Dead Man's Switch

• Outcome: Review
• Latest audit: May 28, 2026 · 7:56 AM UTC
• Version: 0.1.0

Overview

This appears to be a legitimate infrastructure repair skill, but it can make powerful automatic system changes that users should review before installing.

Install only if you intentionally want an agent that can repair Linux infrastructure, not just report status. Before using it, require confirmation for service restarts, process killing, Docker prune, log/temp deletion, cron creation, Tavily-derived fixes, and playbook edits; also review what operational details may be sent to Tavily or ElevenLabs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to search the web for fixes and then attempt those fixes on production infrastructure. This expands authority from bounded recovery playbooks to untrusted external guidance, creating a path for prompt injection, bad advice, or attacker-influenced remediation to trigger unsafe commands or configuration changes.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill tells the agent to append newly learned fixes into playbook files based on externally sourced information. That creates self-modifying operational guidance, allowing one bad or poisoned recovery attempt to persist and influence future runs, compounding risk over time.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad enough to match common user requests about checking service health, which can invoke a skill that performs repairs and other state-changing actions. In this context, accidental activation is more dangerous because the skill is authorized to restart services, create cron jobs, and modify files.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill advertises autonomous diagnosis, recovery, cron creation, and learning behavior without an upfront warning that it may alter system state. Users invoking what sounds like a monitoring tool may not realize it can restart services, persist scheduled tasks, or change operational files.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The self-improvement section permits updating playbook files based on newly discovered fixes without a user-facing warning or approval gate. This is especially dangerous in an infrastructure-recovery skill because it turns transient errors and untrusted external advice into persistent future behavior.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The playbook directs the agent to perform destructive cleanup actions automatically and to persist new behavior by creating an hourly cron job, but it does not require explicit user approval before making those system changes. In an autonomous recovery skill, this creates a real risk of unintended data removal, repeated cleanup loops, and stealthy persistence beyond the immediate incident response.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The playbook instructs creating a persistent cron job that will continue executing every 5 minutes, but it does not clearly warn that this creates ongoing automated behavior with repeated diagnostic and recovery actions. In a self-healing infrastructure skill, that persistence increases risk because future service issues can trigger unattended restarts or other privileged remediation indefinitely, potentially masking incidents or causing repeated disruptive actions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The playbook instructs `pkill -f <process-name>` as an automated recovery step without warning that it may terminate multiple matching processes based on a broad pattern. In a self-healing infrastructure skill, this is more dangerous because an agent could kill unrelated or critical processes if the process name is ambiguous or attacker-influenced, causing service disruption or cascading outages.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The cron rule creates a persistent automated restart loop that will repeatedly check and restart a service every 5 minutes without further user confirmation. In this skill's autonomous recovery context, that can mask root causes, thrash unstable services, repeatedly execute privileged actions, and prolong an incident rather than safely contain it.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The playbook directs the agent to run privileged commands such as a root-owned recovery script and systemd restarts without any explicit confirmation or warning to the user about service-impacting changes. In an autonomous recovery skill, this can normalize silent privileged actions and increase the chance of unintended disruption or misuse if the detection logic is wrong or the environment is compromised.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The playbook instructs creation of a recurring cron job that will keep performing privileged recovery actions every 5 minutes, but it does not clearly warn that this establishes ongoing automated privileged behavior. Persistent self-healing loops can hide repeated failures, repeatedly execute sudo-backed actions, and create a durable mechanism that could be abused or cause prolonged unintended changes.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

which docker 2>/dev/null

# Remove unused images, containers, volumes
sudo docker system prune -f 2>/dev/null || true

# More aggressive: also remove unused images
sudo docker image prune -af 2>/dev/null || true

• Confidence: 82% confidence
• Finding: The Docker cleanup commands run with sudo and include aggressive pruning of images, containers, and volumes without requiring confirmation or validating what will be removed. In this skill context, that can disrupt running or recoverable workloads and erase artifacts needed for service recovery or forensics.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo apt-get clean && sudo apt-get autoclean

# Step 3: Journal vacuum
sudo journalctl --vacuum-time=7d --vacuum-size=500M

# Step 4: Old rotated logs
sudo find /var/log -name "*.gz" -mtime +30 -delete 2>/dev/null || true

• Confidence: 79% confidence
• Finding: Deleting rotated logs with sudo under /var/log changes system state and can remove potentially important operational or forensic data automatically. In a self-healing agent, doing this without approval or retention safeguards increases the chance of destroying evidence or causing troubleshooting blind spots.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo journalctl --vacuum-time=7d --vacuum-size=500M

# Step 4: Old rotated logs
sudo find /var/log -name "*.gz" -mtime +30 -delete 2>/dev/null || true

# Step 5: Temp files
sudo find /tmp -type f -atime +1 -delete 2>/dev/null || true

• Confidence: 74% confidence
• Finding: Automatically deleting files from /tmp with sudo can remove temporary files still needed by applications, especially if access time is not a reliable freshness signal on the filesystem. While less severe than deleting application data, it can still cause service instability when executed autonomously.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo find /var/log -name "*.gz" -mtime +30 -delete 2>/dev/null || true

# Step 5: Temp files
sudo find /tmp -type f -atime +1 -delete 2>/dev/null || true

# Step 6: Docker (if present)
which docker && sudo docker system prune -f 2>/dev/null || true

• Confidence: 83% confidence
• Finding: This privileged Docker prune action is embedded in the automated recovery sequence, making it more dangerous than a simple administrative example. Autonomous execution can remove cached images and stopped containers needed for rollback or incident analysis, potentially worsening outages.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

sudo find /tmp -type f -atime +1 -delete 2>/dev/null || true

# Clear stale apt lists
sudo rm -rf /var/lib/apt/lists/*
sudo apt-get update  # Regenerates them
```

• Confidence: 86% confidence
• Finding: Although the command is scoped to apt metadata, it uses sudo rm -rf with a wildcard in an automated playbook, which is a high-risk deletion primitive if paths are mistyped, expanded unexpectedly, or reused unsafely in templated automation. In a self-healing skill, normalizing recursive forced deletion as a recovery step raises the chance of accidental destructive behavior.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

sudo find /tmp -type f -atime +1 -delete 2>/dev/null || true

# Clear stale apt lists
sudo rm -rf /var/lib/apt/lists/*
sudo apt-get update  # Regenerates them
```

• Confidence: 86% confidence
• Finding: Although the command is scoped to apt metadata, it uses sudo rm -rf with a wildcard in an automated playbook, which is a high-risk deletion primitive if paths are mistyped, expanded unexpectedly, or reused unsafely in templated automation. In a self-healing skill, normalizing recursive forced deletion as a recovery step raises the chance of accidental destructive behavior.

Chaining Abuse

High

• Category: Tool Misuse

Content

sudo find /tmp -type f -atime +1 -delete 2>/dev/null || true

# Step 6: Docker (if present)
which docker && sudo docker system prune -f 2>/dev/null || true

# Step 7: Check final usage
df -h /

• Confidence: 78% confidence
• Finding: The conditional chain 'which docker && sudo docker system prune -f' combines environment-dependent detection with immediate destructive action, reducing opportunities for review and making accidental execution easy. In an autonomous repair playbook, this pattern increases the chance that a simple presence check triggers state-changing cleanup without user awareness.

Static analysis

No suspicious patterns detected.