Arista Device Health

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:57 PM UTC
• Version: 0.1.1

Overview

This Arista health-check skill is mostly diagnostic, but its read-only label is contradicted by a device configuration command that can restart EOS agents.

Install only if you treat it as a diagnostic plus remediation guide, not a read-only health check. Do not allow an agent to run the EOS agent restart step automatically; require explicit operator approval, confirm the selected agent and blast radius, collect logs first, and use normal network change-control procedures.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:421

Finding

Read-Only Safety Declaration Contradicted by Privileged Agent Restart Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17 and SKILL.md:421-422
Vulnerability Type: Safety-boundary violation and unauthorized state-changing operation
Risk Level: Medium

Vulnerable Code

yaml

metadata:
  safety: read-only
  author: network-security-skills-suite
  version: "1.0.0"
  openclaw: '{"emoji":"🔍","safetyTier":"read-only","requires":{"bins":["ssh"],"env":[]},"tags":["arista","eos","health"],"mcpDependencies":[],"egressEndpoints":[]}'

text

4. If the agent is not running, attempt: `agent [name] shutdown` then
   `no agent [name] shutdown` in configuration mode (note: this is a config change)

Technical Analysis

The Skill explicitly declares both safety: read-only and safetyTier: read-only, but its recovery procedure instructs the operator or executing agent to enter EOS configuration mode and issue commands that modify device state.

The commands agent [name] shutdown and no agent [name] shutdown administratively stop and restart an EOS subsystem agent. They therefore require privileges beyond the stated privilege-1 diagnostic prerequisite and are not read-only operations. Restarting an agent can temporarily disable the protocol or subsystem it controls.

The placeholder [name] also permits selection of operationally critical agents such as BGP, STP, routing-information-base, bridging, or ASIC-management agents. Although the document acknowledges that the operation is a configuration change, this warning does not resolve the contradiction with the machine-readable safety metadata. An automation framework may trust that metadata when approving or executing the Skill.

No evidence of malicious intent, credential theft, persistence, external payload retrieval, or arbitrary command construction was found. The issue is a misrepresented privilege and operational safety boundary.

Attack Path

1. An automation platform or operator loads the Skill based on ...[truncated 1661 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the agent restart commands from this read-only health-check Skill. Limit the procedure to collecting agent state, logs, crash information, and escalation data.
2. Move all state-changing recovery operations into a separately classified remediation Skill whose metadata clearly indicates that configuration changes and service disruption are possible.
3. If restart guidance must remain, change the safety metadata so it no longer claims a read-only tier.
4. Require explicit human confirmation immediately before any restart, including the selected agent name and its affected subsystem.
5. Require validation of configuration authorization, a maintenance window, redundancy status, and an approved change record before execution.
6. Add agent-specific impact warnings and prohibit automated substitution of arbitrary or unvalidated agent names.
7. Collect logs and crash artifacts before restarting an agent so diagnostic evidence is preserved.
8. Add pre-change and post-change checks, including protocol-neighbor state, MLAG status, VXLAN/EVPN health, and traffic-impact verification.
9. Document a rollback and escalation procedure, including when the operator must stop and contact Arista TAC rather than restart the agent.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The metadata and documentation present the skill as read-only, which lowers operator suspicion and may cause automated systems to trust it for safe diagnostic use. Because the content later includes a configuration-changing recovery action, this mismatch creates a deceptive safety boundary that can lead to unauthorized or unexpected modifications on production switches.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is labeled and marketed as read-only, but it explicitly instructs the operator to restart an EOS agent via configuration mode using agent [name] shutdown followed by no agent [name] shutdown. That is an active state-changing action that can disrupt control-plane services, alter device behavior, and violate least-change expectations during a health-check workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The agent restart instruction appears in operational guidance without a strong inline warning that it is a configuration change and may temporarily disable a protocol or subsystem. In troubleshooting contexts, users or agents may follow this as a routine next step, causing avoidable service interruption or masking the root cause before evidence is collected.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.