agentic-devops

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:05 PM UTC
• Version: 1.0.2

Overview

This DevOps skill is coherent and not malicious, but it should be reviewed because it can expose sensitive local operational details and make user-directed network checks without strong warnings or guardrails.

Install only if you are comfortable with a DevOps helper that can read local logs, show process command lines, inspect Docker state, probe localhost ports, and make HTTP requests to URLs you provide. Treat its output as sensitive and avoid running diagnostics in shared transcripts or support channels unless reviewed/redacted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Note

• Location: devops.py:832
• Finding: Automatic Broad Environment Reconnaissance and Sensitive Diagnostic Disclosure<![CDATA[ ## Vulnerability Details **File Location**: `devops.py`, lines 832–1004 and 1099–1103 **Vulnerability Type**: Automatic environment reconnaissance and information disclosure **Risk Level**: Low ### Complete Code Snippet ```python def cmd_diag(_args): """Full system diagnostics — one command to see everything.""" w = min(term_width(), 80) now = datetime.now().strftime("%Y-%m-%d %H:%M:%S") hostname = platform.node() or "unknown" os_info = platform.platform() if docker_available(): rc, out, _ = run( "docker ps -a --format '{{.Names}}\t{{.Status}}'" ) common_ports = [ 22, 80, 443, 3000, 3306, 5432, 6379, 8080, 8443, 9090 ] port_results = [] for port in common_ports: try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(0.5) result = sock.connect_ex(("127.0.0.1", port)) sock.close() if result == 0: port_results.append((port, True)) except Exception: pass log_locations = [ "/var/log/syslog", "/var/log/messages", "/var/log/kern.log", "/var/log/auth.log", ] found_errors = False for log_path in log_locations: if not os.path.isfile(log_path): continue try: with open(log_path, "r", errors="replace") as f: lines = f.readlines() recent = lines[-500:] errors = [ line.rstrip() for line in recent if re.search( r"\b(error|critical|fatal|panic)\b", line, re.IGNORECASE, ) ] except PermissionError: continue rc, out, _ = run( "ps aux --sort=-%cpu 2>/dev/null | head -n 8" ) ``` ```python args = parser.parse_args() if args.command is None: # Default to diag ...[truncated 2449 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the implicit diagnostic behavior and require an explicit `diag` subcommand. 2. Display a clear summary of the information to be collected and require confirmation before broad diagnostics. 3. Divide diagnostics into opt-in flags such as `--system`, `--docker`, `--ports`, `--logs`, and `--processes`. 4. Redact potentially sensitive process arguments, usernames, container identifiers, IP addresses, tokens, and authentication-log fields. 5. Avoid printing raw log records by default; report only aggregate counts unless detailed output is explicitly requested. 6. Add a safe-output mode suitable for AI agents, CI systems, support tickets, and shared terminals. 7. Apply strict output-size limits and document that diagnostic output may contain sensitive operational data. 8. Ensure captured reports are stored with restrictive permissions and are not automatically transmitted or retained. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises operational capabilities that inherently touch shell, files, environment data, and network resources, but the manifest declares no explicit tool scope or permission boundaries. In an agent setting, this can lead to over-broad execution authority, making it easier for the skill to read sensitive logs, inspect system state, probe services, or invoke shell-backed diagnostics beyond what a user may expect.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run(cmd, timeout=15, shell=True):
    """Run a shell command and return (returncode, stdout, stderr)."""
    try:
        result = subprocess.run(
            cmd, shell=shell, capture_output=True, text=True, timeout=timeout
        )
        return result.returncode, result.stdout.strip(), result.stderr.strip()

• Confidence: 94% confidence
• Finding: The helper executes shell commands with shell=True by default, which is dangerous in a CLI that later interpolates user-controlled values into command strings. Although some inputs are shell-quoted, the overall pattern creates command-injection risk and makes future call sites easy to misuse, especially where values like counts or file paths are inserted into shell pipelines.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The tool defaults to running full diagnostics when invoked without a subcommand, and that diagnostics routine prints host details, process information, open localhost ports, Docker state, and excerpts from common system logs. In an agentic context, automatic collection and display of this information can expose sensitive operational data to logs, transcripts, or downstream systems without an explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The health check performs arbitrary outbound HTTP requests to a user-supplied URL and reads part of the response body, which can be abused for SSRF-style access to internal services or metadata endpoints if an agent invokes it on untrusted input. Returning body content also increases the chance of leaking secrets or sensitive service responses into command output.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The markdown documents HTTP endpoint checks and port scanning commands, which can transmit requests to remote systems and probe local or remote services. There is no accompanying warning about ensuring authorization, possible logging on target systems, or the fact that these checks may affect privacy or system integrity expectations.