T09 · Insecure Skill Coding Practices
Error
- Location
lib/checks.sh:327- Finding
Arbitrary Local Command Execution Through eval
- Content
View full analysis
- Remediation
View remediation
Security audit
AI Cluster Pre-flight Check
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real GPU-cluster checker, but it includes unsafe switch and container checks that deserve manual review before installation.
Review this skill before installing on production or privileged cluster nodes. Avoid using SWITCH_CLI_CMD unless the environment is fully trusted, prefer pinned and approved container images, require normal SSH host-key verification for switches, set MOUNT_POINT deliberately, and run the checks with the least privilege that still permits the diagnostics you need.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T03 · Remote Payload Retrieval and Execution
Error
- Location
lib/checks.sh:123- Finding
Mutable Remote Container Images Are Automatically Retrieved and Executed
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
lib/checks.sh:327- Finding
SSH Host Identity Verification Is Disabled for Switch Connections
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
lib/checks.sh:11- Finding
Unvalidated Peer Values Can Be Interpreted as SSH Options
- Content
View full analysis
&2 return 3 fi local fail=0 IFS=',' read -ra ips <<< "$peers" for ip in "${ips[@]}"; do ip=$(echo "$ip" | xargs) if ssh -o BatchMode=yes -o ConnectTimeout=5 "$ip" echo ok 2>/dev/null; then ``` ### Technical Analysis `PREFLIGHT_PEER_IPS` is documented as a comma-separated collection of peer IP addresses, but each entry is passed to `ssh` without validation that it is actually an IPv4 address, IPv6 address, or approved hostname. Quoting the variable prevents ordinary shell metacharacter injection, but it does not ensure that the receiving program treats the value as a destination. A crafted value beginning with `-` may be interpreted by the SSH client as an option rather than as a hostname. Depending on the accepted option and client behavior, this can alter SSH configuration or introduce dangerous transport behavior such as a locally executed proxy command. The implementation also uses `xargs` for trimming, which is unnecessary and makes input normalization less predictable than explicit shell-based whitespace handling. ### Attack Path 1. An attacker controls or influences `PREFLIGHT_PEER_IPS` through an orchestration job, Agent request, wrapper script, or inherited environment. 2. The attacker supplies an entry beginning with an SSH option rather than a valid peer address. 3. Check `1.1` passes the crafted entry directly to `ssh`. 4. The SSH client interprets the value as configuration instead of a destination. 5. The attacker alters connection behavior and may reach a local command-execution primitive if a dangerous client option is accepted. ### Impact Assessment The obtainable scope depends ...[truncated 612 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Privileged Container / Container Escape
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Potential security issue detected. Manual review is recommended.
- Content
sh if [ "$vendor" = nvidia ]; then docker run --rm --gpus all nvidia/cuda:12.4.0-base-ubuntu22.04 nvidia-smi --query-gpu=gpu_name --format=csv,noheader elif [ "$vendor" = amd ]; then docker run --rm --device /dev/kfd --device /dev/dri rocm/rocm-terminal rocm-smi --showproductname else echo "No GPU vendor detected" >&2 return 1
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh done fi [ -z "$mp" ] && mp=/tmp df -h "$mp" && touch "$mp/.clusterready_test" && rm -f "$mp/.clusterready_test" && echo "read/write OK on $mp" } # 1.11 GPUDirect Kernel Module
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh done fi [ -z "$mp" ] && mp=/tmp df -h "$mp" && touch "$mp/.clusterready_test" && rm -f "$mp/.clusterready_test" && echo "read/write OK on $mp" } # 1.11 GPUDirect Kernel Module
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The switch validation function executes the contents of SWITCH_CLI_CMD via 'eval', which allows arbitrary shell command execution if that environment variable is attacker-controlled or accidentally mis-set. Because this skill is intended for infrastructure pre-flight checks and may run with elevated privileges on cluster nodes, exploitation could lead to full local command execution on sensitive systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill documentation states that check 1.10 validates a shared mount with read/write access, but it does not clearly warn users that running the check may modify the target filesystem. On infrastructure skills, undocumented write behavior can cause unintended changes to production or shared storage, especially if operators assume the tool is read-only health validation.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
The AMD container check uses 'rocm/rocm-terminal' without an explicit tag or digest, so each run may pull a different image over time. In a pre-flight check that may be executed on privileged cluster nodes, this creates avoidable supply-chain risk because behavior and contents of the image are not fixed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The function can execute shell commands sourced from an environment variable, but there is no explicit warning, confirmation, or disclosure to the operator that arbitrary local commands may run. In practice this increases the chance of unsafe use, especially in automation pipelines where environment variables may come from CI, orchestration, or inherited shell state.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The SSH-based switch check disables host key verification with 'StrictHostKeyChecking=no', making the connection vulnerable to man-in-the-middle attacks or silent connection to an impostor host. In a cluster/network administration context, that is more dangerous because the command may query or trust data from infrastructure devices on privileged networks.
- Content
Static analysis
No suspicious patterns detected.