Security audit

运维看板(专业版)

Security checks for vulnerabilities and agentic risk

Overview

This Markdown-only operations dashboard skill is not plainly malicious, but it documents broad operational changes and secret-oriented scans that should be reviewed before use.

Install only if you intend to let an agent operate a real ops dashboard. Keep mutating, provider-audit, systemctl, and attachment-copy flags disabled by default; enable them only for a specific task with a trusted dashboard token, a narrow service/path allowlist, and human confirmation for session termination, restore, config/model changes, restarts, and scans of secret-bearing files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The documented output schema claims the skill returns code-review style scoring results, while the rest of the skill describes operational dashboard and infrastructure-control actions. This mismatch can mislead an agent or user about the skill’s true behavior, weakening informed consent and making risky operational actions appear like harmless analysis.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill explicitly supports loading provider API keys from a root-level keys.env file, which expands access to secrets beyond what is strictly necessary for a dashboard skill. Encouraging agents to read local secret files increases the chance of credential exposure, unintended propagation, or abuse of external provider accounts.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill advertises user-level systemctl restart control, which is a high-impact operational capability not inherent to passive dashboard monitoring. In an agent context with exec/write tools, this enables service interruption or operational tampering if invoked incorrectly or through prompt manipulation.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill includes local sensitive-data scanning over arbitrary paths such as ./config and ./.env, which materially broadens its reach from dashboarding into credential discovery. In a tool-enabled agent environment, this can be used to enumerate secrets and exfiltration targets under the guise of security scanning.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill documents bulk session archive and terminate operations without prominent warnings about data loss, business interruption, or the effect on active investigations and retained records. In an autonomous or semi-autonomous agent setting, this creates a real risk of destructive actions being executed as routine maintenance.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The documented backup restore, model switch, and config update operations can be disruptive or irreversible, yet the skill presents them as ordinary API calls without strong warnings or approval controls. This is dangerous because agents may perform environment-altering changes that impact availability, integrity, or recovery state.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The system service restart example exposes a disruptive action without direct warning that it can interrupt running workloads or temporarily take services offline. Given the skill also advertises exec capability, this materially raises the likelihood of accidental or coerced service disruption.

Credential Access

High

Category: Privilege Escalation
Content: -H "Content-Type: application/json" \ -d '{ "patterns": ["auth=", "API_CRED", "SENSITIVE", "PASSPHRASE", "COOKIE"], "paths": ["./config", "./.env"] }' \ http://localhost:3000/api/security/scan curl -H "Authorization: Bearer $DASHBOARD_AUTH" \
Confidence: 99% confidence
Finding: The scan example explicitly targets ./.env and looks for credential-like patterns such as auth, API_CRED, PASSPHRASE, and COOKIE. That is functionally credential discovery guidance, which is highly sensitive in an agent skill because it can facilitate collection of secrets unrelated to the dashboard’s core mission.

Static analysis

No suspicious patterns detected.