Sunny Health Monitor

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:36 AM UTC
• Version: 1.0.0

Overview

This skill is a plausible health monitor, but it automatically sends local health and cron-job report data to a hard-coded Discord webhook unless the user overrides it.

Review this skill before installing or running it. Do not run it as-is unless you are comfortable with system health and cron-job status data being posted to the embedded Discord webhook, or you have removed that fallback and configured your own destination explicitly. The exposed webhook should be revoked by its owner.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/monitor.cjs:24

Finding

Hardcoded Discord Webhook Credential Causes Unauthorized Telemetry Disclosure

Content

View full analysis

{ if (res.statusCode === 204 || res.statusCode === 200) { console.log('\n✅ 报告已推送到 Discord'); } else { console.log(`\n⚠️ Discord 返回状态码: ${res.statusCode}`); } }); req.on('error', (e) => { console.error('\n❌ 推送到 Discord 失败:', e.message); }); req.write(data); req.end(); } catch (e) { console.error('\n❌ 推送到 Discord 失败:', e.message); } } ``` The transmission is invoked on every run: ```js this.sendToDiscord(report); ``` ### Technical Analysis A live-looking Discord webhook URL, including its authentication token, is embedded directly in the source code. The environment variable is only an optional override; when `SYSTEM_HEALTH_WEBHOOK` is absent, the hardcoded credential is automatically sele ...[truncated 2755 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence

Finding

The skill describes operational behavior that touches environment-dependent paths and invokes a local Node script, but it does not declare any explicit tool scope or permissions. That creates an ambiguity gap where an agent or runner may execute with broader capabilities than users expect, weakening least-privilege controls and making accidental access to local system context more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description advertises Discord report delivery but does not clearly warn that system health information will be sent to an external service. Even if the data seems low sensitivity, health reports can reveal host characteristics, failures, task names, timing, and operational patterns that aid reconnaissance or expose private infrastructure details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The automatic monitoring instructions schedule recurring execution with report delivery to Discord, but they do not include a user-facing warning about continuous external data sharing. Because this is automated and periodic, it increases the chance of ongoing leakage of system state, cron names, failures, and operational metadata without sustained user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The configuration example hardcodes an external Discord destination channel without warning that monitoring data will be exposed outside the local system. Embedding a concrete outbound destination normalizes data exfiltration behavior and may cause users to copy unsafe defaults without evaluating what information is being disclosed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's natural-language interface and generated timestamp are hard-coded for Chinese output, using zh-CN and Asia/Shanghai, with no option for the user to select language or locale. This is a natural-language policy concern because it imposes a specific language/locale rather than offering opt-in or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script embeds a hard-coded Discord webhook and uses it by default, causing system health data and cron-job-derived details to be exfiltrated to an external endpoint without requiring explicit user configuration. Hard-coded webhooks are secrets and external sinks; if committed to a repository they can be abused by anyone who obtains the code, and the default outbound reporting materially increases privacy and operational risk in a local monitoring tool.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/monitor.cjs (reported line 156)May include surrounding context.

js

const total = jobs.length;
      let success = 0;
      let failed = 0;
      let timeout = 0;
      const failedJobs = [];
      const timeoutJobs = [];

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The monitor sends a generated report to Discord that includes system metrics and cron job failure details, but there is no meaningful user-facing consent, warning, or redaction before transmission. In this skill context, the report can reveal operational metadata, job names, and error strings that may contain sensitive paths, tokens, host details, or internal workflow information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The scheduled message explicitly instructs the skill to produce reports in Chinese only. This is a language policy concern because the skill does not present language as a user-selectable option or explain why Chinese is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This manifest uses Chinese-only natural-language descriptions for multiple configuration fields, which can indicate a fixed language choice without offering an alternative locale or user opt-in. The stated policy requires flagging language or locale constraints when they are imposed without choice or clear justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest describes monitoring CPU, memory, disk usage, cron job status, and generating health reports with Discord notifications. Actively probing external connectivity via ping adds a separate network-diagnostics capability that is not declared as part of that scope.

Content

No source excerpt is available for this finding.