Higress Gateway Management

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:52 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate local gateway-admin skill, but it should be reviewed because it uses admin credentials to change and delete live gateway resources without enough safety or secret-handling guardrails.

Install only in a trusted Higress manager environment. Treat HICLAW_ADMIN_PASSWORD, HIGRESS_COOKIE_FILE, generated consumer keys, provider tokens, and database credentials as secrets; do not paste or log them. Before using delete or update commands, confirm the exact resource name, export or inspect the current object, and understand that route/provider changes can break live gateway traffic.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (21)

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

MCP server listing exposes access to high-privilege configuration objects that may include raw configurations, upstream service definitions, domains, and consumer auth settings. Given the skill's agent context, broad MCP configuration visibility increases the blast radius for reconnaissance and follow-on abuse, especially because MCP definitions can bridge to external systems and databases.

Content

Scanner excerpt · references/higress-api-doc.json (reported line 1139)May include surrounding context.

json

"tags": [
          "Mcp APIs"
        ],
        "summary": "List mcp server",
        "operationId": "list_6",
        "parameters": [
          {

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 87% confidence

Finding

The allow-consumers listing endpoint reveals authorization relationships between MCP servers and consumers, which can help map trust boundaries and target privileged principals. In a gateway-management skill, exposing this information without narrow scoping increases reconnaissance value and can support misconfiguration or privilege abuse.

Content

Scanner excerpt · references/higress-api-doc.json (reported line 1251)May include surrounding context.

json

"tags": [
          "Mcp APIs"
        ],
        "summary": "List mcp server allow consumers",
        "operationId": "listAllowConsumers",
        "parameters": [
          {

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 81% confidence

Finding

This finding corresponds to MCP consumer access enumeration in the documented API, again surfacing sensitive authorization mapping data for MCP resources. Even if the endpoint is read-only, such metadata is dangerous in an agent-integrated administrative skill because it helps identify who can reach which high-value MCP backends.

Content

Scanner excerpt · references/higress-api-doc.json (reported line 1307)May include surrounding context.

json

}
          },
          "200": {
            "description": "List mcp server allow consumers successfully",
            "content": {
              "*/*": {
                "schema": {

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The OpenAPI file exposes authentication and bootstrap endpoints such as login, logout, changePassword, user info, and system initialization, which exceed the skill's stated gateway-management purpose. In an agent context, overbroad documented capabilities can enable unintended credential handling or full system takeover paths if the skill is granted access based on its narrower description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The MCP server schema supports direct database configuration with host, username, password, and database name fields. In the context of a gateway-management skill, this introduces sensitive secret handling and potential backend connectivity expansion that can expose databases, enable credential exfiltration, or facilitate lateral movement if misused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs use of admin credentials and a live session cookie file without warning that these are sensitive secrets that must not be logged, echoed, or exposed to users. In an agent workflow, this can lead to credential disclosure in command output, transcripts, or downstream tools, enabling full administrative access to the gateway.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

## Authentication

A session cookie file is stored at the path in `${HIGRESS_COOKIE_FILE}` environment variable. Use it with `curl -b "${HIGRESS_COOKIE_FILE}"`.

If the cookie expires, re-login:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

Create Consumer

bash

curl -X POST http://127.0.0.1:8001/v1/consumers \
  -b "${HIGRESS_COOKIE_FILE}" \
  -H 'Content-Type: application/json' \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

NEW_KEY=$(openssl rand -hex 32)
CONSUMER=$(curl -s http://127.0.0.1:8001/v1/consumers/worker-alice -b "${HIGRESS_COOKIE_FILE}")
UPDATED=$(echo $CONSUMER | jq --arg new "$NEW_KEY" '.credentials[0].values = [$new]')
curl -X PUT http://127.0.0.1:8001/v1/consumers/worker-alice \
  -b "${HIGRESS_COOKIE_FILE}" \
  -H 'Content-Type: application/json' \
  -d "$UPDATED"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documents destructive actions such as DELETE operations without any guidance to verify target identity, confirm user intent, or warn about irreversible changes. In an agent setting, that omission increases the chance of accidental deletion of consumers or routes through prompt misunderstanding or automation errors.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

bash

# Example: add a DeepSeek route alongside the existing default route
curl -X POST http://127.0.0.1:8001/v1/ai/routes \
  -b "${HIGRESS_COOKIE_FILE}" \
  -H 'Content-Type: application/json' \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md

UPDATED=$(echo $AI_ROUTE | jq '.authConfig.allowedConsumers += ["worker-alice"]')

# Step 3: PUT full object (AI Route has "version" field, include it)
curl -X PUT http://127.0.0.1:8001/v1/ai/routes/default-ai-route \
  -b "${HIGRESS_COOKIE_FILE}" \
  -H 'Content-Type: application/json' \
  -d "$UPDATED"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

bash

# Qwen (native type)
curl -X POST http://127.0.0.1:8001/v1/ai/providers \
  -b "${HIGRESS_COOKIE_FILE}" \
  -H 'Content-Type: application/json' \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

"type": "openai", "name": "my-provider", "tokens": ["<API_KEY>"], "protocol": "openai/v1", "modelMapping": {}, "rawConfigs": {"apiUrl": "https://api.example.com/v1"} }'

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

md

# GET-modify-PUT pattern (provider has "version" field)
PROVIDER=$(curl -s http://127.0.0.1:8001/v1/ai/providers/qwen -b "${HIGRESS_COOKIE_FILE}")
UPDATED=$(echo $PROVIDER | jq '.tokens = ["<NEW_KEY>"]')
curl -X PUT http://127.0.0.1:8001/v1/ai/providers/qwen \
  -b "${HIGRESS_COOKIE_FILE}" \
  -H 'Content-Type: application/json' \
  -d "$UPDATED"

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The API reference includes powerful administrative surfaces beyond the described consumer/route/AI-provider/MCP use cases, including TLS certificate, domain, proxy server, service source, dashboard, and wasm plugin management. This broadens the operational authority of the skill and raises the chance that an agent or user invokes dangerous infrastructure changes not anticipated from the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented API includes destructive update/delete operations over live gateway resources without prominent warnings about production impact, rollback needs, or irreversibility. In an agent setting, missing safety cues materially increase the chance of accidental outages, broken routing, or loss of configuration through routine automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Consumer credential operations allow submission and management of secrets such as auth keys, but the documentation does not warn that sensitive material is being handled. In agent workflows this increases the risk of accidental plaintext exposure in prompts, logs, transcripts, or generated examples.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The endpoint summary says it adds an LLM provider, but the responses repeatedly describe a route being added or route data being invalid. Those descriptions contradict the operation's declared intent and could mislead users or automation consuming the spec.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The endpoint summary says "Change password" but its operationId is "logout", which directly conflicts with the documented action. This kind of intent mismatch can mislead generated clients or agent tooling about what the operation actually does.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This endpoint is for deleting an MCP server, but the success response says "Route deleted successfully." That is an active contradiction in the documentation for the operation's effect, not merely an omission.

Content

No source excerpt is available for this finding.