Security audit
Security checks for vulnerabilities and agentic risk
This Consul API reference has no executable payload, but it documents powerful cluster-changing operations without enough safety guidance.
Review this before installing if the agent may access a real Consul cluster. Use least-privilege ACL tokens, avoid management tokens, require explicit confirmation for deletes or ACL changes, verify datacenter/namespace/key prefixes, and never paste real tokens into shared logs or transcripts.
This documents a raw delete operation against Consul KV without any guardrails on key validation, environment targeting, or user confirmation. In an agent setting, ambiguous or manipulated parameters could cause unintended deletion of important configuration or service state.
DELETE /kv/:key # 删除单个 key
DELETE /kv/:prefix?recurse # 删除前缀下所有 key
DELETE /kv/:key?cas=100 # Check-And-Set 删除
Recursive prefix deletion is especially dangerous because a small parameter mistake can erase large sections of the KV hierarchy, causing widespread configuration loss or outages. The skill presents this capability without warning about blast radius or requiring preflight listing of affected keys.
DELETE /kv/:key # 删除单个 key
DELETE /kv/:prefix?recurse # 删除前缀下所有 key
DELETE /kv/:key?cas=100 # Check-And-Set 删除
CAS delete is safer than unconditional deletion, but it still performs destructive state changes and the documentation does not explain when to use it safely or how to verify the index. In agent workflows, misuse could still remove critical keys based on stale or incorrect assumptions.
DELETE /kv/:key # 删除单个 key
DELETE /kv/:prefix?recurse # 删除前缀下所有 key
DELETE /kv/:key?cas=100 # Check-And-Set 删除
Deleting Connect intentions changes service-to-service authorization policy and can unintentionally break or weaken mesh security. Without warnings or validation guidance, an agent could remove the wrong intention, causing outages or unexpected access changes.
"DestinationName": "db", "Action": "allow" } DELETE /connect/intention/:id
## Sessions (分布式锁)
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
DELETE /kv/:key
DELETE /kv/:prefix?recurse # Delete all with prefix
DELETE /kv/:key?cas=200 # Check-And-Set delete
This line documents recursive prefix deletion, which is materially more dangerous than single-key deletion because a broad or attacker-influenced prefix can wipe large portions of the KV store. In an agent skill context, presenting this operation without guardrails increases the chance of catastrophic data loss from prompt injection, user error, or parameter manipulation.
DELETE /kv/:key
DELETE /kv/:prefix?recurse # Delete all with prefix
DELETE /kv/:key?cas=200 # Check-And-Set delete
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
DELETE /kv/:key
DELETE /kv/:prefix?recurse # Delete all with prefix
DELETE /kv/:key?cas=200 # Check-And-Set delete
Deleting ACL tokens is a sensitive identity-management action; if parameter values are influenced by untrusted input or if operators misunderstand the endpoint, it can revoke access unexpectedly or disrupt automation. In this skill context, token-management endpoints are especially risky because they involve security boundaries and secret-bearing identities.
GET /acl/token/:accessor_id
PUT /acl/token/:accessor_id
DELETE /acl/token/:accessor_id
Policy deletion can remove authorization rules that services or operators depend on, causing outages or forcing insecure workarounds. In an agent-driven environment, exposing direct delete operations without safeguards makes parameter abuse or mistaken policy targeting more dangerous.
GET /acl/policies PUT /acl/policy/:name GET /acl/policy/:name DELETE /acl/policy/:name
### Roles
Role deletion affects authorization mappings and can break access for users, services, or automation unexpectedly. Because this skill is for operational API use, a model or user may invoke this endpoint directly, so lack of safety framing increases the risk of disruptive parameter abuse.
GET /acl/roles PUT /acl/role/:name GET /acl/role/:name DELETE /acl/role/:name
---
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
GET /connect/intentions POST /connect/intention GET /connect/intention/:id DELETE /connect/intention/:id
**Intention Body:**
The authentication examples show direct use of Consul ACL tokens in headers but provide no warning that these are sensitive credentials that must not be logged, echoed, hardcoded, or exposed in transcripts. In agent workflows, this can lead to credential leakage into prompts, shell history, CI logs, or shared output.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
PUT /kv/:key?flags=123 # 附加 flags PUT /kv/:key?cas=100 # Check-And-Set (乐观锁)
curl -X PUT -d 'my value' http://127.0.0.1:8500/v1/kv/my-key
### 删除 KV
The skill documents destructive KV deletion operations, including recursive prefix deletion, without any caution about irreversible data loss, scope validation, or confirmation requirements. In an agent context, this increases the chance that a model or operator will execute broad deletions on production Consul state without understanding the blast radius.
This markdown file describes deregistration operations that can remove nodes, services, or checks from the catalog, but it does not include any warning about service disruption or configuration impact. Under the markdown criteria for missing user warnings, destructive behaviors that may affect system integrity should be disclosed.
The file lists DELETE KV endpoints, including recursive prefix deletion, but provides no warning that these operations can permanently remove stored key data. For markdown files, destructive actions affecting user data should be accompanied by clear warnings.
This documentation includes ACL bootstrap and token-management endpoints without any security guidance about the sensitivity of bootstrap actions and access tokens. In an agent skill context, exposing credential-management operations without warnings can encourage unsafe handling, accidental token creation/deletion, or overprivileged workflows that compromise the Consul cluster.
The session creation example includes Behavior set to "delete", which can trigger destructive cleanup semantics, but no warning explains the possible data or lock-management impact. This omission is relevant because markdown should warn about behaviors that can affect user data or system state.
The skill content is written in Chinese, while the manifest description is in English, and the document does not state that the skill is intentionally region- or language-specific or offer an opt-in language choice. The policy requires avoiding forced language or locale constraints unless explicitly justified or optional.
The file begins with Chinese-only descriptive text and does not indicate that the document is intentionally region-specific or provide an alternative language option. This can violate language/locale policy when a skill or reference material imposes a specific language without user opt-in.