Security audit

log-dive

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent read-only log search tool, but unsafe shell argument handling could let crafted inputs execute local commands, so it needs review before installation.

Install only after the maintainer fixes numeric validation for --since and --limit. Use least-privilege read-only backend credentials, prefer HTTPS for any authenticated backend, avoid production AWS profiles during testing, and treat all returned logs as sensitive.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (6)

T01 · Skill Instruction Hijacking

Note

Location: SKILL.md:272
Finding: Mandatory Promotional Footer Alters Agent Responses
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/log-dive-loki.sh:50
Finding: Command Execution Through Unvalidated Loki Duration
Content: View full analysis
Remediation: View remediation
365 )); then jq -n '{"error":"Duration exceeds the permitted maximum","exit_code":1}' exit 1 fi case "$unit" in s) local seconds=$((10#$num)) ;; m) local seconds=$((10#$num * 60)) ;; h) local seconds=$((10#$num * 3600)) ;; d) local seconds=$((10#$num * 86400)) ;; esac } ``` Also: - Apply validation in the top-level dispatcher before forwarding arguments. - Enforce a documented maximum duration. - Add regression tests using nonnumeric values and arithmetic-expression syntax. - Avoid relying on suffix removal as input validation. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/log-dive-cw.sh:50
Finding: Command Execution Through Unvalidated CloudWatch Duration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/log-dive-cw.sh:109
Finding: Command Execution Through Unvalidated CloudWatch Result Limit
Content: View full analysis
Remediation: View remediation
10000 )); then limit=10000 fi ``` Centralize this validation in a shared argument parser and add regression tests for negative values, decimals, whitespace, operators, array expressions, and command-substitution syntax. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/log-dive-loki.sh:17
Finding: Loki Credentials and Log Data May Be Transmitted Over Plaintext HTTP
Content: View full analysis
&1); then ``` ### Technical Analysis The URL validation permits both HTTPS and plaintext HTTP. When `LOKI_TOKEN` is configured, the script attaches it as a bearer token regardless of the selected scheme. The tenant identifier and returned log content are also exposed to the same unencrypted transport. HTTP provides neither confidentiality nor authenticated transport. A network observer can read credentials and log data, while an active intermediary can modify backend responses. Because logs may contain tokens, personal information, and internal infrastructure details, response confidentiality is as important as credential confidentiality. ### Attack Path 1. A user configures `LOKI_ADDR` with an `http://` URL and sets `LOKI_TOKEN`. 2. The script accepts the URL because HTTP is explicitly permitted. 3. The script sends the bearer token and tenant header over the plaintext connection. 4. A network observer or intermediary captures the headers and returned log entries. 5. The captured token may be reused against Loki within its granted scope. ### Impact Assessment An attacker positioned on the relevant network path may obtain the Loki bearer token, tenant identifier, search queries, and sensitive lo ...[truncated 298 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/log-dive-es.sh:17
Finding: Elasticsearch Credentials and Search Results May Be Transmitted Over Plaintext HTTP
Content: View full analysis
&1 else curl "${curl_args[@]}" "$url" 2>&1 fi ``` ### Technical Analysis The backend permits `http://` while attaching either Basic or Bearer authorization credentials to requests. Basic authentication merely encodes credentials and provides no confidentiality; bearer tokens are likewise exposed in full over plaintext HTTP. Search queries and Elasticsearch responses may contain sensitive log records, personal information, internal system details, and accidentally logged secrets. Plaintext transport exposes both request and response data to passive monitoring and allows active response tampering. ### Attack Path 1. A user configures `ELASTICSEARCH_URL` with an `http://` endpoint and supplies `ELASTICSEARCH_TOKEN`. 2. URL validation accepts the plaintext scheme. 3. The script sends the authorization header and search body without transport encryption. 4. A network observer captures the credentials and returned records. 5. ...[truncated 621 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a unified search skill spanning Loki, Elasticsearch, and CloudWatch with natural-language translation into LogQL, ES DSL, or CloudWatch filter patterns. The supplied code chunk is narrower: it is specifically a CloudWatch-only shell backend using AWS CLI commands such as describe-log-groups, describe-log-streams, and filter-log-events. It does remain read-only and does not modify or delete logs, so that part matches. However, the primary described capability of unified cross-backend search and natural-language translation is not evidenced here. Additionally, the code exposes related but undeclared capabilities for listing log groups/streams and tailing recent logs. Because the actual behavior is materially narrower and somewhat different from the declared purpose, this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: The code is consistent with the 'read-only' part of the description and does not modify or delete logs. However, the declared purpose describes a broader unified log-search capability spanning Loki, Elasticsearch, and CloudWatch with natural-language translation. This code chunk only implements Elasticsearch/OpenSearch operations. Its search path builds Elasticsearch queries directly, either wrapping user-provided JSON or converting plain text into a query_string query; that is not natural-language translation in the described sense. It also exposes index listing and cluster health retrieval, which are related but broader than log search. Therefore the description overstates and partially misrepresents what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The code is consistent with the read-only portion of the description: it queries Loki and lists/tails logs without modifying or deleting data. However, the declared purpose says the skill provides unified log search across Loki, Elasticsearch, and CloudWatch and translates natural language queries into LogQL, ES DSL, or CloudWatch filter patterns. This code chunk only supports Loki and expects an explicit query string; there is no evidence of Elasticsearch support, CloudWatch support, or natural-language translation. Additionally, it includes tail mode for live/recent log streaming, which is adjacent to log search but not clearly captured by the stated description. Therefore the description overstates the implemented capabilities in this supplied code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: The code is broadly related to unified log access across Loki, Elasticsearch, and CloudWatch, and it appears read-only, consistent with the non-destructive claim. However, the declared description emphasizes natural-language query translation, which is not present in this code chunk; the script requires a backend-specific --query and simply dispatches to per-backend scripts. Additionally, the script includes undeclared capabilities such as live tailing, backend detection/status reporting, and listing labels/indices/log groups. These are material behavior differences from the declared purpose, so this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The CloudWatch testing instructions encourage use of real AWS credentials and live log queries but do not warn that the commands may access production or sensitive log data, incur cloud costs, or expose private operational information in terminal output. In the context of a log-search skill, this is more dangerous because the feature is explicitly designed to retrieve potentially sensitive logs across environments.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: This Docker instruction pulls localstack/localstack without an explicit version tag or digest, which makes test execution non-reproducible and exposes users to supply-chain risk if the upstream image changes unexpectedly. In a testing guide, this can lead to silently running different code over time, including code with new vulnerabilities or malicious compromise of the tag.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/log-dive-es.sh (reported line 56)May include surrounding context.
sh
local url="${ELASTICSEARCH_URL%/}${path}" if [[ -n "$data" ]]; then curl "${curl_args[@]}" -d "$data" "$url" 2>&1 else curl "${curl_args[@]}" "$url" 2>&1 fi

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest frames the skill as a unified log search tool. The list_indices command enumerates available indices and returns health, status, document counts, and storage size, which is additional discovery/administration-oriented functionality beyond executing log searches.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest describes a read-only log search capability across backends, centered on translating natural-language queries into backend-specific search syntax. The cluster_health command queries Elasticsearch cluster status and node/shard metadata, which is operational infrastructure introspection rather than log search behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.