Suricata IDS Monitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:51 AM UTC
• Version: 1.0.0

Overview

This skill performs useful Suricata alert reporting, but its local-only privacy claims conflict with Telegram delivery, credential use, memory writes, and scheduled recurring execution.

Install only after reviewing and narrowing the data flows. Treat Suricata logs and generated reports as sensitive. Do not rely on the local-only privacy claim unless Telegram delivery, memory writes, and cron scheduling are removed or made explicit opt-in, and prefer group or ACL-based log access instead of chmod 644.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:124
• Finding: Undisclosed Transmission of Sensitive Suricata Telemetry to Telegram<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:3, 12, 124-133` **Vulnerability Type**: Privacy violation and external transmission of sensitive security telemetry **Risk Level**: Medium ### Vulnerable Code ```python **To Telegram** (use telegram-notifier skill): ```python # After building the report string above: import os, requests requests.post( f"https://api.telegram.org/bot{os.environ['TELEGRAM_BOT_TOKEN']}/sendMessage", json={"chat_id": os.environ['TELEGRAM_CHAT_ID'], "text": report}, timeout=10 ) ``` ``` This behavior conflicts with the Skill's declared privacy properties: ```yaml description: Read and triage Suricata IDS/IPS alerts from eve.json into a structured threat report — severity-ranked findings, attacker IPs, top triggered signatures, and recommended blocks. Use when you want an automated threat intelligence snapshot from your Suricata deployment, after a scan triggers alerts, or as a daily security briefing module. No external API. Reads your local Suricata log only. ``` ```text **Privacy:** Reads `/var/log/suricata/eve.json` only. No data leaves your machine. ``` ### Technical Analysis The generated report may contain source and destination IP addresses, destination ports, protocols, alert signatures, alert timestamps, attack categories, and an assessment of the deployment's security posture. The delivery code sends the complete report to Telegram's external API. Although Telegram delivery is documented in a later section, it directly contradicts the prominent assertions that the Skill uses no external API and that no data leaves the machine. Users relying on those assertions may execute or schedule the Skill without understanding that sensitive incident telemetry can be disclosed to a third party. The bot token is also placed in the request URL. HTTPS protects it in transit, but URL-bearing credentials may be exposed to HTTP client diagnostics, proxy logs, exception reports, or monitoring systems that re ...[truncated 1536 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove or correct the claims that the Skill uses no external API and that no data leaves the machine. 2. Make external delivery strictly opt-in and require explicit user confirmation before the first transmission. 3. Keep local report generation as the default behavior and place Telegram delivery in a clearly separated optional workflow. 4. Display the categories of data that will be transmitted before enabling delivery. 5. Redact or pseudonymize private destination addresses, host identifiers, ports, and sensitive signature details unless they are explicitly required by the recipient. 6. Permit an allowlist of approved report fields rather than sending the complete report by default. 7. Apply restrictive access controls to the Telegram bot and target chat, and document Telegram's retention and third-party processing implications. 8. Avoid exposing the bot token in logs. Disable verbose HTTP logging, sanitize errors, and ensure proxies and monitoring systems redact Telegram bot URLs. 9. Provide a local-only scheduling example separately from the Telegram-enabled cron example. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:27
• Finding: Suricata Log Made Readable by All Local Users<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:27-30` **Vulnerability Type**: Excessive file permissions and violation of least privilege **Risk Level**: Medium ### Vulnerable Code ```bash If the log is permission-denied: ```bash sudo chmod 644 /var/log/suricata/eve.json ``` ``` ### Technical Analysis Mode `0644` grants read access to the file owner, its group, and every other local user. Suricata's `eve.json` can contain substantially more information than the report fields extracted by this Skill, including network addresses, ports, protocols, alert metadata, flow details, and potentially application-layer event data. The Skill only needs the invoking identity to have read access. Granting access to the system-wide `other` class exceeds that requirement and breaks least-privilege boundaries. The instruction also fails to account for log rotation. A rotation policy may recreate the file with different permissions, leading users to repeatedly weaken access or to modify rotation configuration insecurely. ### Attack Path 1. The invoking user encounters a permission error while reading `/var/log/suricata/eve.json`. 2. Following the documented workaround, an administrator runs `sudo chmod 644 /var/log/suricata/eve.json`. 3. The file becomes readable by every local account and process operating under those accounts. 4. An unprivileged local user opens or copies the log without needing membership in Suricata's authorized log-reading group. 5. The user extracts network topology, monitored services, alert details, and other event data for reconnaissance or unauthorized monitoring. ### Impact Assessment This issue does not grant write access, root access, or direct code execution. It broadens read privileges to all local users and can expose security-sensitive network telemetry beyond the users and services that legitimately require it. The affected scope is the current `eve.json` file. Related rotated logs are affected only if their permiss ...[truncated 74 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the recommendation to use world-readable mode `0644`. 2. Prefer membership in a dedicated Suricata log-reader group, with the log kept at mode `0640`: ```bash sudo usermod -aG suricata "$USER" sudo chgrp suricata /var/log/suricata/eve.json sudo chmod 640 /var/log/suricata/eve.json ``` 3. If group membership is unsuitable, grant a narrowly scoped read ACL only to the required account: ```bash sudo setfacl -m "u:$USER:r" /var/log/suricata/eve.json ``` 4. Configure Suricata and its log-rotation policy to preserve the restrictive group or ACL for newly created files. 5. Do not grant write permission to the monitoring account. 6. Document that access changes require administrator approval because the log may contain sensitive event data. 7. Apply restrictive permissions to generated reports and memory files as well, such as mode `0600` for per-user report files. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (15)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical

• Category: YARA Match

Content

cata rule for: [top signature]
  [ ] If RED posture: run eva-security-audit skill

