arthas-dashboard

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:54 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent Arthas JVM diagnostics dashboard, but it can expose sensitive runtime data such as environment variables and method arguments without clear consent, scoping, or redaction.

Install only for authorized JVM targets where diagnostic output may include secrets or live business data. Avoid watch/sysenv/sysprop on authentication, payment, identity, customer-data, or credential-bearing code paths unless you explicitly need that data, and sanitize outputs before sharing or retaining conversations/logs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:501

Finding

Unrestricted Process Environment Variable Collection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:501-518
Vulnerability Type: Excessive access to sensitive runtime configuration
Risk Level: Medium

Evidence

text

**工具调用:** 并行调用 `mcp__arthas__sysprop`、`mcp__arthas__sysenv`、`mcp__arthas__vmoption`

╔══════════════════════════════════════════════════════════════════╗ ║ ⚙️ 系统参数 ║ ╠══════════════════════════════════════════════════════════════════╣ ║ JVM 参数 (关键) ║ ║ -Xms/Xmx: {ms} / {mx} ║ ║ -Xss: {value} ║ ║ GC: {gc相关} ║ ║ Metaspace: {metaspace相关} ║ ║ HeapDump: {dump相关} ║ ╠══════════════════════════════════════════════════════════════════╣ ║ 环境变量 (业务相关) ║ ║ SPRING_PROFILES_ACTIVE: {value} ║ ║ JAVA_HOME: {value} ║ ║ SERVER_PORT: {value} ║

text

Technical Analysis

The system-parameter workflow directs the agent to invoke mcp__arthas__sysenv alongside JVM diagnostic tools. A process environment commonly contains secrets such as API keys, database credentials, cloud access tokens, proxy credentials, private service endpoints, and authentication configuration.

The documented output only requires a few operational variables, but the skill does not constrain environment collection to an allowlist. It also does not define redaction rules, require user confirmation, or prevent sensitive values returned by the tool from entering the agent context. Consequently, a routine request for JVM parameters may expose information beyond what is required for JVM health analysis.

This is a least-privilege violation within the diagnosti ...[truncated 1423 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove mcp__arthas__sysenv from the default system-parameter workflow.
2. Query only explicitly required variables through an allowlist, such as JAVA_HOME, SERVER_PORT, and SPRING_PROFILES_ACTIVE.
3. Require informed user confirmation before collecting any broader environment information.
4. Redact names and values associated with PASSWORD, PASS, SECRET, TOKEN, KEY, CREDENTIAL, AUTH, COOKIE, and connection-string patterns.
5. Do not place unredacted environment results in tables, logs, summaries, or persistent memory.
6. Return variable presence or a sanitized summary instead of the raw value whenever the value is not essential.
7. Document that environment inspection is potentially sensitive and should only be used by authorized operators against approved JVM targets.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:440

Finding

Unredacted Disclosure of Method Arguments and Return Values

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:440-455
Vulnerability Type: Plaintext exposure of sensitive application data
Risk Level: Medium

Evidence

text

**工具调用:** `mcp__arthas__watch`

╔══════════════════════════════════════════════════════════════════╗ ║ 👁️ Watch: {className}#{methodName} ║ ╠══════════════════════════════════════════════════════════════════╣ ║ 调用 #{n} | 耗时: {cost}ms ║ ║─────────────────────────────────────────────────────────────── ║ ║ 📥 入参: ║ ║ param1: {value1} ║ ║ param2: {value2} ║ ║─────────────────────────────────────────────────────────────── ║ ║ 📤 返回值: ║ ║ {returnValue} ║ ║─────────────────────────────────────────────────────────────── ║ ║ ❌ 异常 (如有): ║ ║ {exception} ║

text

Technical Analysis

The method-watch workflow captures and displays arbitrary method arguments, return values, and exceptions without defining redaction, object-depth limits, output-length limits, or sensitivity controls. Application methods may process passwords, authorization headers, session identifiers, access tokens, payment information, personal records, or proprietary business data.

Because the template explicitly renders captured values, sensitive information may be exposed in plaintext in the agent response and associated logs. Recursive or large objects may also reveal substantially more data than the operator intended.

The issue does not depend on command injection or code execution. Exploitation requires access to the diagnostic capability and selection of a method that processes sensitive information. The s ...[truncated 1305 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before capturing method arguments, return values, or exceptions.
2. Default to displaying parameter types, object classes, sizes, and structural summaries rather than raw values.
3. Redact fields whose names indicate secrets or personal data, including passwords, tokens, authorization headers, cookies, keys, credentials, account numbers, and session identifiers.
4. Detect and mask common credential formats such as bearer tokens, JWTs, private keys, and connection strings.
5. Apply strict output controls, including maximum object depth, collection size, string length, and total response size.
6. Warn users before observing authentication, payment, identity, healthcare, or other sensitive methods.
7. Allow class and method denylisting for known sensitive application boundaries.
8. Ensure diagnostic output is not persisted by default and is protected by appropriate authorization, retention, and audit controls.
9. Stop the watch operation promptly after collecting the minimum number of samples necessary for diagnosis.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger text is overly broad, including catch-all language like any Arthas-related diagnostic need, which can cause the skill to activate in ambiguous contexts. Because the skill can access thread, memory, watch, sysenv, and sysprop data, over-triggering increases the chance of unnecessary sensitive introspection or unintended data exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Defaulting to the dashboard when no keyword is present means the skill may run without clear user intent. In a diagnostic skill that aggregates JVM, thread, memory, and potentially sensitive operational metadata, this increases the risk of unsolicited collection and display of internal runtime information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The watch and related inspection flows can expose raw method parameters, return values, exceptions, system properties, and environment data, which may include credentials, personal data, session tokens, or proprietary business information. The absence of an explicit warning, redaction guidance, or consent step is especially dangerous here because the skill encourages rich observability outputs and actionable debugging workflows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill expands from JVM dashboard diagnostics into system property, environment variable, and JVM option inspection, which can expose sensitive operational data such as credentials, tokens, internal endpoints, or deployment configuration. In this context, the capability is adjacent to diagnostics but still materially increases information disclosure risk beyond what a user may expect from a monitoring dashboard.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill claims it uses only read-only diagnostic commands, but it also instructs use of control operations such as stopping the profiler. Even if low risk, this mismatch weakens operator trust and can lead users to approve actions under a false assumption that no stateful or control-changing operations will occur.

Content

No source excerpt is available for this finding.