Error Log Analyzer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:54 AM UTC
• Version: 1.2.0

Overview

The skill is a real error-log analyzer, but it can send sensitive log contents to external AI providers despite local-only privacy claims and has an unsafe web display path.

Review before installing in any environment with production, customer, credential, or private logs. Use only sanitized logs unless you are comfortable sending error messages and stack traces to the configured AI provider. Do not rely on the local-only privacy statement, and avoid the optional web UI with untrusted logs until output escaping is fixed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: src/analyzers/__init__.py:54

Finding

Potentially Sensitive Log Data Is Transmitted to External AI Providers Without Accurate Disclosure

Content

View full analysis

str: """Build the AI prompt.""" prompt = f"""You are a senior software engineer helping debug an application error. Analyze this error and provide a clear, actionable response: ERROR MESSAGE: {error_message} """ if stack_trace: prompt += f""" STACK TRACE: {stack_trace[:2000]} # Limit stack trace length """ prompt += """ Please provide your analysis in this exact JSON format: { "error_type": "Brief error type (e.g., Database Connection Error)", "severity": "CRITICAL|HIGH|MEDIUM|LOW", "explanation": "Plain English explanation of what happened (2-3 sentences)", "root_cause": "The underlying cause (1-2 sentences)", "suggestions": [ "Step 1 to fix", "Step 2 to fix", "Step 3 to fix" ], "code_examples": [ "// Optional code example" ] } Guidelines: - Be specific and actionable - Use simple language (avoid jargon when possible) - Provide numbered steps - Include commands/code when relevant - Be helpful and encouraging """ return prompt ``` ```python def _call_claude(self, prompt: str) -> str: """Call Claude API.""" try: import anthropic client = anthropic.Anthropic(api_key=self.api_key) message = client.messages.create( model="claude-3-5-sonnet-20241022", max_tokens=1024, messages=[{"role": "user", "content": prompt}] ) return message.content[0].text except ImportError: raise ImportError("Please insta ...[truncated 2582 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: src/analyzers/__init__.py:91

Finding

Untrusted Log Content Can Perform Indirect Prompt Injection Against AI Analysis

Content

View full analysis

str: """Build the AI prompt.""" prompt = f"""You are a senior software engineer helping debug an application error. Analyze this error and provide a clear, actionable response: ERROR MESSAGE: {error_message} """ if stack_trace: prompt += f""" STACK TRACE: {stack_trace[:2000]} # Limit stack trace length """ prompt += """ Please provide your analysis in this exact JSON format: { "error_type": "Brief error type (e.g., Database Connection Error)", "severity": "CRITICAL|HIGH|MEDIUM|LOW", "explanation": "Plain English explanation of what happened (2-3 sentences)", "root_cause": "The underlying cause (1-2 sentences)", "suggestions": [ "Step 1 to fix", "Step 2 to fix", "Step 3 to fix" ], "code_examples": [ "// Optional code example" ] } Guidelines: - Be specific and actionable - Use simple language (avoid jargon when possible) - Provide numbered steps - Include commands/code when relevant - Be helpful and encouraging """ return prompt ``` ### Technical Analysis The application concatenates attacker-influenced error messages and stack traces directly into the same user prompt that contains the analyzer's operational instructions. It does not establish a strong trust boundary or explicitly instruct the model that content inside the log must be treated only as inert evidence. An attacker who can cause controlled text to be written to a log can include instruction-like content, such as directions to ignore the requested JSON schema, misclassify an error, hide an indicator of compromise, or recommend a dangerous remediation command. Large language models do not reliably distinguish such embedded instructions from the surroundi ...[truncated 1512 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: web/templates/index.html:458

Finding

Unescaped AI and Log-Derived Fields Allow DOM-Based Cross-Site Scripting

Content

View full analysis

📊 Analysis Summary

Total Errors

${results.total_errors}

Unique Errors

${results.unique_errors}

Trend

${results.trends.trend}

${results.summary}

`; document.getElementById('summary').innerHTML = summaryHtml; // Display error cards const cardsHtml = results.analyses.map(error => `

${error.error_type}

${error.severity}

What happened

${error.explanation}

Occurrences

${error.occurrence_count} time(s)

How to fix

${error.suggestions.map(s => `
• ${s}
`).join('')}

${error.code_examples && error.code_examples.length > 0 ? `

Code Example

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (53)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This is an overbroad and likely inaccurate privacy claim: the README says all processing happens locally and logs are never stored on external servers, yet the skill explicitly supports cloud AI providers. False privacy guarantees are especially dangerous for a log-analysis tool because users may trust it with highly sensitive logs under incorrect assumptions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill exposes test, benchmark, feedback, or CLI orchestration modes unrelated to end-user log analysis, that expands behavior beyond the stated purpose and may trigger local command execution or file operations users did not expect. Undocumented execution paths increase attack surface and make it harder for users to assess operational risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the skill exposes test, benchmark, feedback, or CLI orchestration modes unrelated to end-user log analysis, that expands behavior beyond the stated purpose and may trigger local command execution or file operations users did not expect. Undocumented execution paths increase attack surface and make it harder for users to assess operational risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the skill exposes test, benchmark, feedback, or CLI orchestration modes unrelated to end-user log analysis, that expands behavior beyond the stated purpose and may trigger local command execution or file operations users did not expect. Undocumented execution paths increase attack surface and make it harder for users to assess operational risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the skill exposes test, benchmark, feedback, or CLI orchestration modes unrelated to end-user log analysis, that expands behavior beyond the stated purpose and may trigger local command execution or file operations users did not expect. Undocumented execution paths increase attack surface and make it harder for users to assess operational risk.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

