prom-query

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:54 PM UTC
• Version: 1.0.4

Overview

This Prometheus query skill is mostly coherent and read-only, but it can send a bearer token over plaintext HTTP if configured that way, so it needs user review before installation.

Install only if you are comfortable giving the agent read access to Prometheus metrics, alerts, targets, and rules. Use HTTPS whenever PROMETHEUS_TOKEN is set, keep tokens narrowly scoped and read-only, avoid putting production tokens on plain HTTP endpoints, and pin Docker image versions before following the optional local testing steps in sensitive environments.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/prom-query.sh:73

Finding

Bearer Token May Be Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: scripts/prom-query.sh, lines 73–80 and 119–126
Vulnerability Type: Authenticated plaintext network communication
Risk Level: Medium

Vulnerable Code

bash

# Validate scheme
case "$PROMETHEUS_URL" in
  http://*|https://*)
    ;;
  *)
    die "PROMETHEUS_URL must start with http:// or https:// (got: ${PROMETHEUS_URL})"
    ;;
esac

bash

if [[ -n "${PROMETHEUS_TOKEN:-}" ]]; then
  final_args+=(-H "Authorization: Bearer ${PROMETHEUS_TOKEN}")
fi

final_args+=("$@")
final_args+=("$url")

if ! response=$(curl "${final_args[@]}" 2>"$tmp"); then

Technical Analysis

The URL validation accepts both HTTPS and plaintext HTTP. Independently, the request builder adds PROMETHEUS_TOKEN as an HTTP Authorization: Bearer header whenever the environment variable is set. There is no check preventing a bearer token from being sent to an http:// endpoint.

When HTTP is used, neither the authorization header nor the Prometheus response has transport confidentiality or integrity. An attacker capable of observing or modifying traffic between the host and the configured server can capture the token, inspect sensitive monitoring information, or tamper with responses supplied to the agent.

The token is also included in curl's argument array. On systems where process arguments are visible to other local users or monitoring software, this may create an additional short-lived disclosure surface.

The network request itself is necessary for the Skill's declared functionality. However, allowing authenticated requests over plaintext HTTP is not necessary and falls short of least-privilege credential handling.

The static pre-scan reference in CHANGELOG.md is only documentation of bearer-token support; that file does not transmit data. The actual transmission occurs in this script.

Attack Path

1. An operator sets PROMETHEUS_URL to an http:// Prometheus-compatible endpoint.
2. The operator also supplies ...[truncated 1326 chars]

Remediation

View remediation

Remediation Suggestions

1. Require HTTPS whenever PROMETHEUS_TOKEN is set:

bash

if [[ -n "${PROMETHEUS_TOKEN:-}" && "$PROMETHEUS_URL" != https://* ]]; then
  die "HTTPS is required when PROMETHEUS_TOKEN is configured."
fi

2. If local plaintext access is operationally necessary, restrict it to explicit loopback addresses or require a clearly named opt-in such as PROMETHEUS_ALLOW_INSECURE_HTTP=1. Emit a prominent warning when this override is used.

3. Prefer secure local proxies or Unix-domain sockets rather than plaintext HTTP for local deployments.

4. Reduce local token exposure by avoiding sensitive headers in command-line arguments where practical. For example, provide curl configuration through a permission-restricted temporary file or another protected input mechanism, and ensure cleanup occurs on all exit paths.

5. Keep standard TLS certificate verification enabled. Do not add --insecure; document how operators should install the appropriate private certificate authority instead.

6. Add automated tests confirming that:

   • HTTP without a token behaves according to the documented policy.
   • HTTP with a token is rejected by default.
   • HTTPS with a token is accepted.
   • Any insecure override is explicit and produces a warning.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes a shell script tool (bash scripts/prom-query.sh) but does not declare any explicit tool scope such as permissions or allowed-tools. That weakens least-privilege enforcement and can let the runtime grant broader shell capability than the skill actually needs, increasing the blast radius if the script, its arguments, or surrounding execution environment are abused.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The testing instructions pull and run prom/prometheus:latest, which is an unpinned Docker image reference. Using latest makes builds and tests non-reproducible and creates a supply-chain risk: future image changes, regressions, or a compromised upstream image could be pulled automatically and executed during testing. In this skill context, the risk is real because the file explicitly instructs users to run the container locally.

Content

No source excerpt is available for this finding.