Security audit

JumpServer Skills

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed JumpServer query/reporting tool, but it needs Review because it handles credentials and privileged audit data with insecure transport defaults, automatic package installation, broad authenticated reads, and persistent local configuration writes.

Install only for authorized JumpServer administrators or auditors. Before use, pin and preinstall dependencies, enable TLS verification, require https, avoid password auth over insecure transport, store secrets outside the repository when possible, review .env writes and org changes, and limit queries/reports to the minimum organization, time range, and fields needed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/jumpserver_api/jms_types.py:27
Finding: TLS Certificate Verification Is Disabled by Default
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/jumpserver_api/jms_bootstrap.py:95
Finding: Formal Entrypoints Automatically Install an Unpinned Dependency
Content: View full analysis
=2.31.0 ``` The pip command is constructed in `scripts/jumpserver_api/jms_bootstrap.py:83-87`: ```python def _manual_install_command(requirements_file: Path) -> list[str]: return [sys.executable, "-m", "pip", "install", "-r", str(requirements_file)] ``` Missing dependencies trigger installation without user confirmation in `scripts/jumpserver_api/jms_bootstrap.py:95-125`: ```python def ensure_requirements_installed(requirements_file: Path | None = None) -> None: active_requirements = Path(requirements_file or REQUIREMENTS_FILE) if not active_requirements.exists(): _print_json_error( "Automatic dependency bootstrap failed because requirements.txt was not found.", details={ "requirements_file": str(active_requirements), "install_command": _manual_install_command(active_requirements), }, ) raise SystemExit(1) required_distributions = _required_distributions(active_requirements) if not required_distributions: return missing_distributions = [name for name in required_distributions if not _is_distribution_installed(name)] if not missing_distributions: return install_command = _manual_install_command(active_requirements) sys.stderr.write( "[jumpserver-skills] Missing Python dependencies detected: %s. Installing with %s\n" % (", ".join(missing_distributions), " ".j ...[truncated 3226 chars]
Remediation: View remediation
--hash=sha256: ``` 4. Use a fully resolved lock file containing hashes for direct and transitive dependencies, and install with: ```text python -m pip install --require-hashes -r requirements.lock ``` 5. Restrict package retrieval to an approved internal index or verified artifact repository. Do not inherit arbitrary `PIP_INDEX_URL`, `PIP_EXTRA_INDEX_URL`, or user-level pip configuration in sensitive deployments. 6. Install dependencies inside a dedicated, non-privileged virtual environment rather than modifying the agent's global interpreter environment. 7. Prefer prebuilt, verified wheels and disable source builds where operationally possible. 8. Add software-composition analysis and dependency-update review to the release process. 9. If bootstrap behavior must be retained, require an explicit `--install-dependencies` option and display the exact package versions, source, and integrity information before requesting confirmation. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (61)

Credential Access

High

Category: Privilege Escalation
Confidence: 86% confidence
Finding: The skill encourages collecting credentials through natural-language conversation and writing them into a local .env file. Storing JumpServer access keys or passwords in plaintext local files increases the risk of credential leakage via logs, workspace exposure, source control mistakes, or other local tooling that can read the repository directory.
Content: Scanner excerpt · README.en.md (reported line 35)May include surrounding context.
Manual method:

bash
cp .env.example .env

Conversation method:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 35)May include surrounding context.
手动方式：

bash
cp .env.example .env

对话方式：

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the skill claims authoritative JumpServer querying and analysis but may rely on local metadata JSON rather than live JumpServer APIs, users can be misled into trusting stale or incomplete results. This is primarily an integrity and decision-risk issue: governance, audit, or incident-response conclusions could be wrong because the provenance of data is unclear.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the skill claims authoritative JumpServer querying and analysis but may rely on local metadata JSON rather than live JumpServer APIs, users can be misled into trusting stale or incomplete results. This is primarily an integrity and decision-risk issue: governance, audit, or incident-response conclusions could be wrong because the provenance of data is unclear.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/troubleshooting.md (reported line 40)May include surrounding context.
md
-> 若为轻量失败，先升级到全量校验 -> 检查 Python 3 与自动依赖安装结果 -> 执行 config-status --json -> 检查 .env / shell 环境变量 -> jms_diagnose.py ping -> 选择组织 select-org -> 精确解析对象 resolve / list / get

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/jumpserver_api/jms_runtime.py (reported line 413)May include surrounding context.
python
-> 若为轻量失败，先升级到全量校验 -> 检查 Python 3 与自动依赖安装结果 -> 执行 config-status --json -> 检查 .env / shell 环境变量 -> jms_diagnose.py ping -> 选择组织 select-org -> 精确解析对象 resolve / list / get

