SSL + Nginx Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:24 AM UTC
• Version: 1.0.0

Overview

This SSL setup skill is mostly purpose-aligned, but it contains unsafe live-server defaults that users should review before installation.

Review this skill before installing or using it on a production server. Require explicit approval before removing the default Nginx site, enabling HSTS includeSubDomains/preload, storing DNS API tokens, or creating renewal hooks/cron jobs. Use narrowly scoped DNS tokens and back up existing Nginx configs first.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:310

Finding

Unsafe Default HSTS Policy Conflicts with Explicit-Consent Requirement

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 310; related safety rule at line 467
Vulnerability Type: Unsafe security configuration
Risk Level: Medium

Vulnerable configuration:

nginx

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

Conflicting safety rule:

text

NEVER set HSTS preload without explicit user consent. Preload is irreversible -- once submitted to the HSTS preload list, the domain must serve HTTPS forever.

Technical Analysis

The supplied production configuration unconditionally enables a two-year HSTS policy with includeSubDomains and the preload directive. However, the Skill's own safety rules require explicit user consent before setting HSTS preload.

Once a browser receives this header over HTTPS, it can cache the requirement to use HTTPS for the parent domain and every subdomain for up to 63,072,000 seconds. The preload token also makes the domain eligible for submission to browser preload lists. Merely sending this token does not itself submit the domain, but it creates a dangerous default and facilitates a longer-lived, difficult-to-reverse policy.

This is an insecure configuration practice rather than malicious persistence. The separate instructions to enable Nginx and configure certificate renewal are proportionate to the declared reverse-proxy and automated-TLS functionality.

Attack Path

1. An agent follows Phase 6 and copies the provided hardened Nginx configuration without modification.
2. Nginx begins returning the HSTS header containing includeSubDomains, a two-year max-age, and preload.
3. Browsers cache the policy for the parent domain and apply it to all subdomains.
4. Any subdomain that lacks valid HTTPS becomes inaccessible to affected clients because browsers automatically upgrade HTTP requests to HTTPS.
5. If the domain is subsequently submitted to an HSTS preload list, the be ...[truncated 738 chars]

Remediation

View remediation

Remediation Suggestions

Use a conservative HSTS policy by default:

nginx

add_header Strict-Transport-Security "max-age=31536000" always;

Apply the following hardening plan:

1. Do not enable includeSubDomains until every current subdomain supports HTTPS with a valid certificate.
2. Do not add preload until the user gives explicit informed consent and understands the preload-list removal process.
3. Begin with a short max-age, such as 300 seconds, during validation and increase it gradually after confirming that HTTPS works reliably.
4. Inventory current and anticipated subdomains before enabling includeSubDomains.
5. Confirm that certificate renewal and monitoring are operational before deploying a long-lived policy.
6. Make consent an explicit prerequisite in Phase 6 rather than relying only on the later safety rule.
7. Clearly state that the preload directive alone does not submit a domain; submission to the browser preload service is a separate action that must also require explicit approval.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (8)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The unconditional rm -f /etc/nginx/sites-enabled/default removes the default site symlink and can unexpectedly disable an existing site or fallback configuration on a production server. While not malicious, it is a destructive live-system change that may affect availability or interfere with unrelated hosted services.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

bash

ln -sf /etc/nginx/sites-available/<DOMAIN> /etc/nginx/sites-enabled/
rm -f /etc/nginx/sites-enabled/default

4c: Test and reload

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The sample config enables HSTS preload by default despite a later rule explicitly forbidding this without user consent. Because preload can lead to long-lived browser enforcement and possible submission to the preload ecosystem, this inconsistent guidance materially increases the chance of unsafe deployment on domains that are not fully prepared.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description and 'When to Use' section include generic triggers such as 'configure Nginx', 'set up SSL', and 'add HTTPS' without tightly constraining context beyond broad VPS hosting language. These phrases are common enough to overlap with many unrelated support requests, increasing the risk of unintended invocation despite the later negative examples.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

Verify Nginx is running:

bash

systemctl enable nginx
systemctl start nginx
nginx -v

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file contains commands to create or replace /etc/nginx/sites-available/<DOMAIN>, symlink enabled sites, remove the default site, and write renewal hook files. While there are some safety notes about backups and config testing, the skill description does not give a clear upfront user warning that it will change live web-server configuration and may affect site routing or availability if applied on a production host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs storing a DNS provider API token on disk in /etc/letsencrypt/cloudflare.ini. Even with chmod 600, this creates a persistent high-value credential on the server and the skill does not warn about token scope minimization, secret lifecycle, or the risk of DNS takeover if the host is compromised.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

md

cat > /etc/letsencrypt/cloudflare.ini << 'EOF'
dns_cloudflare_api_token = <CLOUDFLARE_API_TOKEN>
EOF
chmod 600 /etc/letsencrypt/cloudflare.ini

certbot certonly \
  --dns-cloudflare \

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The sample production config sets Strict-Transport-Security with the preload token by default, while the skill later states preload should never be enabled without explicit user consent. This contradiction can cause operators to deploy an effectively irreversible browser policy that forces HTTPS across the domain tree and may break subdomains or recovery paths if the environment is not fully HTTPS-ready.

Content

No source excerpt is available for this finding.