Security audit
Security checks for vulnerabilities and agentic risk
The skill is generally aligned with Flowtriq infrastructure monitoring, but it can use authenticated APIs for sensitive incident and PCAP data without clear privacy warnings or confirmation boundaries.
Review this before installing if your Flowtriq data includes customer traffic, regulated data, or sensitive network metadata. Only configure the API key for accounts and nodes you intend the agent to access, and require explicit confirmation before registering nodes, opening or updating incidents, or uploading PCAP files.
The trigger text is broad enough to activate on generic monitoring or status questions, which can cause the agent to invoke this skill in contexts where the user did not clearly intend to contact Flowtriq. Because the skill is wired to authenticated infrastructure-monitoring actions, over-triggering increases the chance of unnecessary third-party data access and disclosure.
The skill describes authenticated API usage against a third-party service but does not clearly disclose that node identifiers, configuration, incidents, and telemetry may be transmitted to Flowtriq. This creates a consent and data-handling risk because users may not realize operational metadata about their infrastructure is being accessed or shared when the skill runs.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
**Degraded / agent offline:**
> "The Flowtriq platform is reachable but your node hasn't sent a heartbeat
> recently. Your agent may be down. Run `sudo systemctl status ftagent` on
> the server to check."
---
The reference documents endpoints for uploading PCAP files and incident telemetry that can contain highly sensitive network metadata, source IPs, traffic characteristics, and potentially payload-bearing packet captures, but it provides no warning about privacy, legal, or data-handling sensitivity. In a monitoring skill, this omission can lead users or downstream agents to collect and transmit sensitive customer or third-party traffic without informed consent, minimization, or retention safeguards.