incident-responder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:30 AM UTC
• Version: 1.0.0

Overview

This incident-response skill is purpose-aligned, but it includes high-impact production commands and automatic remediation examples without enough safety scoping or approval guidance.

Review before installing. This skill can be useful for experienced operators, but it should be treated as advisory runbook material, not something an agent should execute automatically. Require human approval for production changes, avoid copying the auto-remediation example as-is, pin and restrict any debug container image, and preserve logs before cleanup or rollback actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: references/examples.md:162

Finding

Shell Command Injection in Log Analysis

Content

View full analysis

Remediation

View remediation

Dict: if not isinstance(lookback_minutes, int): raise TypeError("lookback_minutes must be an integer") if not 1 <= lookback_minutes <= 1440: raise ValueError("lookback_minutes must be between 1 and 1440") result = subprocess.run( [ "journalctl", "--since", f"{lookback_minutes} minutes ago", "--no-pager", ], capture_output=True, text=True, check=False, ) matching_lines = [ line for line in result.stdout.splitlines() if "ERROR" in line or "FATAL" in line ] ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/examples.md:194

Finding

Automatic Remediation Can Delete Forensic Logs and Perform Unsafe Host-Wide Operations

Content

View full analysis

90: subprocess.run(["sync"], check=True) subprocess.run(["echo", "3", ">", "/proc/sys/vm/drop_caches"], shell=True) actions_taken.append("Cleared system caches due to memory pressure") # Disk space - clean up logs if diagnostics['checks']['disk'].get('usage_percent', 0) > 90: subprocess.run(["journalctl", "--vacuum-time=7d"], check=True) actions_taken.append("Cleaned up old logs to free disk space") ``` ### Technical Analysis The remediation function performs system-wide actions automatically when diagnostic thresholds are exceeded. In particular, `journalctl --vacuum-time=7d` can permanently remove journal records older than seven days during an active incident. Those records may be required for root-cause analysis, timeline reconstruction, regulatory retention, or forensic investigation. The cache-clearing operation also combines an argument list, shell redirection, and `shell=True`. This is not a reliable way to write to `/proc/sys/vm/drop_caches`; its behavior is shell- and platform-dependent. If implemented successfully with elevated privileges, clearing caches can cause a system-wide performance penalty and worsen an incident. ### Attack Path 1. Disk usage exceeds 90%, whether through legitimate workload growth or deliberate resource exhaustion. 2. `auto_remediate()` processes diagnostics reporting the threshold breach. 3. The function invokes `journalctl --vacuum-time=7d` without operator approval or prior evidence preservation. 4. Journal records outside the retention window are removed. 5. Responders lose evidence that may be necessary to identify the incident's cause or reconstruct attacker activity. For the ...[truncated 779 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:138

Finding

Unpinned Third-Party Kubernetes Diagnostic Image

Content

View full analysis

Remediation

View remediation

\ --serviceaccount=restricted-debug \ --overrides='' \ -it --rm ``` ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples include host-level command execution via subprocess and system-modifying operations that are not clearly justified by the stated analysis-focused purpose. In an agent skill context, this expands capability from observation to action, increasing the risk that an autonomous or semi-autonomous agent executes privileged commands on production systems.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The code builds a shell command string and executes it with shell=True, which creates a command-injection sink if any part of the command becomes user-controllable now or in future edits. Even though lookback_minutes is typed as an int, this pattern is unsafe in reusable example code and encourages shell-based composition for log analysis on production hosts.

Content

Scanner excerpt · references/examples.md (reported line 178)May include surrounding context.

md

def analyze_error_logs(self, lookback_minutes: int = 60) -> Dict:
        """Analyze error patterns in logs"""
        cmd = f"journalctl --since '{lookback_minutes} minutes ago' | grep -E 'ERROR|FATAL'"
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
        
        errors = {}
        for line in result.stdout.split('\n'):

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The example goes beyond incident analysis and includes automated remediation actions that modify the host, such as dropping caches and vacuuming logs. In a skill framed as debugging and analysis guidance, normalizing unattended remediation is dangerous because users or downstream agents may copy these actions into production without safeguards, causing service disruption, loss of forensic data, or unsafe changes during an incident.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This uses subprocess with shell=True in a system-modifying code path intended to drop kernel caches, combining unsafe process invocation with a privileged and disruptive operation. The specific invocation is also error-prone and models a dangerous pattern that could be adapted into arbitrary shell execution or copied into production automation without safeguards.

Content

Scanner excerpt · references/examples.md (reported line 209)May include surrounding context.

md

# Memory pressure - clear caches
        if diagnostics['checks']['memory'].get('usage_percent', 0) > 90:
            subprocess.run(["sync"], check=True)
            subprocess.run(["echo", "3", ">", "/proc/sys/vm/drop_caches"], shell=True)
            actions_taken.append("Cleared system caches due to memory pressure")
        
        # Disk space - clean up logs

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill includes operationally dangerous commands such as packet capture, debugger attachment, live kubectl exec access, ephemeral debug pods, and deployment rollback/scale actions without any safety framing, prerequisites, or warnings. In an agent skill context, this can lead an automated or rushed user to run destructive or privacy-impacting commands directly in production, causing outages, data exposure, or incident escalation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown presents destructive or operationally risky remediation steps without warnings, confirmation prompts, or decision criteria. During incidents, operators are under pressure, and examples that imply these actions are routine can lead to accidental data loss, reduced observability, or secondary outages.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.