Security audit

Ovh

Security checks for vulnerabilities and agentic risk

Overview

This OVH skill is not deceptive, but it can make immediate production account changes using broad OVH credentials without built-in confirmation or permission boundaries.

Install only if you are comfortable giving an agent live OVH account access. Use least-privileged OVH consumer keys, separate read-only and write credentials where possible, manually confirm DNS deletes and server power actions before running them, and pin/review the OVH Python SDK instead of following an unpinned install command.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: scripts/ovh-cli.py:8
Finding: Unpinned OVH SDK Installation Guidance Creates Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
--hash=sha256: ``` 4. Install through a hash-locked file: ```bash python -m pip install --require-hashes -r requirements.txt ``` 5. Generate and review a complete transitive lockfile with tooling such as `pip-tools`, and commit it to the project. 6. Replace the displayed command with guidance that references the controlled manifest rather than `pip install ovh`. 7. Prefer a trusted internal package mirror or explicitly configured package index in sensitive environments. 8. Run the CLI and dependency installation under a dedicated, least-privileged account. 9. Grant the OVH consumer key only the API permissions required for the intended operation, and use separate credentials for read-only and destructive workflows where practical. 10. Rotate OVH credentials if an untrusted package version has previously been installed or imported. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill description promises broad OVH resource management, but the documented behavior includes undeclared billing/order access and omits or overstates support for other areas like email and full cloud management. This mismatch can mislead users and orchestrators about what the skill can access or change, increasing the chance of unintended sensitive-data exposure or unsafe invocation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill requires sensitive OVH credentials from environment variables and can perform account-affecting API actions, but it declares no explicit tool scope or permissions boundary. This weakens governance and makes it easier for an agent runtime to invoke the skill with broader access than users may expect, especially where environment access is implicitly available.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation description is very broad and encourages use for nearly any OVH-related request, including high-risk administrative actions across domains, DNS, servers, and certificates. In an agent setting, overbroad routing increases the likelihood that the skill is invoked in situations where the user intended only informational help, not live account operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation advertises destructive and state-changing operations such as DNS create/update/delete, VPS reboot/stop/start, and server reboot without any warning, approval flow, or emphasis on confirmation. In this context, the skill directly manages production infrastructure, so silent execution mistakes could cause outages, traffic hijacking, or service disruption.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: DNS record deletion is executed immediately with no confirmation, dry-run, or explicit warning. In an agent skill context, this is risky because a mistaken invocation, ambiguous prompt, or prompt-injection-induced action can remove production DNS entries and disrupt service availability.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: VPS power operations (reboot, start, stop) are performed immediately without confirmation or safety interlocks. In a remote-management skill, these actions can cause outages or data loss if triggered accidentally, by misunderstanding user intent, or via malicious prompt injection through the agent workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Dedicated server reboot is a disruptive state-changing action executed with no warning or confirmation. Because this skill manages infrastructure directly, lack of a confirmation barrier increases the chance that accidental or adversarially induced requests cause production downtime.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The CLI exposes billing and order-history endpoints (/me/bill, /me/order) that go beyond the stated OVH service-management scope in the manifest. This broadens access to sensitive financial/account metadata and can violate least-privilege expectations, making the skill more dangerous if invoked unexpectedly or by a prompt-injected workflow.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code defines cmd_vps_status with the docstring 'Get VPS status', and the CLI accepts a 'status' action for vps, but main routes any present VPS action to cmd_vps_action first. Because cmd_vps_action has no 'status' branch, requesting 'vps status' does not execute the documented status function, contradicting the documented intent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.