System Load Monitor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:11 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a load-checking helper, but it can expose full process command lines and may advise continuing when load checks fail.

Review before installing on shared, production, or privileged servers. Treat its JSON and logs as sensitive because process command lines can include tokens, passwords, URLs, or private paths. Do not rely on it as an automatic task controller without adding explicit confirmation, safer error handling, and command-line redaction.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check_load.py:45

Finding

Exposure of Sensitive Process Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/check_load.py, lines 45-64
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

python

def get_top_processes(limit=5):
    """Get top processes by CPU usage"""
    try:
        result = subprocess.run(
            ['ps', 'aux', '--sort=-%cpu'],
            capture_output=True, text=True, timeout=5
        )
        lines = result.stdout.strip().split('\n')[1:limit+1]
        processes = []
        for line in lines:
            parts = line.split()
            if len(parts) >= 11:
                processes.append({
                    "user": parts[0],
                    "cpu_percent": float(parts[2]),
                    "mem_percent": float(parts[3]),
                    "command": ' '.join(parts[10:])
                })
        return processes
    except Exception as e:
        return [{"error": str(e)}]

Technical Analysis

The script invokes ps aux, which enumerates processes system-wide and includes their complete command-line arguments. It then copies those arguments into the command field of the returned result.

Command-line arguments can contain API tokens, passwords, database connection strings, signed URLs, private paths, or other confidential values. The collected data is exposed through the script's JSON output and can subsequently enter agent transcripts, application logs, monitoring systems, or notification channels.

Full process arguments are not required to determine CPU or memory load. Consequently, their collection and disclosure exceed the minimum information necessary for the skill's stated purpose.

Attack Path

1. A process is started with a sensitive value in its command-line arguments, such as an API token or database password.
2. The process consumes enough CPU to appear among the five highest-CPU processes.
3. A user or automated agent inv ...[truncated 882 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove complete command-line arguments from the output.
2. Report only the minimum necessary process metadata, such as PID, CPU percentage, memory percentage, and executable name.
3. Prefer a command that does not expose arguments, or read a sanitized executable name from an appropriate system interface.
4. Where feasible, restrict process enumeration to processes owned by the current user.
5. If arguments must be retained for a justified use case, implement strict allowlisting and redact tokens, passwords, authorization headers, connection strings, URLs containing credentials, and other credential-like values.
6. Treat monitoring output as sensitive and prevent it from being written to public logs or unrestricted notification channels.
7. Add tests using synthetic secrets in process arguments to verify that generated output never includes those values.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check_load.py:11

Finding

Load-Monitoring Failures Produce an Unsafe Continue Recommendation

Content

View full analysis

Vulnerability Details

File Location: scripts/check_load.py, lines 11-77
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

python

def get_cpu_load():
    """Get CPU load average (1 minute)"""
    try:
        load_avg = os.getloadavg()[0]
        cpu_count = os.cpu_count() or 1
        load_percent = (load_avg / cpu_count) * 100
        return {
            "load_avg_1m": round(load_avg, 2),
            "cpu_count": cpu_count,
            "load_percent": round(load_percent, 1)
        }
    except Exception as e:
        return {"error": str(e)}

python

def get_memory_usage():
    """Get memory usage percentage"""
    try:
        with open('/proc/meminfo', 'r') as f:
            meminfo = {}
            for line in f:
                parts = line.split(':')
                if len(parts) == 2:
                    key = parts[0].strip()
                    value = int(parts[1].strip().split()[0])
                    meminfo[key] = value

        total = meminfo.get('MemTotal', 0)
        available = meminfo.get('MemAvailable', 0)
        used = total - available
        used_percent = (used / total) * 100 if total > 0 else 0

        return {
            "total_mb": round(total / 1024, 0),
            "used_mb": round(used / 1024, 0),
            "available_mb": round(available / 1024, 0),
            "used_percent": round(used_percent, 1)
        }
    except Exception as e:
        return {"error": str(e)}

python

def check_status(cpu_threshold=90, memory_threshold=90):
    """Check system status against thresholds"""
    cpu = get_cpu_load()
    memory = get_memory_usage()
    top_procs = get_top_processes()

    cpu_critical = cpu.get('load_percent', 0) >= cpu_threshold
    memory_critical = memory.get('used_percent', 0) >= memory_threshold
    is_critical = cpu_critical or m
...[truncated 2429 chars]

Remediation

View remediation

Remediation Suggestions

1. Introduce an explicit unknown or error status whenever a required metric cannot be collected or validated.
2. Fail closed by returning a PAUSE recommendation when CPU or memory telemetry is unavailable.
3. Do not use zero as the default for missing measurements. Validate that load_percent and used_percent are present, numeric, finite, and within expected ranges before making a decision.
4. Return a nonzero exit code for telemetry failures in both human-readable and JSON modes.
5. Separate collection errors from legitimate zero-load measurements in the output schema.
6. Log concise diagnostic information without exposing unnecessary environmental details.
7. Add tests for missing /proc/meminfo, malformed memory data, unavailable load averages, zero MemTotal, and partial telemetry failure.
8. Require all essential metrics to be valid before issuing CONTINUE; otherwise, pause execution and request operator review or retry after a bounded delay.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code accurately reads system load and memory information and evaluates them against thresholds, which aligns with the monitoring portion of the description. However, its actual behavior is limited to a one-time status check plus a recommendation string ('PAUSE' or 'CONTINUE') and exit codes. There is no logic to suspend processes, resume them later, or continuously monitor and react over time. It also enumerates top processes via ps, which is related diagnostic behavior but not the declared task-control functionality. Therefore, the description materially overstates the implemented capabilities.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill includes shell-executable commands and file-path access patterns but does not declare any explicit tool scope such as permissions or allowed-tools. This increases the risk that an agent may invoke shell/file capabilities more broadly than intended, especially because the skill encourages running local Python scripts against the host environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The invocation criteria are broad enough that the skill could activate in many routine server-management scenarios, potentially causing unnecessary shell/script execution or task-control recommendations without strong user intent. In an agent setting, overly broad triggers can expand operational reach and create unsafe automation on production systems.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_load.py (reported line 55)May include surrounding context.

python

def get_top_processes(limit=5):
    """Get top processes by CPU usage"""
    try:
        result = subprocess.run(
            ['ps', 'aux', '--sort=-%cpu'],
            capture_output=True, text=True, timeout=5
        )

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill that 'automatically pauses tasks when the load exceeds the threshold, and resumes execution after the load recovers.' In this file, the implemented behavior is limited to collecting CPU/memory/process data and returning a 'PAUSE' or 'CONTINUE' recommendation; no task pause/resume logic or task control actions are performed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest focuses on monitoring CPU and memory usage and controlling tasks based on thresholds. This file also inspects and returns detailed process information via 'ps aux', which goes beyond the specifically described CPU/memory threshold checking and task pause/resume behavior.

Content

No source excerpt is available for this finding.