Security audit

Higress Gateway Management

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate Higress administration helper, but it gives an agent admin-session instructions for persistent gateway changes without clear confirmation or scope limits.

Install only if you intend to let the agent administer a Higress gateway with admin credentials. Review every create, update, delete, provider-token, and route-change command before it runs, and keep a rollback plan for production gateways.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The documented API exposes authentication, password-change, session, and system initialization endpoints that go beyond routine Higress gateway object management. In an agent skill, this materially expands the action surface from configuration management into identity/bootstrap control, increasing the chance of credential misuse, unauthorized account changes, or accidental re-initialization if the agent is ever permitted to call endpoints based on user prompts.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The API spec includes broad system and dashboard administration endpoints such as config retrieval/modification and dashboard initialization/URL configuration that are not narrowly aligned with the stated skill purpose. In practice, this lets a gateway-management skill influence platform-wide settings and observability integrations, creating a larger blast radius than users would reasonably expect from the manifest.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The OpenAPI schema allows configuring database-backed MCP servers, including host, port, username, password, and database name fields. Even though this is only documentation, exposing this capability through an agent skill widens the skill into database connectivity management and secret handling, which increases the risk of storing, forwarding, or manipulating sensitive infrastructure credentials outside the expected gateway-management boundary.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill documents destructive deletion of consumers without any warning, impact description, or confirmation guidance. In an admin-oriented gateway management skill, this can lead to accidental removal of credentials or service identities, causing outages or unintended loss of access.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The AI route deletion example lacks any warning that removing a route can break model routing, authentication, or tenant access for the gateway domain. Because this skill targets live gateway administration, omission of confirmation and rollback guidance increases the chance of disruptive operator mistakes.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: SKILL.md:68