Security audit

Observability Lgtm

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent local observability setup, but it exposes no-login monitoring services more broadly than its local-only description suggests.

Install only on a trusted machine and network. Before running it, bind exposed Docker ports to 127.0.0.1, disable anonymous Grafana Admin access or add authentication, validate service names passed to helper scripts, and consider using pinned dependencies or a reviewed lockfile.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: assets/docker-compose.yml:26
Finding: Unauthenticated observability services are exposed on all host interfaces
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: assets/scripts/register_app.sh:13
Finding: Target registration permits path traversal and JSON injection
Content: View full analysis
}" PORT="${2:?Usage: $0 }" TARGETS_DIR="$(cd "$(dirname "$0")/../config/prometheus/targets" && pwd)" TARGET_FILE="${TARGETS_DIR}/${SERVICE}.json" cat > "${TARGET_FILE}" <
Remediation: View remediation
&2 exit 1 fi ``` 2. Validate that the port is numeric and within the valid TCP range: ```bash if [[ ! "$PORT" =~ ^[0-9]+$ ]] || (( PORT < 1 || PORT > 65535 )); then echo "Invalid port" >&2 exit 1 fi ``` 3. Create the expected target directory before resolving it: ```bash TARGETS_DIR="$(dirname "$0")/../config/prometheus/targets" mkdir -p "$TARGETS_DIR" TARGETS_DIR="$(cd "$TARGETS_DIR" && pwd -P)" ``` 4. Resolve the destination and verify that it remains under `TARGETS_DIR`. 5. Generate JSON with a real JSON serializer rather than string interpolation. For example, use `jq -n --arg` or a short Python program using `json.dump`. 6. Write to a temporary file in the same directory and atomically rename it after successful validation to prevent partial configuration files. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: assets/lib/observability.py:56
Finding: Unvalidated service name permits log-path traversal
Content: View full analysis
logging.Logger: """ Configure root logger with: - JSON formatter → file (Alloy scrapes this → Loki) - Plain formatter → stderr (local dev readability) Log file: //app.log """ log_dir = _LOG_BASE / service_name log_dir.mkdir(parents=True, exist_ok=True) log_file = log_dir / "app.log" ``` ### Technical Analysis `service_name` is treated as a trusted directory name without validation. Python's `pathlib` allows `..` components, and joining an absolute path as the right operand can replace the intended base path entirely. For example, a traversal-bearing service name can resolve outside the configured log root. The function then creates parent directories and opens `app.log` through `logging.FileHandler`, using the application process's permissions. Although typical documented usage supplies a hardcoded service identifier, the public API does not enforce that assumption. Applications commonly source service names from environment variables or deployment configuration, which may make the value attacker-influenced. ### Attack Path 1. An attacker gains control over, or influences, the value passed as `service_name`. 2. The attacker supplies an absolute path or a value containing parent-directory components. 3. `_LOG_BASE / service_name` resolves outside the intended observability log directory. 4. `mkdir(parents=True)` creates reachable directories and `FileHandler` creates or appends to `app.log`. 5. Subsequent application logs are written to the attacker-selected location. ### Impact Assessment An attacker can cause ...[truncated 502 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: assets/requirements.txt:4
Finding: Dependencies are unbounded and are not integrity-pinned
Content: View full analysis
=7.0.0 # Traces (OpenTelemetry) opentelemetry-sdk>=1.25.0 opentelemetry-exporter-otlp-proto-grpc>=1.25.0 opentelemetry-instrumentation-fastapi>=0.46b0 # Structured JSON logging (Loki-compatible) python-json-logger>=2.0.7 ``` The installation instructions repeat the same lower-bound-only constraints: ```bash pip install \ "prometheus-fastapi-instrumentator>=7.0.0" \ "opentelemetry-sdk>=1.25.0" \ "opentelemetry-exporter-otlp-proto-grpc>=1.25.0" \ "opentelemetry-instrumentation-fastapi>=0.46b0" \ "python-json-logger>=2.0.7" ``` ### Technical Analysis Every Python dependency uses a minimum version with no upper bound or exact lock. Installation therefore selects whatever compatible release is available from the package index at installation time. No hashes are supplied to authenticate the downloaded artifacts. The reviewed package names appear consistent with the intended observability libraries; no direct evidence of typosquatting or a currently malicious package was found. The weakness is that future builds are non-reproducible and automatically trust future upstream artifacts. The Compose images are version-tagged, which is preferable to `latest`, but they are not pinned by immutable digest. ### Attack Path 1. A dependency publisher account, package-index distribution channel, or container registry is compromised, or an unsafe future release is published. 2. A user follows the Skill instructions at a later time. 3. The resolver accepts the newer package because it satisfies the lower-bound constraint, or the registry serves changed content under an image tag. 4. Installation hooks, imported Python modules, or container entrypoints execute the changed c ...[truncated 684 chars]