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is described as a diagnostic/query tool, but config-write accepts arbitrary JSON and writes local environment configuration after only a confirmation flag. This introduces a state-changing capability that can alter authentication, endpoints, or runtime behavior, which is broader than read-only diagnostics and can be abused to redirect future API usage or weaken local security controls.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: endpoint-verify permits caller-controlled paths and parameters for arbitrary GET/OPTIONS requests through the authenticated JumpServer client. In a diagnostic skill, this significantly expands the reachable API surface beyond declared use cases and can expose sensitive data from unintended endpoints or enable enumeration of privileged functionality using the skill's credentials and org context.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/jumpserver_api/jms_runtime.py (reported line 23)May include surrounding context.
python
SKILL_DIR = Path(__file__).resolve().parents[2] LOCAL_ENV_FILE = SKILL_DIR / ".env" GLOBAL_ORG_ID = "00000000-0000-0000-0000-000000000000" DEFAULT_ORG_ID = "00000000-0000-0000-0000-000000000002" DEFAULT_PAGE_SIZE = 100

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README explicitly instructs the agent/runtime to collect JumpServer credentials and write them into a local .env file, but it does not prominently warn that these are sensitive secrets requiring secure storage and exclusion from logs, version control, and report outputs. In an agent skill context, this increases the chance that credentials are persisted insecurely, echoed back in conversation, or left behind on shared workstations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises and operationalizes shell, file write, network, and environment-manipulation capabilities without declaring an explicit tool scope. That creates an authorization gap: a caller or reviewer cannot reliably tell that the skill may modify local configuration and invoke external systems, increasing the risk of unintended command execution or environment changes.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The invocation language is very broad and overlaps with generic requests for analysis, inspection, reports, and diagnosis. In an agent environment, this can cause over-triggering of a skill that has shell/network/write capabilities, expanding the number of situations where potentially sensitive JumpServer queries or local state changes are performed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest text and default prompt are written as mandatory Chinese instructions for handling requests, and there is no indication that users may choose another language. This creates a natural-language locale policy concern because the skill appears to impose a specific language without opt-in or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This is a markdown file, so SQP-2 applies to missing user warnings in the skill description. The document instructs users to query login records, terminal sessions, command history, suspicious activity, and file transfer logs, but it does not include any caution about handling potentially sensitive personal, operational, or privacy-impacting audit data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The document says each capability maintains a 'trigger description' field, but this human-facing index does not define concrete trigger phrases, scope limits, or disambiguation rules. In a skill that can query audit logs, sessions, accounts, permissions, and system settings, vague triggering increases the chance of over-broad capability invocation and unnecessary exposure of sensitive data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file enumerates capabilities for command logs, session records, file transfers, account inventories, permissions, and system settings without any warning that these may expose highly sensitive operational, identity, and configuration data. In the JumpServer context, such data can reveal privileged activity, internal topology, account relationships, and security control settings, making accidental over-collection or over-disclosure more dangerous.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill is designed to read sensitive access, audit, permission, system-setting, and license information, yet the documentation provides no privacy or sensitivity warning. In a privileged environment like JumpServer, these outputs may expose user access patterns, infrastructure inventory, and governance details that should be handled under least-privilege and need-to-know controls.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation explicitly includes config-write, which writes collected runtime configuration into .env. That exceeds a pure query/analysis scope and introduces a state-changing local side effect that could persist sensitive connection details or alter future executions if invoked without strong guardrails.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The markdown describes writing runtime configuration to .env but does not prominently warn that local configuration files will be modified and may contain sensitive values. This can lead users or higher-level agents to perform persistent changes without understanding the security and operational consequences.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: select-org is described as able to explicitly write JMS_ORG_ID, which changes execution context rather than only inspecting JumpServer state. Changing organization scope can redirect subsequent queries to a different tenant/org and may cause unintended data exposure or mis-scoped analysis.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/metadata/capabilities.json (reported line 12)May include surrounding context.
json
"trigger_description": "适用于按用户、资产、命令关键字、时间范围排查堡垒机命令执行记录，并输出明细与风险摘要。", "examples": [ "查询近 7 天 root 在生产资产上执行过哪些命令", "按命令关键字 sudo 排查某用户的高风险操作" ], "endpoints": [ "/api/v1/terminal/commands/",

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This JSON manifest uses Chinese-only natural-language descriptions such as "许可证归属公司" and continues that pattern throughout the file, with no indication that the skill is region-specific or that users can opt into this locale. Under the policy, forcing a specific language without user choice or clear justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The mapping table repeatedly uses broad '适用于' routing descriptions without clear exclusion criteria, preconditions, or escalation boundaries. In a security-sensitive JumpServer skill, that can cause over-broad skill selection and lead the agent to retrieve audit, permission, user, or governance data outside the user's actual need, increasing the risk of unnecessary exposure of sensitive operational information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 75% confidence
Finding: 对 markdown 文件，SQP-2 关注是否缺少会影响用户数据、隐私或系统完整性的行为警示。L66 明确说明 README 与 references 不保留 preview/confirm 写流程描述，虽然本文件同时声称仓库不提供写操作，但这一表述会降低文档层面对高影响操作的显式提醒，尤其在技能边界演进或复用时容易造成误解。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file presents all operational guidance exclusively in Chinese, which can amount to a language/locale policy violation when users are not offered an explicit language choice. The rule for natural-language policy violations applies to all file types, and there is no indication here that the Chinese-only constraint is optional or justified as region-specific.
Content: No source excerpt is available for this finding.