T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:93- Finding
Read-Only Monitoring Skill Recommends Privileged and State-Changing Operations
- Content
View full analysis
- Remediation
View remediation
Security audit
Rdk X5 Monitor
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a read-only RDK X5 hardware monitor, but it includes troubleshooting advice that can terminate processes or run a privileged cleanup command.
Review this skill before installing if you expect strict read-only monitoring. Its normal status commands are appropriate, but do not let an agent run `kill` or `sudo apt clean` from this skill without explicit confirmation and a clear understanding of the target process or files affected.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is explicitly described as read-only monitoring, but the troubleshooting table includes operational actions that change system state, such as killing processes and cleaning package caches. This creates scope drift: an agent or user relying on the skill may perform destructive or privileged actions under a monitoring skill, increasing the chance of misuse or accidental disruption.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Providing unjustified remediation commands in a monitoring-only skill is dangerous because it normalizes taking action from a context that should only inspect status. Even if the commands are common admin steps, they can terminate important workloads or alter package state when triggered by an automated agent without proper escalation boundaries.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Including
sudo apt cleanin a read-only monitoring skill introduces privileged execution guidance that exceeds the declared scope. Althoughapt cleanis not typically catastrophic, it still performs a privileged state-changing operation and can train an agent to invoke sudo where only inspection was expected.- Content
md | CPU 100% 持续 | 进程占满 | `top` 查看高占用进程；`kill` 或降低负载 | | 温度 >90°C | 散热不足 | 加装散热片/风扇；降低 BPU 负载 | | BPU ratio 始终 0 | 无推理任务运行 | 正常现象；启动 AI 推理后会上升 | | 磁盘满 | 日志或备份过大 | `du -sh /var/log/*`；`sudo apt clean` |
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill content and operational headings are presented in Chinese, and there is no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale constraint is explicitly justified.
- Content