Security audit

Monitoring

Security checks for vulnerabilities and agentic risk

Overview

The skill is documentation-only and aligned with monitoring, but several examples would deploy persistent monitoring services, expose host telemetry, or run unpinned third-party installers without enough safety guidance.

Review and harden the examples before installing anything: pin package and image versions, avoid running remote installers casually, bind monitoring ports to localhost or private networks, require authentication/TLS/firewall rules, restrict host mounts, redact logs and traces, and keep alert messages free of secrets or sensitive operational details.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Warning

Location: apm.md:27
Finding: Execution of an Unpinned Remote Sentry Wizard Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: prometheus.md:27
Finding: Monitoring Services Published Without Access-Control Safeguards
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: simple.md:20
Finding: Uptime Kuma Container Uses a Mutable Major-Version Tag
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The documentation tells users to run npx @sentry/wizard@latest, which fetches and executes the latest package version at install time without pinning. This creates a supply-chain risk: if the package or a dependency is compromised, users may execute unreviewed code directly from the registry.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The telemetry guidance encourages automatic instrumentation, user context, stack traces, breadcrumbs, and exporting traces to an external endpoint, but it does not warn about collection of sensitive data, consent, retention, redaction, or compliance obligations. In an observability skill, this omission is materially risky because users may enable broad data capture that includes PII, secrets in headers, query parameters, or application payloads, then transmit that data to third-party services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The logging guidance and examples include direct logging of user identifiers and IP addresses, and even suggest request payloads at debug level, without any warning about data minimization, redaction, or avoiding secrets and personal data. In a monitoring/logging skill, this omission is especially risky because readers may copy these patterns into production systems, creating unnecessary retention of personal or sensitive data and increasing breach, privacy, and compliance exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Compose example mounts /proc, /sys, and the host root filesystem into node_exporter, which gives the container broad read-only visibility into host internals. While this is a common monitoring pattern, the skill does not warn users that these mounts expose sensitive host metadata and filesystem structure to the container and anyone who can access its metrics or runtime environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The Docker example pulls and runs louislam/uptime-kuma:1, which is only loosely pinned to a major tag rather than an immutable image digest. A tag can be moved to a different image over time, so repeated use of the command may run unreviewed code or introduce breaking changes into monitoring infrastructure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The guide instructs users to run npx @sentry/wizard@latest, which fetches and executes remote code at install time without pinning to a specific version. If the upstream package is compromised or a breaking release is published, users may execute unexpected code in their environment during setup.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Recommending Telegram for alert delivery without noting privacy and data-sharing implications can expose operational metadata, incident details, and service status to a third-party messaging platform. While this is not code execution risk, it can create unnecessary information disclosure and compliance issues depending on what alerts contain.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.