T06 · System Persistence
Error
- Location
SKILL.md:131- Finding
User-Level Service Persistence Through systemd
- Content
View full analysis
- Remediation
View remediation
Security audit
Azure Gateway Cli
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be an Azure OpenAI gateway guide, but its documentation is inconsistent and includes under-scoped persistent service setup for a credential-handling local proxy.
Install only if you are prepared to audit or supply the missing gateway script and systemd unit yourself. Do not enable the systemd service until you have reviewed exactly what it runs, where credentials are stored, and how to stop, disable, and remove it. Treat the SEO and generic scoring sections as documentation defects that should be corrected before broad agent use.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:215- Finding
Unpinned npm Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata and description are internally inconsistent: it presents itself as an Azure OpenAI gateway, but also claims applicability to SEO optimization and ranking tasks. This kind of scope confusion can cause the agent to invoke the skill in unrelated contexts, increasing the chance of unintended command execution, file access, or exposure of sensitive configuration during tasks the user did not intend this skill to handle.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The invocation language is overly broad and mismatched, explicitly encouraging use for generic SEO tasks even though the skill claims to be an Azure gateway. Broad trigger phrases raise the risk of inappropriate automatic selection, which is especially dangerous here because the skill declares read/exec/write tools and includes operational steps that can alter the local environment.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documented input/output contract describes a generic review/scoring tool rather than an Azure gateway service, indicating the skill may be assembled from mismatched templates or misleading documentation. This mismatch can cause unsafe agent behavior because callers may supply arbitrary content for analysis while the skill also advertises exec/write capabilities and local system modification steps.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description explicitly states '支持中文交互，无需复杂配置即开即用', which presents Chinese as the interaction language without offering opt-in or alternatives. Under the language/locale policy, forcing a specific language is a natural-language policy concern unless the restriction is clearly justified or optional.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The 'professional edition enhancements' list data processing, visualization, and synchronization features unrelated to a local Azure gateway. Such capability inflation obscures the true behavior of the skill and may induce broader trust or invocation in contexts that involve sensitive data handling not actually justified by the stated purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation instructs users to register and start a systemd user service, which changes local system behavior and creates persistence, but it does not prominently warn about the security and operational implications. In an agent skill context, this is risky because users may not realize they are enabling a background service that can continue handling requests or consuming stored credentials after the session ends.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
This duplicate persistence finding points to the same service-installation sequence that creates user-level systemd configuration. The risk is not merely the file operations themselves, but that the skill encourages installation of a persistent local service without enough transparency or guardrails around what will run continuously.
- Content
第三步：注册为系统服务（可选）
bash mkdir -p ~/.config/systemd/user cp （请参考skill目录中的脚本文件） ~/.config/systemd/user/ nano ~/.config/systemd/user/azure-gateway.service # ...
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
This duplicate persistence finding points to the same service-installation sequence that creates user-level systemd configuration. The risk is not merely the file operations themselves, but that the skill encourages installation of a persistent local service without enough transparency or guardrails around what will run continuously.
- Content
第三步:注册为系统服务(可选)
bash mkdir -p ~/.config/systemd/user cp (请参考skill目录中的脚本文件) ~/.config/systemd/user/ nano ~/.config/systemd/user/azure-gateway.service # ...
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The use of 'systemctl --user enable' establishes persistence by configuring the gateway to start automatically for the user. Persistence is contextually significant in a skill that brokers API traffic and may access keys, because it allows the service to continue operating beyond the initiating session and increases the window for misuse, accidental exposure, or unnoticed network activity.
- Content
nano ~/.config/systemd/user/azure-gateway.service
...
systemctl --user daemon-reload systemctl --user enable azure-gateway systemctl --user start azure-gateway
text
Static analysis
No suspicious patterns detected.