sonic-build

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:28 PM UTC
• Version: 1.1.0

Overview

This SONiC build skill is mostly coherent, but it asks users to run host-modifying setup and destructive cleanup commands without enough guardrails.

Install only if you are comfortable with a skill that may guide an agent or user to make system-level package, Docker, and group changes on the host. Review the prerequisites script before running it, prefer pinned dependencies, verify the SONiC repository working directory before deleting target/*, and avoid Docker prune/rmi commands unless you intend to remove local images system-wide.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/prerequisites.sh:38

Finding

Unpinned Third-Party Python Package Installation

Content

View full analysis

Vulnerability Details

File Location: scripts/prerequisites.sh:38
Vulnerability Type: Unpinned dependency installation from a mutable package index
Risk Level: Medium

Vulnerable Code:

bash

run_step "Installing jinjanator (j2)" \
    bash -c 'pip3 install --user jinjanator || sudo apt-get install -y j2cli'

Technical Analysis

The script installs jinjanator from pip without constraining its version or validating package integrity with cryptographic hashes. Consequently, the installed package and its transitive dependencies are resolved from the mutable default Python package index at execution time.

If the upstream package, maintainer account, release process, or a transitive dependency is compromised, a later malicious release could be selected automatically. Python package installation may execute package-controlled build hooks or backend code. The resulting j2 executable also participates in subsequent SONiC build operations.

The fallback to j2cli does not mitigate the supply-chain risk. It silently changes implementations when pip installation fails, produces nondeterministic environments, and invokes apt-get with root privileges. There is no evidence that either named package is currently malicious; the confirmed issue is the unsafe, unpinned dependency-resolution mechanism.

Related documentation repeats the unpinned installation guidance at references/prerequisites.md:20 and references/troubleshooting.md:7.

Attack Path

1. An attacker compromises the jinjanator publisher account, release infrastructure, or one of its unconstrained dependencies.
2. The attacker publishes a malicious version that remains compatible with the unconstrained package requirement.
3. A user runs scripts/prerequisites.sh.
4. pip3 install --user jinjanator resolves and downloads the attacker-controlled release from the default package index.
5. Malicious package installation hooks can ex ...[truncated 771 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin jinjanator and every transitive Python dependency to audited versions in a committed lock file.

2. Require cryptographic hashes during installation, for example:

   bash

   python3 -m pip install --user --require-hashes -r requirements.txt
   

3. Install dependencies in an isolated virtual environment rather than the user's global package context.

4. Use a trusted internal package mirror or a controlled artifact repository where packages are reviewed and immutable.

5. Fail closed if the expected package cannot be installed instead of silently switching to j2cli.

6. Update references/prerequisites.md and references/troubleshooting.md to direct users to the pinned, hash-verified installation procedure.

7. Periodically review and deliberately update locked dependencies using vulnerability and provenance checks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (29)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The skill includes rm -rf target/*, a powerful destructive shell command that can cause significant data loss if executed from the wrong working directory or if target is unexpectedly resolved. Because the skill is meant for operational use by an agent or user performing builds, this is materially dangerous despite being presented as maintenance guidance rather than overtly malicious behavior.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

When to clean: after branch switch, rebase, or unexplained failures.

bash

rm -rf target/*   # always full clean, not selective
make configure PLATFORM=vs
make SONIC_BUILD_JOBS=4 target/sonic-vs.img.gz

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The instruction to run rm -rf target/* is a destructive shell command presented as a routine fix, which creates risk of accidental data loss through copy-paste or path confusion. Although the target is a build directory, the absence of safety checks or confirmation makes it hazardous in documentation intended for broad operational use.

Content

Scanner excerpt · references/troubleshooting.md (reported line 9)May include surrounding context.

md

|---------|-------|-----|
| `j2: command not found` | Python 3.12+ removed `imp` | `pip3 install jinjanator` |
| Build dies silently | OOM killer | Set `SONIC_BUILD_MEMORY`, reduce JOBS |
| Trixie phase missing | Stale artifacts in `target/` | `rm -rf target/*` and rebuild |
| `sg docker` nesting fails | Docker group session lost in subshell | Keep `sg docker` as outermost wrapper |
| `make: Nothing to be done` | Stale target files exist | Clean `target/` completely |
| DCO check fails on PR | Missing `Signed-off-by` | `git commit --amend --signoff` + force-push |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

This troubleshooting step again instructs users to run rm -rf target/* after checking for stale artifacts, but it still lacks safeguards against accidental misuse. Even though the command is relevant to build cleanup, the skill context makes copy-paste execution likely, so destructive commands need stronger guardrails.

Content

Scanner excerpt · references/troubleshooting.md (reported line 34)May include surrounding context.

ls -la target/.bin target/.gz target/*.squashfs 2>/dev/null

text

If any exist from a prior build, `rm -rf target/*` and reconfigure.