STATUS: [GREEN/YELLOW/RED]
  GREEN  = 0 critical, <10 high in 24h
  YELLOW = 1–5 critical OR 10–50 high
  RED    = >5 critical OR >50 high OR C2/exploit signatures detected
```

### 4. Deliver

**To Telegram** (use telegram-notifier skill):
```python
# After building the report string above:
import os, requests
requests.post(
    f"https://api.telegram.org/bot{os.environ['TELEGRAM_BOT_TOKEN']}/sendMessage",
    json={"chat_id": os.environ['TELEGRAM_CHAT_ID'], "text": report},
    timeout=10
)
```

**To memory:**
```bash
echo "[report]" >> memory/$(date +%Y-%m-%d).md
```

---

## Schedule daily monitoring

```bash
openclaw cron add \
  --name "suricata-monitor:daily" \
  --cron "0 7 * * *" \
  --prompt "Run the suricata-monitor skill. Look back 24 hours. Send report to Telegram and append to today's memory file."
```

---

## Signature categories to watch

| Category | Severity | Action |
|----------|

• Confidence: 86% confidence
• Finding: The combination of reading environment-stored bot credentials and immediately sending report contents to a webhook-like external endpoint matches a strong exfiltration pattern. Although the apparent purpose is notification rather than overt credential theft, in this context it still creates an externally connected channel that can move sensitive IDS-derived data off-host under misleading local-only claims.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is presented as a read-only analyzer, but it also documents writing reports to memory files and installing a scheduled cron job. Hidden write and persistence behaviors undermine least surprise and can cause unauthorized state changes or repeated execution beyond the user's intended one-time analysis.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation explicitly says 'No data leaves your machine' and 'Reads /var/log/suricata/eve.json only,' but later instructions contradict both claims by sending reports to Telegram and appending data to local memory files. This is a significant trust and transparency failure that can lead operators to expose sensitive IDS findings under a false privacy guarantee.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a read-only analyzer, but it also documents writing reports to memory files and installing a scheduled cron job. Hidden write and persistence behaviors undermine least surprise and can cause unauthorized state changes or repeated execution beyond the user's intended one-time analysis.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The description says to use the skill for an "automated threat intelligence snapshot," "after a scan triggers alerts," or as a "daily security briefing module," but it does not define explicit trigger phrases or exclusion conditions. In a manifest/markdown context, this breadth makes activation scope ambiguous and could cause unintended invocation in general security-analysis conversations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation includes commands to relax log permissions and later transmit report contents externally, but it does not warn users about confidentiality, integrity, or privilege implications. Lowering permissions on IDS logs can expose sensitive telemetry to more local users, and external transmission can leak internal network indicators.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

If the log is permission-denied:
```bash
sudo chmod 644 /var/log/suricata/eve.json
```

---

• Confidence: 93% confidence
• Finding: The specific recommendation to set mode 644 on eve.json is unsafe because it makes a security log globally readable. In context, the file may contain sensitive incident and network data, so this permission change can expose information to unintended local principals.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

If the log is permission-denied:
```bash
sudo chmod 644 /var/log/suricata/eve.json
```

---

• Confidence: 93% confidence
• Finding: The specific recommendation to set mode 644 on eve.json is unsafe because it makes a security log globally readable. In context, the file may contain sensitive incident and network data, so this permission change can expose information to unintended local principals.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Alerts: X total  |  Critical: X  High: X  Medium: X  Low: X

TOP ATTACKER IPs
  1. [ip]  — X hits  (Block: sudo ufw deny from [ip])
  2. ...

TOP SIGNATURES

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Alerts: X total  |  Critical: X  High: X  Medium: X  Low: X

TOP ATTACKER IPs
  1. [ip]  — X hits  (Block: sudo ufw deny from [ip])
  2. ...

TOP SIGNATURES

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Alerts: X total  |  Critical: X  High: X  Medium: X  Low: X

TOP ATTACKER IPs
  1. [ip]  — X hits  (Block: sudo ufw deny from [ip])
  2. ...

TOP SIGNATURES

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill accesses Telegram bot credentials from environment variables even though its advertised scope is local log analysis. Pulling credentials into scope for an unnecessary external-send path increases the blast radius: a skill trusted for local inspection can become a bridge for outbound transmission using privileged secrets already present in the environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

```python
# After building the report string above:
import os, requests
requests.post(
    f"https://api.telegram.org/bot{os.environ['TELEGRAM_BOT_TOKEN']}/sendMessage",
    json={"chat_id": os.environ['TELEGRAM_CHAT_ID'], "text": report},
    timeout=10

• Confidence: 97% confidence
• Finding: This code posts the generated Suricata report to Telegram, creating a clear outbound data channel from sensitive IDS telemetry to a third-party service. In the context of a skill advertised as local-only, the external send materially increases risk of unintended disclosure of attacker IPs, internal destination IPs, ports, and detection details.

External Transmission

Medium

• Category: Data Exfiltration

Content

# After building the report string above:
import os, requests
requests.post(
    f"https://api.telegram.org/bot{os.environ['TELEGRAM_BOT_TOKEN']}/sendMessage",
    json={"chat_id": os.environ['TELEGRAM_CHAT_ID'], "text": report},
    timeout=10
)

• Confidence: 94% confidence
• Finding: The explicit Telegram API endpoint confirms that the skill is designed to send data to an external service. Given the surrounding false privacy assurances, this is more dangerous than a normal notifier because operators may not realize alert data leaves the host.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The cron-based self-scheduling capability extends the skill from passive analysis into persistence and repeated autonomous execution. In security-sensitive environments, unattended recurrence can amplify mistakes, create noisy or unwanted outbound activity, and make the skill harder to audit or contain.

Static analysis

No suspicious patterns detected.