2. Start the database if it's stopped:
   sudo systemctl start postgresql

3. Verify the connection settings in your .env file:
   DATABASE_URL=postgresql://user:password@localhost:5432/dbname

4. Test the connection manually:

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The FAQ claims that all processing happens locally and that logs are never stored on external servers, yet the same document requires API keys for AI analysis and supports external model providers. This is a materially misleading privacy statement because users may submit sensitive logs under the false assumption that no external disclosure occurs.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · src/analyzers/__init__.py (reported line 133)May include surrounding context.

python

- Be helpful and encouraging
"""
        
        return prompt
    
    def _call_claude(self, prompt: str) -> str:
        """Call Claude API."""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide instructs users to set third-party AI API keys and enables AI-backed analysis, but it does not disclose that submitted log data may be sent to external providers. Error logs often contain sensitive material such as tokens, stack traces, internal hostnames, file paths, or user data, so this omission can lead to unintended data exposure and compliance/privacy issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The setup and quick-start sections encourage users to configure external AI APIs but do not warn that submitted logs may be transmitted to external providers. Since error logs often contain credentials, tokens, stack traces, hostnames, and PII, this omission can cause users to unknowingly disclose sensitive information.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 92)May include surrounding context.

md

How to fix it:
1. Check if PostgreSQL is running:
   sudo systemctl status postgresql

2. Start the database:
   sudo systemctl start postgresql

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 95)May include surrounding context.

md

How to fix it:
1. Check if PostgreSQL is running:
   sudo systemctl status postgresql

2. Start the database:
   sudo systemctl start postgresql

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md

How to fix it:
1. Check if PostgreSQL is running:
   sudo systemctl status postgresql

2. Start the database:
   sudo systemctl start postgresql

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md

How to fix it:
1. Check if PostgreSQL is running:
   sudo systemctl status postgresql

2. Start the database:
   sudo systemctl start postgresql

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · src/analyzers/__init__.py (reported line 232)May include surrounding context.

python

How to fix it:
1. Check if PostgreSQL is running:
   sudo systemctl status postgresql

2. Start the database:
   sudo systemctl start postgresql

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · src/analyzers/__init__.py (reported line 233)May include surrounding context.

python

How to fix it:
1. Check if PostgreSQL is running:
   sudo systemctl status postgresql

2. Start the database:
   sudo systemctl start postgresql

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · src/analyzers/__init__.py (reported line 254)May include surrounding context.

python

How to fix it:
1. Check if PostgreSQL is running:
   sudo systemctl status postgresql

2. Start the database:
   sudo systemctl start postgresql

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · src/analyzers/__init__.py (reported line 331)May include surrounding context.

python

How to fix it:
1. Check if PostgreSQL is running:
   sudo systemctl status postgresql

2. Start the database:
   sudo systemctl start postgresql

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · src/analyzers/__init__.py (reported line 332)May include surrounding context.

python

How to fix it:
1. Check if PostgreSQL is running:
   sudo systemctl status postgresql

2. Start the database:
   sudo systemctl start postgresql

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · src/analyzers/__init__.py (reported line 614)May include surrounding context.

python

How to fix it:
1. Check if PostgreSQL is running:
   sudo systemctl status postgresql

2. Start the database:
   sudo systemctl start postgresql

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · src/analyzers/__init__.py (reported line 615)May include surrounding context.

python

How to fix it:
1. Check if PostgreSQL is running:
   sudo systemctl status postgresql

2. Start the database:
   sudo systemctl start postgresql

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README states that logs are 'never stored on external servers' while the skill also advertises use of Claude, OpenAI, and OpenAI-compatible APIs for AI analysis. That creates a misleading privacy assurance because log contents may be transmitted to third-party services, exposing sensitive operational data or secrets contained in logs.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises capabilities that imply reading files, accessing environment variables, making network calls, and possibly invoking shell commands, but it does not declare any explicit tool scope or permissions. This makes the operational boundary opaque and increases the chance of over-privileged execution, especially when handling sensitive log files and API keys.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description promotes AI analysis but omits a warning that enabling those features may transmit log contents to third-party model providers. Because logs often contain secrets, internal hostnames, stack traces, and personal data, lack of disclosure can lead to accidental data exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Real-time monitoring of application logs implies ongoing access to potentially sensitive files, and alerting may further disclose excerpts to external systems such as chat or notification platforms. Without an explicit warning, users may enable continuous collection and forwarding without understanding the privacy and security implications.

Content

No source excerpt is available for this finding.