Security audit
Security checks for vulnerabilities and agentic risk
This DevOps skill is coherent and not malicious, but it should be reviewed because it can expose sensitive local operational details and make user-directed network checks without strong warnings or guardrails.
Install only if you are comfortable with a DevOps helper that can read local logs, show process command lines, inspect Docker state, probe localhost ports, and make HTTP requests to URLs you provide. Treat its output as sensitive and avoid running diagnostics in shared transcripts or support channels unless reviewed/redacted.
devops.py:832Automatic Broad Environment Reconnaissance and Sensitive Diagnostic Disclosure
The skill advertises operational capabilities that inherently touch shell, files, environment data, and network resources, but the manifest declares no explicit tool scope or permission boundaries. In an agent setting, this can lead to over-broad execution authority, making it easier for the skill to read sensitive logs, inspect system state, probe services, or invoke shell-backed diagnostics beyond what a user may expect.
The helper executes shell commands with shell=True by default, which is dangerous in a CLI that later interpolates user-controlled values into command strings. Although some inputs are shell-quoted, the overall pattern creates command-injection risk and makes future call sites easy to misuse, especially where values like counts or file paths are inserted into shell pipelines.
def run(cmd, timeout=15, shell=True):
"""Run a shell command and return (returncode, stdout, stderr)."""
try:
result = subprocess.run(
cmd, shell=shell, capture_output=True, text=True, timeout=timeout
)
return result.returncode, result.stdout.strip(), result.stderr.strip()
The tool defaults to running full diagnostics when invoked without a subcommand, and that diagnostics routine prints host details, process information, open localhost ports, Docker state, and excerpts from common system logs. In an agentic context, automatic collection and display of this information can expose sensitive operational data to logs, transcripts, or downstream systems without an explicit user confirmation.
The health check performs arbitrary outbound HTTP requests to a user-supplied URL and reads part of the response body, which can be abused for SSRF-style access to internal services or metadata endpoints if an agent invokes it on untrusted input. Returning body content also increases the chance of leaking secrets or sensitive service responses into command output.
The markdown documents HTTP endpoint checks and port scanning commands, which can transmit requests to remote systems and probe local or remote services. There is no accompanying warning about ensuring authorization, possible logging on target systems, or the fact that these checks may affect privacy or system integrity expectations.