Security audit

unifly

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate UniFi management skill, but it gives an agent broad live network administration power with some under-scoped automation examples.

Install only for users who are authorized to administer the target UniFi environment. Before enabling mutation workflows, require explicit human review for raw API calls, --yes automation, bulk device operations, voucher purges, backup deletion, VPN changes, and reboot/poweroff actions. Treat event webhooks and JSON outputs as potentially sensitive operational data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The manifest description frames the skill around general UniFi network management but omits that the documented command surface includes extensive VPN management capabilities. That mismatch can cause operators or upstream tooling to underestimate the sensitivity of the skill and permit use in contexts where VPN creation, peer management, config download, and connection restart should receive higher scrutiny.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill metadata does not clearly advertise controller and site administration powers that the body documents, including admin management, backups, reboot, poweroff, site creation/deletion, settings changes, and raw API access. In practice, incomplete disclosure weakens informed consent and security review because a skill that appears limited to routine network tasks actually exposes high-impact administrative operations.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger language is extremely broad, activating on essentially any UniFi-, Ubiquiti-, or device-model-related mention rather than on clear intent to perform management actions. Over-broad routing increases the chance that unrelated or low-risk conversations are handed to a highly privileged infrastructure-management skill, creating unnecessary exposure to dangerous commands and raw API functionality.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This section documents destructive and high-impact operations—such as device restart, PoE cycling, firmware upgrade, firewall/NAT changes, client blocking, and raw API calls—without a prominent, upfront safety warning. In a skill that directly manages production network infrastructure, insufficient warning and guardrails materially increase the risk of outages, lockouts, traffic disruption, or unauthorized administrative changes.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The workflow explicitly recommends using --yes to bypass confirmation prompts in automation without pairing that guidance with guardrails. In a network-management skill, confirmations are one of the last protections against accidental destructive changes, so normalizing their removal increases the likelihood of mass misconfiguration or unintended service impact.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The backup rotation example permanently deletes recovery artifacts with --yes and provides no warning about retention risk or recovery implications. In infrastructure management, deleting backups can directly reduce resilience and make rollback impossible after later errors or compromise.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The voucher purge recipe removes unused vouchers based on a filter without warning that valid future guest access codes may be invalidated. Because this skill manages production access control, silent bulk cleanup can cause user lockouts and operational disruption.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The fleet upgrade script performs unattended firmware upgrades across all online switches with --yes and only a fixed sleep interval, but omits warnings about downtime, reboot behavior, and compatibility risk. In a UniFi operations context, this can disrupt broad portions of the network if run at the wrong time or against unsuitable devices.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Bulk-adopting all pending devices can enroll unintended or rogue hardware into centralized management, especially in environments with exposed adoption workflows or shared staging networks. In this skill's context, adoption grants trust and operational control, so indiscriminate enrollment materially expands attack surface and mismanagement risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The allowlist example blocks every client whose MAC does not start with one prefix, but provides no warning that vendor-prefix matching is incomplete and can misclassify legitimate devices. In a live network environment, this can rapidly deny service to authorized clients at scale.

External Transmission

Medium

Category: Data Exfiltration
Content: unifly events watch --types Client -o json | \ jq -c 'select(.severity == "Warning" or .severity == "Error")' | \ while read -r event; do curl -fsSL -X POST "$SLACK_WEBHOOK" \ -H "Content-Type: application/json" \ -d "{\"text\": $(echo "$event" | jq '.message')}" done
Confidence: 85% confidence
Finding: The event-stream example forwards event messages to an external webhook, which is an intentional data egress path. Even though the payload shown is limited to .message, UniFi event messages may still contain sensitive operational or client-related details, and the recipe does not warn about data handling, destination trust, or minimization.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: examples/config.toml:15