Security audit

arthas-dashboard

Security checks across malware telemetry and agentic risk

Overview

This JVM diagnostic skill is mostly purpose-aligned, but it can expose environment and runtime data without clear redaction or consent guidance.

Review this skill before installing in production or shared environments. It is aimed at legitimate JVM troubleshooting, but users should avoid running the system-parameter or watch flows unless they are authorized to view environment values, method arguments, return values, and other operational details; sensitive values should be redacted before sharing outputs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill explicitly includes `sysenv` output and displays environment variables such as `SPRING_PROFILES_ACTIVE`, `JAVA_HOME`, and `SERVER_PORT`. Environment variables frequently contain secrets, tokens, internal hostnames, and deployment metadata, so exposing them in a dashboard-style skill expands access to sensitive system information beyond what is necessary for routine JVM health diagnosis.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The skill claims it only uses read-only diagnostic commands, but its documented profiler flow starts profiling and then invokes `stop`, which changes runtime diagnostic state. This inconsistency weakens the stated safety boundary and can mislead users or reviewers about the presence of state-changing operations, even if the operation is limited to diagnostics.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The activation text includes a catch-all trigger for essentially any Arthas-related diagnostic need, making the skill eligible in very broad contexts. Overbroad activation increases the chance the skill is invoked when a narrower or safer tool should be used, which can lead to unnecessary collection and display of sensitive JVM and host diagnostics.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: Defaulting to the dashboard scene when no keywords are present means the skill may activate without a clear user request for JVM diagnostics. That broad default can cause unsolicited collection of runtime, thread, memory, class-loading, and file-descriptor information, increasing unnecessary exposure of operational data.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs displaying environment variables but provides no user-facing warning, consent gate, or masking guidance despite the high likelihood of sensitive values being present. In operational environments, this can expose credentials, endpoints, service topology, and deployment details to anyone invoking the skill.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.