## Build Monitoring

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/prerequisites.sh (reported line 39)May include surrounding context.

sh

sudo apt install -y python3-pip git

run_step "Installing jinjanator (j2)" \
    bash -c 'pip3 install --user jinjanator || sudo apt-get install -y j2cli'

echo "==> Testing j2 availability..."
if ! command -v j2 >/dev/null 2>&1; then

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/prerequisites.sh (reported line 65)May include surrounding context.

sh

sudo apt install -y python3-pip git

run_step "Installing jinjanator (j2)" \
    bash -c 'pip3 install --user jinjanator || sudo apt-get install -y j2cli'

echo "==> Testing j2 availability..."
if ! command -v j2 >/dev/null 2>&1; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/prerequisites.sh (reported line 59)May include surrounding context.

sh

sudo apt install -y ca-certificates curl gnupg lsb-release

    run_step "Adding Docker GPG key" \
        bash -c "curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg"

    run_step "Adding Docker apt repository" \
        bash -c "echo \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/prerequisites.sh (reported line 63)May include surrounding context.

sh

sudo apt install -y ca-certificates curl gnupg lsb-release

    run_step "Adding Docker GPG key" \
        bash -c "curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg"

    run_step "Adding Docker apt repository" \
        bash -c "echo \

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

Piping network-fetched content directly into a sudo-executed command creates a dangerous trust chain with no independent verification step. In a build prerequisites script, this is more dangerous because the script is expected to be run by developers on their host systems and modifies package trust at the OS level.

Content

Scanner excerpt · scripts/prerequisites.sh (reported line 59)May include surrounding context.

sh

sudo apt install -y ca-certificates curl gnupg lsb-release

    run_step "Adding Docker GPG key" \
        bash -c "curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg"

    run_step "Adding Docker apt repository" \
        bash -c "echo \

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents shell commands and operational procedures but does not declare any explicit tool scope or allowed-tools boundary. In an agent setting, this increases the chance the agent will execute build, cleanup, or system-modifying shell commands without least-privilege constraints, which is especially relevant because the skill includes Docker use and destructive filesystem operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented cleanup step uses a destructive deletion command without a prominent warning that it irreversibly removes build artifacts. In an agent-assisted workflow, omission of a clear warning makes accidental data loss more likely, particularly if the current directory is wrong or if users assume selective cleanup is safe.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/prerequisites.md (reported line 19)May include surrounding context.

Python & Jinja

bash

sudo apt install -y python3-pip
pip3 install --user jinjanator

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/prerequisites.md (reported line 30)May include surrounding context.

Python & Jinja

bash

sudo apt install -y python3-pip
pip3 install --user jinjanator

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/prerequisites.md (reported line 31)May include surrounding context.

Python & Jinja

bash

sudo apt install -y python3-pip
pip3 install --user jinjanator

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/prerequisites.md (reported line 33)May include surrounding context.

Python & Jinja

bash

sudo apt install -y python3-pip
pip3 install --user jinjanator

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/vs-platform.md (reported line 39)May include surrounding context.

Python & Jinja

bash

sudo apt install -y python3-pip
pip3 install --user jinjanator

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/troubleshooting.md (reported line 14)May include surrounding context.

md

| `make: Nothing to be done` | Stale target files exist | Clean `target/` completely |
| DCO check fails on PR | Missing `Signed-off-by` | `git commit --amend --signoff` + force-push |
| Submodule checkout fails | HTTPS HTTP 500 | Use SSH remotes |
| Container exits immediately | `nohup bash -c 'sg docker -c "..."'` nesting | Use `sg docker -c 'nohup make ...'` (sg outermost) |

## Diagnosing OOM

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation recommends rm -rf target/* as a troubleshooting step without any warning about irreversible deletion or guidance to verify the working directory first. In a build skill, users may copy-paste commands blindly, and destructive cleanup commands can cause unintended data loss if run from the wrong path or against unexpectedly populated build artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Docker cleanup section includes docker image prune -a and bulk image removal via docker rmi without warning that these actions irreversibly delete local images, potentially affecting unrelated workflows on the host. In a build environment where multiple projects may share Docker images, this can disrupt other builds or remove needed cached artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly shows SSH access using a default password without any warning that it is only for isolated lab use or that credentials must be changed immediately. Even in a VS/testing context, normalizing default credentials increases the chance that users expose an instance with known login details or reuse the pattern in less isolated environments.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/prerequisites.sh (reported line 33)May include surrounding context.

sh

###############################################

run_step "Updating apt package index" \
    sudo apt update

run_step "Installing prerequisites (python3-pip, git)" \
    sudo apt install -y python3-pip git

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/prerequisites.sh (reported line 36)May include surrounding context.

sh

###############################################

run_step "Updating apt package index" \
    sudo apt update

run_step "Installing prerequisites (python3-pip, git)" \
    sudo apt install -y python3-pip git

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/prerequisites.sh (reported line 39)May include surrounding context.

sh

###############################################

run_step "Updating apt package index" \
    sudo apt update

run_step "Installing prerequisites (python3-pip, git)" \
    sudo apt install -y python3-pip git

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/prerequisites.sh (reported line 56)May include surrounding context.

sh

###############################################

run_step "Updating apt package index" \
    sudo apt update

run_step "Installing prerequisites (python3-pip, git)" \
    sudo apt install -y python3-pip git

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/prerequisites.sh (reported line 65)May include surrounding context.

sh

###############################################

run_step "Updating apt package index" \
    sudo apt update

run_step "Installing prerequisites (python3-pip, git)" \
    sudo apt install -y python3-pip git

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/prerequisites.sh (reported line 68)May include surrounding context.

sh

###############################################

run_step "Updating apt package index" \
    sudo apt update

run_step "Installing prerequisites (python3-pip, git)" \
    sudo apt install -y python3-pip git

Static analysis

No suspicious patterns detected.