PM2 Remote Manager

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:35 AM UTC
• Version: 1.0.0

Overview

This is a straightforward PM2 server-management command guide, but it should only be used by someone who understands the operational impact of running those commands on production services.

Install this only if you want the agent to help with remote PM2 administration over SSH. Before running commands, confirm the server, process name, and account privileges; be especially careful with restart all, delete, kill, log flushing, startup persistence, and unpinned module installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:65

Finding

Unpinned Third-Party PM2 Module Installation

Content

View full analysis

Remediation

View remediation

" ``` 2. Resolve and record the package's expected integrity digest, then verify the downloaded artifact before production installation. 3. Use an organization-controlled or explicitly approved package registry rather than relying on an unrestricted default registry. 4. Review the selected package version, its transitive dependencies, and all lifecycle scripts before deployment. 5. Test the exact pinned artifact in an isolated staging environment before installing it on production systems. 6. Run PM2 under a dedicated, least-privileged service account with narrowly scoped access to application files and secrets. 7. Apply outbound network restrictions where feasible so the production account can retrieve packages only from approved repositories. 8. Prefer building and validating an immutable deployment artifact in CI, then promote that same artifact to production instead of dynamically installing the latest package on the server. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 95% confidence

Finding

The instruction to 'follow the instructions to run the generated command' encourages execution of opaque, dynamically generated shell output from a remote command without validation. If the remote host, PM2 installation, shell environment, or displayed output is compromised or spoofed, an operator could be socially engineered into running privileged arbitrary commands on the local or remote system.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

bash

# Generate startup script
ssh user@server "pm2 startup"
# Follow the instructions to run the generated command

# Save and enable startup
ssh user@server "pm2 save && pm2 startup systemd"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file includes stop, delete, and restart-all commands for production services, including pm2 delete myapp and pm2 restart all, but does not warn that these actions can interrupt running applications. Under the markdown-file criteria for SQP-2, behaviors that affect system integrity should include an explicit warning or caution to the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The skill instructs users to stream remote PM2 logs, which may expose credentials, personal data, or internal system details from production applications. The markdown does not include any warning about reviewing logs carefully or avoiding disclosure of sensitive contents.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.