Devops Engineer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:11 AM UTC
• Version: 1.0.2

Overview

This is a coherent DevOps reference skill, but several examples could lead to risky production infrastructure changes or sensitive data exposure if followed directly.

Review and adapt examples before installation or use in production. Require protected environments and human approvals for production changes, remove auto-approve unless tightly gated, avoid publishing full Terraform plans to pull requests, scope kubeconfig to temporary files, redact sensitive output, and pin GitHub Actions and container images to reviewed immutable versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:964

Finding

Terraform Plan Disclosure and JavaScript Injection in Pull Request Workflow

Content

View full analysis

Remediation

View remediation

"$RUNNER_TEMP/terraform-plan.txt" ``` 3. Prefer uploading the plan as a restricted workflow artifact rather than publishing it as a comment. 4. If a summary must be posted, generate a minimal structured summary and redact secrets before publication. 5. Run secret scanning against all text that may be posted to GitHub. 6. Mark applicable Terraform variables and outputs as `sensitive = true`, while recognizing that this does not guarantee all plan data is safe to publish. 7. Use the minimum workflow permissions: ```yaml permissions: contents: read pull-requests: write ``` 8. Do not execute pull-request-controlled Terraform with production credentials. Use an isolated read-only planning identity with no apply or mutation permissions. 9. Require approval before running workflows from untrusted forks and avoid exposing repository secrets to those workflows. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:228

Finding

Mutable Third-Party Action and Container Image References

Content

View full analysis

-n -it --image=nicolaka/netshoot --target= ``` ```bash kubectl run tmp-shell --rm -i --tty --image=nicolaka/netshoot -- /bin/bash ``` ### Technical Analysis The `@master` GitHub Action reference is mutable. Its effective implementation can change after review without any modification to this Skill or the consuming repository. A compromised upstream repository, maintainer account, or branch can therefore replace the code executed by subsequent workflow runs. The `nicolaka/netshoot` image is similarly referenced without a version or digest. Container registries normally resolve such a reference through a mutable default tag, commonly `latest`. A future image update or registry compromise can consequently alter the code run inside the Kubernetes environment. These tools are relevant to the declared DevOps functionality, but mutable references grant upstream publishers more trust than necessary. The same functionality can be achieved with reviewed, immutable versions. ### Attack Path 1. An upstream repository, maintainer account, release process, or container registry is compromised, or a mutable reference is otherwise changed. 2. Malicious code is committed to the GitHub Action's `master` branch or published under the unversioned container image reference. 3. A consuming CI workflow runs the Trivy step, or an operator invokes one of the Kubernet ...[truncated 1119 chars]

Remediation

View remediation

``` 2. Record the corresponding release version in a comment for maintainability and use an automated dependency updater that opens reviewed pull requests for SHA changes. 3. Pin the debugging image to a verified immutable digest: ```bash kubectl debug -n -it \ --image=nicolaka/netshoot@sha256: \ --target= ``` 4. Verify image signatures and provenance through Sigstore/Cosign or an equivalent admission policy. 5. Allow images only from approved registries and enforce digest pinning with Kubernetes admission controls. 6. Run debugging containers with a dedicated least-privilege service account, restricted pod security settings, read-only filesystems where practical, and deny-by-default network policies. 7. Minimize GitHub workflow-token permissions and avoid exposing secrets or production cloud credentials to third-party actions unless strictly required. 8. Review and update pinned dependencies through a controlled change-management process rather than accepting automatic mutable upstream changes. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

aws eks update-kubeconfig writes cluster access configuration that can grant broad Kubernetes access to the runner environment. In CI this can expose sensitive cluster credentials or create an attractive target for later steps and third-party actions, especially if the kubeconfig persists in the workspace or runner context.

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

md

steps:
      - name: Configure kubectl
        run: |
          aws eks update-kubeconfig --region ${{ vars.AWS_REGION }} --name staging-cluster
      - name: Deploy with Helm
        run: |
          helm upgrade --install app ./charts/app \

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes very broad terms such as 'deploy', 'build', 'incident', and similar everyday engineering language, which can cause the skill to activate unintentionally outside the user's intended scope. Over-broad activation increases the chance that this powerful operational skill injects risky infrastructure, deployment, or debugging guidance into unrelated contexts, creating confusion and unsafe action recommendations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Several one-word triggers are overly generic and span many non-DevOps contexts, making accidental invocation likely. In an agent environment, unintended skill activation is risky because it can steer conversations toward privileged operational actions, shell commands, network diagnostics, or deployment workflows without clear user intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

At L0087 the Docker Compose guidance says to use .env files for environment-specific variables. Later, L0156 and L1747 explicitly state secrets should never be in plaintext and never in committed .env, while L0393 narrows this to .env.example in git and real .env in secret stores. This creates contradictory intent within the skill's own documentation about whether .env is an endorsed configuration mechanism.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 400)May include surrounding context.

md

Every deployment should have a runbook with:
1. **Pre-deployment checklist:** DB migrations reviewed, feature flags configured, on-call notified
2. **Deployment steps:** Exact commands with expected output
3. **Validation checks:** curl commands, dashboard links, log queries
4. **Rollback plan:** Exact command to revert (`helm rollback app 12`, `kubectl rollout undo deployment/app`)
5. **Escalation path:** Who to contact if rollback fails (PagerDuty escalation policy link)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The example uses terraform apply -auto-approve tfplan in a production apply path, which removes an interactive confirmation checkpoint for infrastructure changes. In an agent-assisted or automated context, this makes destructive or unintended infrastructure modifications easier to execute at scale, especially if upstream plan validation or artifact integrity is imperfect.

Content

Scanner excerpt · SKILL.md (reported line 1000)May include surrounding context.

run: | cd infra/environments/prod terraform init terraform apply -auto-approve tfplan

text

#### Drift Detection

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1074)May include surrounding context.

md

perf script | ./FlameGraph/stackcollapse-perf.pl | ./FlameGraph/flamegraph.pl > flamegraph.svg

# Go pprof (CPU profile)
curl -o cpu.prof http://localhost:6060/debug/pprof/profile?seconds=30
go tool pprof -http=:8081 cpu.prof

# Node.js clinic

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1118)May include surrounding context.

md

export default function () {
  group('login', () => {
    const res = http.post('https://api.example.com/login', JSON.stringify({
      username: 'testuser',
      password: 'testpass',
    }), { headers: { 'Content-Type': 'application/json' } });

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file switches to Chinese for the concluding section without offering the user a language choice or explaining a required locale policy. That creates a natural-language locale constraint that may conflict with organizational expectations for user-selected language.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

L1404 states an absolute rule: use official SDKs only and never make raw HTTP calls to payment APIs. However, the skill elsewhere promotes command-line HTTP interactions as part of operational practice, and in the payments section the absolutist wording is broader than the actual implementation reality because webhook and endpoint validation commonly involves raw HTTP testing. The wording overstates intent and can mislead users about what is actually permissible.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.