Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ADOG_API_KEY"],"bins":["curl","jq"]},"os":["macos","linux","win32"],"files":["SKILL.md"],"emoji":"📡"}}
Security audit
Multi Site Health Monitor
Security checks for vulnerabilities and agentic risk
Overview
The skill is a monitoring guide, but it encourages automated restarts, rollbacks, remote SSH commands, and long-running deployment without enough scoping or confirmation safeguards.
Install only if you are comfortable letting an agent help configure monitoring tied to alerting and infrastructure actions. Keep restart, rollback, AWS, SSH, and webhook actions disabled unless each target and command is explicitly approved, scoped, logged, and reversible. Use least-privilege API keys and never paste real bearer tokens directly into prompts or shared configs.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises automatic restart, rollback, webhook triggering, and remote SSH command execution without requiring explicit user confirmation or providing strong safety guardrails. In an agent context, these capabilities can lead to destructive changes, service disruption, or unintended infrastructure actions if triggered from ambiguous prompts or misconfigured monitors.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest description says to use the skill when the user needs "uptime tracking, performance monitoring, or automated incident response across multiple domains," which describes a wide class of common requests rather than narrow trigger phrases or constraints. Because no exclusion conditions or negative examples are provided in the manifest, the activation scope is ambiguous and may cause unintended invocation collisions with other ops or monitoring skills.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Example 1: Monitor 5 Critical Sites with Slack Alerts
text Monitor these sites every 5 minutes and alert Slack if any fail: - https://api.example.com/health - https://app.example.com/status - https://cdn.example.com/ping - https://wordpress.example.com/wp-json/health
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Example 1: Monitor 5 Critical Sites with Slack Alerts
text Monitor these sites every 5 minutes and alert Slack if any fail: - https://api.example.com/health - https://app.example.com/status - https://cdn.example.com/ping - https://wordpress.example.com/wp-json/health
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Example 1: Monitor 5 Critical Sites with Slack Alerts
text Monitor these sites every 5 minutes and alert Slack if any fail: - https://api.example.com/health - https://app.example.com/status - https://cdn.example.com/ping - https://wordpress.example.com/wp-json/health
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Example 1: Monitor 5 Critical Sites with Slack Alerts
text Monitor these sites every 5 minutes and alert Slack if any fail: - https://api.example.com/health - https://app.example.com/status - https://cdn.example.com/ping - https://wordpress.example.com/wp-json/health
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 78% confidence
- Finding
This example includes an Authorization header with a bearer token in outbound requests, normalizing the use of sensitive credentials in monitoring probes. In an agent setting, this increases the risk of secret exposure through logs, prompt leakage, copied examples, or transmission to misconfigured/untrusted endpoints.
- Content
Example: Monitor API health with custom authentication
text Endpoint: https://api.example.com/health Method: POST Headers: Authorization: Bearer YOUR_API_KEY
Static analysis
No suspicious patterns detected.