack Path

1. The Skill connects to a remote service and downloads log snippets for diagnosis.
2. The snippets contain sensitive operational or user information.
3. Files are written under the predictable temp/server-log-analysis path.
4. Because preserve_downloads is enabled and the instructions discourage automatic deletion, the files remain after the diagnostic session.
5. A later Agent session, local user, process, backup job, artifact collector, or accidental source-control operat ...[truncated 436 chars]

Remediation

View remediation

Remediation Suggestions

• Change the default to preserve_downloads: false.
• Delete downloaded snippets automatically after analysis unless the user explicitly requests retention.
• Create a randomized, per-session temporary directory with owner-only permissions, such as mode 0700, and files with mode 0600.
• Enforce a short retention limit and implement cleanup for abandoned sessions.
• Prevent the temporary directory from being committed or packaged by adding it to ignore and artifact-exclusion rules.
• Redact or tokenize credentials, session identifiers, personal data, and other sensitive values before persistent storage or report generation.
• Encrypt retained diagnostic artifacts and document who may access them.
• Record the source, collection time, sensitivity, and expiration time of intentionally retained logs.
• Update SKILL.md so preservation requires explicit user opt-in rather than being the default.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The configuration hard-codes privileged SSH credentials, including a root username and plaintext password, directly in the skill manifest. This creates an immediate secret exposure risk and enables full remote compromise of the target server if the file is read, leaked, logged, or reused elsewhere; the danger is amplified because the account is root and the skill is specifically designed to connect to remote systems.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This manifest lists very broad keywords such as "login", "timeout", and "order" without any narrowing context or exclusion conditions. In a manifest file, such generic triggers can overlap with common incident descriptions and make it unclear when this skill should activate versus when another skill should handle the request.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · reference.md (reported line 89)May include surrounding context.

md

4. Inspect recent tail output or keyword matches remotely first.
5. Download only minimal required snippets.
6. Analyze locally.
7. Expand scope only when evidence is insufficient.

## Recommended Download Strategy

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · reference.md (reported line 93)May include surrounding context.

md

4. Inspect recent tail output or keyword matches remotely first.
5. Download only minimal required snippets.
6. Analyze locally.
7. Expand scope only when evidence is insufficient.

## Recommended Download Strategy