Lingxi · Agent Health Monitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 1.0.0

Overview

This monitoring skill is not clearly malicious, but it asks an agent to make automatic cleanup and recovery changes without enough user control or scoping.

Install only in an environment where agent operations, session cleanup, memory pruning, connection restarts, provider fallback, and scheduled jobs are explicitly allowed. Prefer disabling self-healing by default, using read-only health checks first, requiring confirmation for cleanup or restarts, and ensuring external alerts do not include secrets, private user content, or sensitive infrastructure details.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:72

Finding

Unbounded Self-Healing Actions Can Modify Agent State Without Explicit Authorization

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 72–78; related behavior at lines 119–123
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable instructions:

markdown

## Self-Healing Actions

When issues are detected, the agent can automatically:

1. **Restart failed MCP connections**
2. **Clean up stale sessions** (sessions idle > 2 hours)
3. **Flush memory cache** when usage > 80%
4. **Retry failed tool calls** (up to 3 attempts)
5. **Switch to backup providers** (e.g., GitHub API fallback)

The related memory-management instructions state:

markdown

## Memory Management

When memory usage is high:
1. Archive completed session summaries to memory files
2. Clear intermediate computation cache
3. Merge small memory files into consolidated ones
4. Prune session history beyond retention limit

Technical Analysis

The skill is documentation-only and does not contain an executable implementation. Nevertheless, its operational instructions authorize an agent to perform state-changing actions automatically when monitoring thresholds are met. These actions include terminating stale sessions, flushing caches, pruning session history, restarting external connections, and switching providers.

The instructions do not define an authorization check, ownership boundary, affected-session scope, confirmation step, backup requirement, or rollback procedure. If the skill is loaded by an agent with sufficiently privileged session, memory, MCP, or provider-management tools, it may interpret a threshold breach as authorization to modify resources belonging to other users or workloads. This violates least-privilege principles because a monitoring task ordinarily requires read access, while the documented recovery behavior requires broad write and administrative access.

No evidence shows that the package independently acquires additiona ...[truncated 2079 chars]

Remediation

View remediation

Remediation Suggestions

1. Make all monitoring operations read-only by default and disable automatic state changes unless explicitly enabled by an authorized administrator.
2. Require per-action confirmation before deleting sessions, pruning history, flushing shared caches, restarting connections, or switching providers.
3. Enforce resource ownership and tenant boundaries so the skill can affect only the requesting user's authorized agent and sessions.
4. Grant separate capabilities for telemetry collection and remediation; do not provide write or administrative permissions to health-reporting operations.
5. Define precise selection criteria for stale sessions, cache entries, and retained history, including exclusions for active, pinned, privileged, or shared resources.
6. Create backups or recoverable snapshots before destructive cleanup and document a tested rollback procedure.
7. Add dry-run mode that reports proposed actions, affected resource identifiers, and expected impact without applying changes.
8. Record immutable audit logs containing the initiating identity, authorization decision, threshold evidence, selected resources, action, and outcome.
9. Restrict provider fallback to a preapproved allowlist and require equivalent privacy, authentication, and data-handling controls.
10. Redact secrets, user content, session identifiers, and sensitive infrastructure details from health reports and external notifications.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad conversational commands such as "Agent status" and especially "Alert me if...", which can overlap with normal user speech and unintentionally activate monitoring or configuration behavior. In a skill that can perform self-healing actions and alter system state, accidental invocation increases the chance of unintended restarts, cleanup actions, or alert reconfiguration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises automatic self-healing actions including restarting connections, cleaning sessions, flushing memory cache, retries, and failover, but it does not prominently warn users that these behaviors can modify runtime state automatically. This is dangerous because operators may enable or invoke the skill expecting passive monitoring, while it can make changes that affect availability, data retention, session integrity, or downstream systems.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

bash

# In your notification workflow
curl -X POST $SLACK_WEBHOOK \
  -H "Content-Type: application/json" \
  -d '{"text": "🔴 Agent Alert: $ALERT_MESSAGE"}'

Static analysis

No suspicious patterns detected.