server-log-analysis

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:45 AM UTC
• Version: 1.0.0

Overview

This skill has a legitimate log-analysis purpose, but it encourages sensitive SSH and log-handling patterns that users should review before installing.

Install only if you are comfortable giving the agent SSH-based access for log diagnosis. Replace the sample root/password connection with a least-privilege log-reading account and key or environment-based credentials, avoid storing real secrets in config.yaml, and clean or protect downloaded logs under temp/server-log-analysis.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: config.yaml:10

Finding

Plaintext SSH Credentials for a Privileged Root Account

Content

View full analysis

Vulnerability Details

File Location: config.yaml, lines 10–15
Vulnerability Type: Plaintext credential storage and excessive privilege
Risk Level: High

Vulnerable configuration:

yaml

connections:
  default-server:
    host: hostname
    port: 22
    username: root
    password: password

Technical Analysis

The SSH connection configuration includes a password directly in a versionable YAML file and associates it with the privileged root account. Although the values appear to be placeholders, the schema encourages users to replace them in place with operational credentials. This conflicts with the security guidance elsewhere in the project, which recommends environment variables, key references, or external secret-management systems.

Any user, process, backup system, source-control service, or Agent with read access to the project directory could obtain the configured credential. Use of the root account also violates least privilege: successful credential compromise would provide administrative access rather than access limited to log inspection.

Attack Path

1. An operator replaces the placeholder host and password with working production values.
2. The configuration is retained in the project directory, committed to source control, copied into a backup, or exposed to another local process.
3. An attacker or unauthorized user reads config.yaml and extracts the root SSH username and password.
4. The attacker connects to the configured SSH host on port 22.
5. If authentication succeeds, the attacker obtains root-level control over the remote server.

Impact Assessment

Successful exploitation could provide full administrative privileges on the configured remote host. The attacker could read or modify arbitrary files, extract additional credentials, access service and customer data, alter logs, stop or reconfigure services, install persistence, and potentially pivot to syst ...[truncated 245 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the password field from the tracked configuration.
• Use an explicit secret reference such as auth.password_env, a protected SSH key reference, or an external secrets manager.
• Configure validation that rejects inline passwords, private keys, tokens, and other secret material.
• Replace direct root authentication with a dedicated, unprivileged log-analysis account.
• Grant that account read access only to the required logs and narrowly scoped commands.
• Disable SSH root login and password authentication where operationally feasible.
• Protect SSH keys with restrictive filesystem permissions and, where possible, passphrases.
• Add secret scanning to pre-commit and CI workflows.
• If real credentials were ever stored in this file or its history, rotate them and remove them from repository history and backups where feasible.

T09 · Insecure Skill Coding Practices

Warning

• Location: config.yaml:3

Finding

Sensitive Remote Logs Retained in a Predictable Local Directory

Content

View full analysis

Vulnerability Details

File Location: config.yaml, lines 3–8
Vulnerability Type: Unsafe temporary-file handling and excessive data retention
Risk Level: Medium

Vulnerable configuration:

yaml

analysis:
  local_temp_dir: temp/server-log-analysis
  default_time_window: 2h
  default_tail_lines: 3000
  max_download_mb_per_file: 50
  prefer_remote_filter: true
  preserve_downloads: true

Technical Analysis

The Skill is designed to download production log fragments from remote servers. The configuration stores them in a predictable relative directory and enables indefinite preservation by default. No requirement is defined for owner-only permissions, secure directory creation, automatic expiration, encryption, secret redaction, or cleanup.

Operational logs can contain session identifiers, authorization tokens, personal data, internal hostnames, request payloads, stack traces, database details, and other sensitive information. Retaining such files increases the period during which another local user, process, subsequent Agent task, backup mechanism, or accidental source-control operation can access them.

Attack Path

1. The Skill retrieves production log data from a remote host.
2. The downloaded data is written beneath the predictable temp/server-log-analysis path.
3. Because preserve_downloads is enabled, the files remain after analysis.
4. A local user or process with access to the workspace reads the retained files, or the directory is included in a backup or source-control commit.
5. Any credentials, tokens, personal data, infrastructure details, or application internals present in the logs are disclosed and may be used in further attacks.

Impact Assessment

The exposed scope depends on the contents of downloaded logs. Potential consequences include disclosure of personal or operational data, compromise of sessions or API credentials, exposure of internal infrastructure, ...[truncated 203 chars]

Remediation

View remediation

Remediation Suggestions

• Change preserve_downloads to false by default.
• Preserve downloaded logs only after explicit user authorization and for a defined retention period.
• Create the local directory securely with owner-only permissions, such as mode 0700, and create files with mode 0600.
• Prefer an operating-system-managed secure temporary directory with unpredictable per-run subdirectories.
• Canonicalize and validate the configured destination to prevent unintended writes outside the approved workspace.
• Redact passwords, tokens, cookies, authorization headers, personal information, and other sensitive fields before persistence.
• Implement guaranteed cleanup on success, failure, cancellation, and timeout.
• Exclude the temporary directory from source control, artifact publication, and broad backup collection.
• Encrypt retained diagnostic artifacts where preservation is operationally required.
• Enforce retention, file-count, and aggregate-size limits, and document who is permitted to access preserved logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to download remote log fragments into a local temp directory, but the user-facing description does not clearly warn that those logs may contain sensitive data such as tokens, personal data, internal URLs, or stack traces. In a remote SSH log-analysis context, this omission increases the risk of unintended data exfiltration from the remote host to the local environment without informed user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The natural-language content of the skill is entirely in Chinese, which effectively imposes a specific language on users and operators. The file does not indicate that Chinese is optional, user-selected, or required for a justified region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The service and download profile descriptions and hints are written in Chinese, which imposes a specific language on users or maintainers reading the skill configuration. The file does not indicate that this skill is intentionally region-specific or provide any opt-in or alternative language, so it creates a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.