Remediation: View remediation
``` 5. Automate vulnerability scanning and dependency-update review rather than silently accepting all future versions. 6. Rebuild and retest lock files on a controlled schedule so security updates can be adopted without sacrificing reproducibility. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill includes shell commands, file copying, chmod, Docker orchestration, pip installs, and local HTTP requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a governance gap: an agent may execute impactful local actions without a machine-readable restriction boundary, increasing the chance of unintended command execution or over-broad tool use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The helper automatically enables OTLP trace export and FastAPI request instrumentation by default, which can transmit request metadata to a network endpoint without any explicit consent or warning at the call site. In an observability utility, this is likely intended for convenience rather than abuse, but it still creates a privacy and data-governance risk because developers may unknowingly emit telemetry containing sensitive route, header, or application context data.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 15% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
Wait ~15 seconds for all services to start, then verify:

bash
curl -s -o /dev/null -w "Grafana: %{http_code}\n" http://localhost:3000/api/health curl -s -o /dev/null -w "Prometheus: %{http_code}\n" http://localhost:9091/-/healthy curl -s -o /dev/null -w "Loki: %{http_code}\n" http://localhost:3300/ready curl -s -o /dev/null -w "Tempo: %{http_code}\n" http://localhost:4318/ready

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The dependency is specified with a lower-bound only (>=7.0.0), which permits installation of any newer release, including unreviewed major versions with breaking changes or newly introduced malicious/supply-chain issues. In a reusable skill, this increases build non-determinism and can cause consumers to pull different packages over time than the author tested.
Content: Scanner excerpt · assets/requirements.txt (reported line 5)May include surrounding context.
text
# Install: pip install -r requirements.txt # Metrics prometheus-fastapi-instrumentator>=7.0.0 # Traces (OpenTelemetry) opentelemetry-sdk>=1.25.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: Using opentelemetry-sdk>=1.25.0 allows future versions to be installed automatically, making deployments non-reproducible and exposing users to potential supply-chain risk if a later release is compromised or introduces insecure defaults. Observability libraries are often deeply integrated into request handling, so unexpected version drift can affect broad application behavior.
Content: Scanner excerpt · assets/requirements.txt (reported line 8)May include surrounding context.
text
prometheus-fastapi-instrumentator>=7.0.0 # Traces (OpenTelemetry) opentelemetry-sdk>=1.25.0 opentelemetry-exporter-otlp-proto-grpc>=1.25.0 opentelemetry-instrumentation-fastapi>=0.46b0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The exporter dependency is unpinned and may resolve to any later version, creating non-deterministic builds and increasing the chance of pulling a vulnerable or malicious upstream release. Because exporters handle telemetry egress, version changes can affect data transmission, reliability, and security-sensitive configuration behavior.
Content: Scanner excerpt · assets/requirements.txt (reported line 9)May include surrounding context.
text
# Traces (OpenTelemetry) opentelemetry-sdk>=1.25.0 opentelemetry-exporter-otlp-proto-grpc>=1.25.0 opentelemetry-instrumentation-fastapi>=0.46b0 # Structured JSON logging (Loki-compatible)

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: python-json-logger>=2.0.7 allows installation of arbitrary later versions, which weakens reproducibility and increases software supply-chain exposure. Logging libraries can influence how application data is serialized and emitted, so unexpected changes may create operational or security issues if a future release is problematic.
Content: Scanner excerpt · assets/requirements.txt (reported line 13)May include surrounding context.
text
opentelemetry-instrumentation-fastapi>=0.46b0 # Structured JSON logging (Loki-compatible) python-json-logger>=2.0.7

Static analysis

No suspicious patterns detected.