Security audit

Agent Audit

Security checks for vulnerabilities and agentic risk

Overview

This skill is an agent-audit tool, but it uses live credentials, root SSH, a hard-coded database password, and includes role-changing database instructions without enough safeguards.

Review before installing. This skill should only be used by an operator who is authorized to access the target ADC host, agent credential files, and backend database. Do not run the login checks unless live authentication attempts are acceptable, and do not use the documented SQL update path without a separate approved admin change process. The embedded database password and root SSH dependency should be removed or replaced with scoped, runtime-supplied credentials before normal use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The documentation provides a concrete command sequence for executing SQL updates over root SSH against a production-like database, even though the skill is described as an audit tool. Embedding privileged write instructions in documentation materially lowers the barrier to accidental or unauthorized modification of critical backend data.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: A skill framed as auditing should not also include direct backend role-modification steps, because this conflates observation with administration. That increases the chance that a user or agent will move from read-only checking to destructive state changes without the procedural safeguards normally applied to privileged operations.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script embeds a PostgreSQL password directly in the command line and connects over SSH as root to a hard-coded host. This exposes highly privileged credentials to anyone who can read the script, shell history, process listings, logs, or repository contents, and it grants broader access than necessary for a read-only role audit task.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrase "check passwords" is broad enough to match common user requests outside the intended agent-audit context, which can invoke a sensitive skill unexpectedly. Because this skill deals with credential testing and infrastructure state, accidental activation could expose secrets, perform intrusive checks, or normalize unsafe password-handling behavior.

Missing User Warnings

High

Confidence: 96% confidence
Finding: Testing agent email/password combinations against the ADC API is a sensitive action that can handle live credentials, trigger authentication events, and potentially lock accounts or expose secrets. Omitting an explicit warning and consent requirement makes accidental misuse more likely and obscures the operational risk to users.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The documentation includes a root SSH command that decodes and runs SQL against the backend database, but does not present this as a high-risk administrative action requiring separate authorization. Without an explicit warning, users may treat a destructive infrastructure command as a routine audit step, increasing the risk of unauthorized or mistaken changes.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The script builds ADC_API with plain HTTP and then sends email/password pairs to the login endpoint, exposing credentials to interception or manipulation by anyone with network visibility on the path. The risk is amplified because the request is executed over SSH on a remote host, so operators may incorrectly assume the full path is protected while the hop from that host to the ADC service may still be unencrypted.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The script performs privileged remote access and uses an embedded database password without any explicit disclosure, approval step, or operator warning. In the context of an audit skill, this increases the risk of silent credential misuse and unexpected access to production-like infrastructure under the guise of a routine check.

Static analysis

No suspicious patterns detected.