T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:16- Finding
Excessive write and execution permissions contradict the read-only monitoring scope
- Content
View full analysis
- Remediation
View remediation
Security audit
Ops Dashboard Free
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a local operations dashboard guide, but it asks for broader write/execute authority and includes inconsistent state-changing instructions despite describing itself as read-only.
Review this before installing. Use it only in a restricted workspace, remove or deny write capability for the free read-only edition, require an auth token for all sensitive local API calls, and avoid pasting raw config/security scan results into shared chats or logs.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:198- Finding
Sensitive operational API examples omit authentication
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
创建
.env文件配置基础运行参数：bash # .env 文件 DASHBOARD_PORT=3000 DASHBOARD_HOST=localhost # ...
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation guidance says to use the skill for broad categories like system monitoring, log analysis, alerting, and deployment management. Such broad triggers can cause the agent to invoke this skill outside its intended scope, especially given that the skill exposes exec and write tools, increasing the chance of unsafe or irrelevant actions.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document first states that change operations are not supported in the free version, then later describes modifying and resetting behavior. In an agentic setting, inconsistent instructions are dangerous because the model may follow the more permissive path and execute destructive or configuration-altering commands.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill claims to be a free, read-only monitoring tool, but these sections explicitly advertise create/modify/reset/import/save/export operations. This contradiction can cause an agent with write/exec capabilities to perform unintended state-changing actions, breaking the user's expectation that the skill is non-destructive.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The capability coverage list is an overly broad keyword catch-all that can match many generic operations requests. This makes accidental or inappropriate auto-selection more likely, and in combination with exec/write access can route unrelated user requests into a more privileged operational context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill encourages scanning configuration and environment data but does not clearly warn that results may contain sensitive values, file paths, or partial secrets. In an LLM-agent workflow, surfaced scan output can be echoed into chat logs, tool transcripts, or downstream systems, creating inadvertent data exposure.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The display name, summary, and the rest of the skill instructions are presented in Chinese, and the file does not indicate that the skill is region-specific or provide an opt-in language choice. This can amount to a language policy issue when a skill effectively forces a specific language for all users.
- Content