Security audit

Openwrt Router

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed OpenWRT router management helper, but it gives an agent broad remote shell access to a router using stored admin credentials and plain HTTP.

Install only if you are comfortable giving the agent administrator-level control over the target OpenWRT router. Use a dedicated least-privilege account if possible, avoid storing router passwords in shared project files, prefer HTTPS or a trusted isolated network, and manually review any command or package-install request before allowing it to run.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The README explicitly states the skill uses LuCI RPC `sys.exec` to run remote shell commands on the router, which is far broader than ordinary monitoring and gives the agent command-execution capability on a network appliance. In skill context, this is especially dangerous because the advertised use case is routine router management, yet the underlying mechanism permits arbitrary command execution and package changes that can alter persistence, security posture, or network traffic handling.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Including package installation extends the skill from monitoring into system modification, creating a capability mismatch between the apparent purpose and the actual power granted to the agent. On a router, package installation can materially change services, routing behavior, firewalling, or introduce persistence, so this is risky even if presented as a convenience feature.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill claims web-based management/monitoring but explicitly documents use of LuCI RPC sys.exec to run shell commands on the router. That turns a monitoring integration into a remote command-execution channel on infrastructure devices, enabling full router compromise, configuration tampering, traffic interception, or persistence if abused.

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The documented scope extends to software inventory queries such as checking installed software, which goes beyond the manifest's stated monitoring features. This expands the operational scope without transparent disclosure and can be a stepping stone toward broader package-management or system-modification actions.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Arbitrary shell execution is much broader than necessary for viewing DHCP leases, client lists, or network status. In this context, it allows any command the router account can run, which could expose secrets, alter firewall rules, install packages, disrupt connectivity, or pivot deeper into the network.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The script presents itself as a LuCI-based management/monitoring tool, but its core helper uses LuCI RPC sys.exec to run shell commands on the router. That means the skill is not limited to read-only inventory queries and instead has remote command-execution capability, which materially increases risk if reused, modified, or exposed through higher-level agent actions.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README normalizes remote shell execution and package installation without warning that these operations are system-impacting and can break the router, weaken security, or be abused by prompt injection or operator mistakes. In an agent skill ecosystem, lack of safety framing increases the chance that users or orchestrators treat dangerous actions as routine and invoke them without sufficient scrutiny.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README instructs users to store router usernames and passwords directly in configuration, but provides no warning about secret handling, exposure risks, or safer storage mechanisms. Router admin credentials are highly sensitive because compromise enables full control of network infrastructure, and agent skill configs are often logged, synced, or readable by other tools.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill exposes remote shell execution on a router but does not present a clear safety warning about the risks of running arbitrary commands on network infrastructure. Users may reasonably expect benign monitoring, while the documented mechanism can materially alter or compromise the device.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instructions tell users to store router usernames and passwords in `TOOLS.md` without warning that these are highly sensitive credentials. Storing plaintext admin credentials in project files increases the risk of accidental disclosure, reuse compromise, or downstream exfiltration by other tools or skills.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script sends the router password and later session/authentication data over plain HTTP, allowing anyone on the same network path to intercept credentials or hijack the session. It also retrieves network inventory over the same unencrypted channel, exposing sensitive device and topology information to passive or active attackers.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The helper runs arbitrary remote commands through LuCI RPC without making that dangerous capability explicit to the caller or constraining what may be executed. In an agent skill context, hidden command-execution primitives are risky because upstream prompts, future code changes, or wrapper logic may unintentionally turn a monitoring tool into a router administration backdoor.

Static analysis

No suspicious patterns detected.