Agent Ops Kit

• Outcome: Review
• Latest audit: May 28, 2026 · 5:56 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate operations-monitoring skill, but it needs Review because it can run persistent scheduled checks that execute configurable host restart commands, including privileged ones.

Install only after reviewing the scripts and config carefully. Treat services.json as executable policy: keep it writable only by trusted admins, avoid broad sudo or arbitrary shell snippets, prefer fixed least-privilege wrappers, and understand that enabling cron, launchd, or systemd will keep running the monitor automatically. Telegram alerting can also send operational details outside the host.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill performs substantial file writes, shell execution, cron/launchd/systemd setup, and service management, but the manifest declares no corresponding permissions. That mismatch can cause users or platforms to underestimate the operational and security impact of installing the skill. In this context, hidden shell/file capabilities are especially important because the skill can persist itself and execute restart commands.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script executes a config-supplied restart_command using eval inside check_process. If an attacker can modify services.json or influence its contents, they can run arbitrary shell commands with the privileges of the monitoring script, which exceeds legitimate health-check behavior and can lead to full host compromise.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script generates shell commands from JSON config using Python and then executes them via eval. Quoting is incomplete: only single quotes are stripped from service names, while other fields like target, host, process_name, and restart_command can inject shell syntax, enabling arbitrary command execution from a crafted configuration file.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill instructs users to enable automatic restarts, maintenance, and cleanup actions that can alter system state or delete files, but it does not clearly foreground these actions as potentially disruptive. In an ops skill, such behavior is expected, but the lack of explicit safety warnings increases the chance of accidental misuse on production systems.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Although framed as lack of user warning, this code path is materially dangerous because it executes configured restart commands with eval. In the context of an operations skill that may run unattended or with elevated privileges, silent config-driven command execution substantially increases the risk of abuse and accidental destructive actions.

Unvalidated Output Injection

High

• Category: Output Handling

Content

# Attempt restart
    log(f"RESTART: {service_name} — attempt {svc_state['attempts'] + 1}/{max_attempts}")
    try:
        result = subprocess.run(
            restart_command, shell=True,
            capture_output=True, text=True, timeout=30,
            env={**os.environ, "PATH": "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/sbin:/usr/sbin"}

• Confidence: 98% confidence
• Finding: The recovery engine executes restart_command from configuration using subprocess.run(..., shell=True). If an attacker can modify services.json or influence restart_command contents, they can achieve arbitrary shell command execution, potentially with elevated privileges if sudo/system services are involved. In this skill, that risk is amplified because the command is specifically designed to run automatically during failure conditions.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

"host": "127.0.0.1",
      "port": 5432,
      "timeout_seconds": 3,
      "restart_command": "sudo systemctl restart postgresql"
    },
    {
      "name": "Redis",

• Confidence: 87% confidence
• Finding: This configuration authorizes restarting PostgreSQL via sudo, which grants a monitoring/remediation component a privileged action path. If the surrounding system lets less-trusted users alter config or trigger restarts, this could be abused for service disruption or privilege-bound command execution through the privileged wrapper.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

"host": "127.0.0.1",
      "port": 6379,
      "timeout_seconds": 3,
      "restart_command": "sudo systemctl restart redis"
    },
    {
      "name": "Background Worker",

• Confidence: 87% confidence
• Finding: The Redis restart command also relies on sudo, creating another privileged execution path from operational automation. In an agent skill context, this becomes more sensitive because automated systems may execute actions based on monitored state, and any weakness in trigger controls or config integrity could lead to repeated disruptive privileged actions.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

"name": "Nginx",
      "type": "process",
      "process_name": "nginx",
      "restart_command": "sudo systemctl restart nginx",
      "restart_cooldown_seconds": 120,
      "max_restart_attempts": 5
    }

• Confidence: 90% confidence
• Finding: Using sudo to restart Nginx exposes a privileged action on a critical front-door service, so abuse could take the site offline or interfere with traffic handling. In this ops skill, automated restart capability is expected, but coupling it with root-level execution increases risk if an attacker can influence triggers, service definitions, or command strings.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# crontab: run every 5 minutes
(crontab -l 2>/dev/null; echo "*/5 * * * * ~/.agent-ops/scripts/health-check.sh >> ~/.agent-ops/logs/cron.log 2>&1") | crontab -

# Or on macOS, create a launchd plist (see Orchestrator Loop section)
```

• Confidence: 88% confidence
• Finding: The skill instructs users to install a cron job that will run periodically and persist across sessions. Persistence is an expected ops feature here, but it materially changes host behavior and can repeatedly execute whatever script resides at that path, which becomes risky if the script or its configuration is later tampered with.

Session Persistence

Medium

• Category: Rogue Agent

Content

```

```bash
sudo systemctl enable agent-ops.timer
sudo systemctl start agent-ops.timer
```

• Confidence: 89% confidence
• Finding: Enabling a systemd timer creates durable persistence and recurring execution. In context this is operationally legitimate, but it increases attack surface because compromised scripts or configs will be re-executed automatically on a schedule.

Session Persistence

Medium

• Category: Rogue Agent

Content

### macOS launchd Setup

Create `~/Library/LaunchAgents/com.agent-ops.orchestrator.plist`:

```xml
<?xml version="1.0" encoding="UTF-8"?>

• Confidence: 91% confidence
• Finding: Creating a LaunchAgent plist establishes scheduled persistence on macOS. That is expected for an orchestrator, but it means the script will continue running automatically and can become a durable execution path if the referenced script is modified maliciously.

Session Persistence

Medium

• Category: Rogue Agent

Content

### macOS launchd Setup

Create `~/Library/LaunchAgents/com.agent-ops.orchestrator.plist`:

```xml
<?xml version="1.0" encoding="UTF-8"?>

• Confidence: 91% confidence
• Finding: Creating a LaunchAgent plist establishes scheduled persistence on macOS. That is expected for an orchestrator, but it means the script will continue running automatically and can become a durable execution path if the referenced script is modified maliciously.

Session Persistence

Medium

• Category: Rogue Agent

Content

Load it:

```bash
launchctl load ~/Library/LaunchAgents/com.agent-ops.orchestrator.plist
```

### Linux systemd Setup

• Confidence: 90% confidence
• Finding: launchctl load activates the LaunchAgent and thereby enables recurring execution persistence on macOS. In an operations skill this is intentional, but users should be clearly warned because it creates an automatically re-running execution path.

Session Persistence

Medium

• Category: Rogue Agent

Content

Load it:

```bash
launchctl load ~/Library/LaunchAgents/com.agent-ops.orchestrator.plist
```

### Linux systemd Setup

• Confidence: 90% confidence
• Finding: launchctl load activates the LaunchAgent and thereby enables recurring execution persistence on macOS. In an operations skill this is intentional, but users should be clearly warned because it creates an automatically re-running execution path.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Attempt restart
    log(f"RESTART: {service_name} — attempt {svc_state['attempts'] + 1}/{max_attempts}")
    try:
        result = subprocess.run(
            restart_command, shell=True,
            capture_output=True, text=True, timeout=30,
            env={**os.environ, "PATH": "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/sbin:/usr/sbin"}

• Confidence: 98% confidence
• Finding: restart_command is a powerful, user-configurable parameter that is passed directly to a shell. This turns configuration into executable code and enables parameter abuse or full command injection if the config is attacker-controlled or modified by another compromised component. Because execution is automatic and may involve service-management privileges, compromise impact is substantial.

Static analysis

No suspicious patterns detected.