Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a local network troubleshooting guide, but it includes broad activation rules and an unsafe device-approval workflow that could authorize the wrong device.
Install only if you are comfortable reviewing each command before it runs. Do not approve pairing requests with a generic latest selector; first verify the exact device identity, timestamp, and request details, then approve a specific intended device. Treat configuration changes and device approvals as privileged actions requiring explicit user confirmation.
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T05 · Unauthorized Access and Privilege Escalation
Error
Location
SKILL.md:125
Finding
Unverified Approval of the Latest Pending Device
Content
View full analysis
Vulnerability Details
File Location: SKILL.md, lines 125-128 Vulnerability Type: Unverified device pairing and authorization Risk Level: High
Vulnerable Code
bash
skill-platform devices approve --latest
Technical Analysis
The Skill directs the Agent to approve the latest pending pairing request without first verifying the requesting device's immutable identifier, fingerprint, owner, or request timestamp. The surrounding workflow assumes that the presence of a pending request proves that the intended device completed the connection process.
This assumption is unsafe on a shared or attacker-accessible LAN. The --latest selector is mutable and timing-dependent. An attacker can submit a new pairing request immediately before approval, causing the command to authorize the attacker's device instead of the user's intended device. The instruction therefore bypasses an essential identity-verification step at an access-control boundary.
Attack Path
The attacker obtains network access to the LAN or otherwise reaches the exposed gateway pairing interface.
The legitimate user begins troubleshooting a pairing failure using this Skill.
The attacker submits a pairing request shortly before the approval command is executed.
The attacker's request becomes the latest pending request.
The Agent or user executes skill-platform devices approve --latest as instructed.
The platform approves the attacker's device without confirming its identity.
The attacker receives the access granted to an authenticated and paired device.
Impact Assessment
Successful exploitation can authorize an unintended device and grant it all permissions normally assigned to paired devices. Depending on the gateway's authorization model, this may include access to node status, gateway services, device operations, or other resources available through the paired-device interface.
The issue affects ga
...[truncated 227 chars]
Remediation
View remediation
Remediation Suggestions
Remove all recommendations to approve pairing requests using --latest.
List pending requests and require verification of an immutable device ID or cryptographic fingerprint.
Display the requesting device's identifier, name, source address, request timestamp, and fingerprint before approval.
Require explicit user confirmation that the displayed identity matches the intended physical device.
Approve the selected request by immutable identifier, for example:
bash
The exact flag should be replaced with the platform's supported identifier-based syntax.
Reject stale requests and clear unexpected pending requests before initiating a new pairing attempt.
Where supported, use a short-lived challenge displayed on both devices to prevent pairing-request races.
Document that the existence of a pending request proves only that a request reached the gateway; it does not prove the request originated from the intended device.
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)
Vague Triggers
High
Category
Not specified by scanner
Confidence
98% confidence
Finding
The trigger condition says to use this skill for broad development, coding, debugging, testing, and deployment tasks, which is much wider than its stated purpose of local/LAN node connectivity diagnosis. Overbroad invocation criteria can cause the skill to activate in unrelated contexts and run shell-based diagnostics or suggest approval/config changes where they are not appropriate.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding
The display name, description, triggers, usage guidance, and all user-facing instructions are entirely in Chinese, with no statement that users may choose another language. This can violate language/locale policy when a skill implicitly constrains interaction language without opt-in or a documented region-specific justification.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The skill advertises diagnostic capabilities but does not clearly foreground that it uses exec-enabled shell commands and may lead to configuration modifications through agent actions. In an agent environment, insufficient disclosure of command execution and write-capable behavior weakens informed consent and can result in unexpected system or configuration changes.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
The skill instructs approving the latest pending device pairing request without an explicit warning that this authorizes a device to connect and may grant access to services or data behind the gateway. If followed blindly, a user or agent could approve an unintended or malicious device simply because a request is pending.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The skill claims it only provides diagnosis and suggestions, but elsewhere instructs the agent to perform state-changing actions such as modifying gateway configuration and approving devices. This mismatch can mislead users and downstream agents into granting broader execution trust than intended, increasing the chance of unauthorized configuration changes or accidental device authorization.
