Security audit

Fortigate Configuration Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it can make live FortiGate changes and has unsafe defaults that could expose administrator access or broaden firewall rules.

Review carefully before installing. Use only with a least-privilege FortiGate API token, set FORTIGATE_VERIFY_SSL=true with a valid certificate, test outside production first, and avoid configure-icond until interface access changes, rollback behavior, and exact FortiOS API support are reviewed.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.py:22
Finding: TLS Certificate Verification Is Disabled by Default
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/main.py:237
Finding: Industrial Connectivity Configuration Unnecessarily Enables Administrative Services
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.py:241
Finding: Failed Industrial Connectivity Setup Leaves a Partial Security-Sensitive Configuration and Returns Success
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.py:137
Finding: Unsupported CIDR Prefixes Silently Create Overly Broad Address Objects
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill requires environment secrets (FORTIGATE_TOKEN) and performs network-based firewall administration, but it does not declare any explicit tool scope or permission boundaries. In an automation context, this increases the risk of over-broad execution, secret exposure, or unintended live changes because users and the platform are not given a clear least-privilege contract.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation advertises create, update, and delete firewall operations against a production security device without prominent user-facing warnings, confirmations, rollback guidance, or change-control precautions. In the context of a FortiGate/ICS skill, accidental or misunderstood execution could disrupt network segmentation, expose industrial protocols, or cause operational outages.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module description, CLI help text, and runtime messages are written in Chinese, with no mechanism for selecting another language. This creates a language policy concern because the skill imposes a locale/language choice on users rather than offering an opt-in or documenting a justified region-specific restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script globally disables TLS certificate warnings and allows HTTPS requests with certificate verification turned off via FORTIGATE_VERIFY_SSL=false, which is also the default. In a firewall administration skill, this makes man-in-the-middle interception of the FortiGate API session and bearer token much more feasible, especially on untrusted or segmented operational networks where self-signed certs are common.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The natural-language content, including the description, usage, and warnings, is entirely in Chinese. Under the stated policy, forcing a specific language without user opt-in or justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency specifier requests>=2.25.1 is unpinned, which allows installation of different versions over time and makes builds non-reproducible. In a security-sensitive skill that automates FortiGate firewall configuration, this increases supply-chain risk because a vulnerable or behavior-changing upstream release could be pulled in without review.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.25.1 tabulate>=0.8.9

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: requests has multiple known advisories, and because the manifest does not pin a specific version, there is no way to verify that deployed environments will avoid affected releases. This is more concerning in a firewall-automation skill because HTTP client behavior may affect authentication, certificate validation, redirect handling, or credential exposure when interacting with management interfaces.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: The dependency specifier tabulate>=0.8.9 is also unpinned, so installations may resolve to different releases over time. While this package is lower risk than a networking library, unpinned dependencies still create reproducibility and supply-chain integrity issues.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
requests>=2.25.1 tabulate>=0.8.9

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: FORTIGATE_TOKEN is accessed from the environment and then used to authorize API calls. While environment-based secret loading is common, this file does not include a visible warning, comment for users, or runtime disclosure about requiring and using privileged credentials.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.