Cis Benchmark Audit

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:01 PM UTC
• Version: 1.0.0

Overview

This is a coherent read-only network compliance audit skill, but it can collect sensitive device configuration details without enough redaction or retention guidance.

Install only if the operators understand that read-only network audit output can still contain secrets and sensitive topology. Use least-privilege audit accounts, avoid storing raw command output in tickets or reports, redact hashes, community strings, keys, usernames where practical, and treat generated evidence as confidential.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/cli-reference.md:13

Finding

Security-Sensitive Configuration May Be Collected Without Redaction Controls

Content

View full analysis

Vulnerability Details

File Location: references/cli-reference.md:13-26 and references/cli-reference.md:115-121
Vulnerability Type: Insufficient minimization and protection of sensitive audit output
Risk Level: Medium

Complete Code Snippet

From references/cli-reference.md:13-26:

markdown

| Function | CLI Command |
|----------|-------------|
| AAA configuration status | `show running-config \| section aaa` |
| Authentication methods for login | `show running-config \| include aaa authentication` |
| Authorization configuration | `show running-config \| include aaa authorization` |
| Accounting configuration | `show running-config \| include aaa accounting` |
| VTY line access settings | `show running-config \| section line vty` |
| Console line settings | `show running-config \| section line con` |
| Auxiliary port status | `show running-config \| section line aux` |
| SSH version and settings | `show ip ssh` |
| SSH active sessions | `show ssh` |
| User accounts and privilege levels | `show running-config \| include username` |
| Enable secret hash type | `show running-config \| include enable` |
| SNMP community strings | `show snmp community` |
| SNMP group and security model | `show snmp group` |

From references/cli-reference.md:115-121:

markdown

| Login user accounts | `show configuration system login` |
| Root authentication settings | `show configuration system root-authentication` |
| SSH service configuration | `show configuration system services ssh` |
| SSH rate limit settings | `show configuration system services ssh rate-limit` |
| Telnet service status | `show configuration system services telnet` |
| RADIUS server configuration | `show configuration system radius-server` |
| TACACS+ server configuration | `show configuration system tacplus-server` |

Technical Analysis

The prescribed commands are read-only and relevant to a CIS comp ...[truncated 2402 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace broad configuration retrieval with narrowly scoped commands or device APIs that return compliance status without raw secret-bearing fields.
2. Redact SNMP community strings, password hashes, authentication keys, tokens, and other credentials before output enters agent context or persistent logs.
3. Collect usernames and infrastructure addresses only when required, and pseudonymize them in the final report where practical.
4. Explicitly prohibit raw credentials, hashes, keys, and community strings from appearing in generated compliance reports.
5. Use a dedicated least-privilege audit role that can inspect control state but cannot retrieve secret material where the platform supports field-level restrictions.
6. Encrypt retained evidence at rest and in transit, restrict access to authorized auditors, and maintain access logs.
7. Define a short evidence-retention period and securely delete raw command output after findings have been validated.
8. Add operator guidance requiring review and sanitization of command output before it is attached to tickets, reports, or external compliance systems.
9. Where broad output cannot be avoided, process it locally through an approved redaction filter before providing it to the agent.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/cli-reference.md (reported line 105)May include surrounding context.

md

| Function | CLI Command |
|----------|-------------|
| Full security policy (effective) | `show running security-policy` |
| Security policy hit counts | `show rule-hit-count vsys vsys1 security rules all` |
| Security Profile Groups | `show running profile-group` |
| Zone configuration and assignments | `show running zone` |
| Zone protection profiles | `show running zone-protection-profile` |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Many listed commands expose sensitive information such as usernames, SNMP communities, AAA configuration, authentication settings, policy details, and possibly password hash metadata. Presenting the list as a generic read-only audit reference without warnings about sensitive output increases the risk that an agent logs, stores, or displays confidential data insecurely during compliance assessment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file explicitly claims all listed commands are non-modifying and safe for production audit, but it includes a PAN-OS test security-policy-match ... command that is not a pure display command and may invoke active evaluation logic on the device. Even if it does not alter configuration, mislabeling interactive or evaluative commands as strictly read-only can cause operators or agents to run commands outside the intended safety boundary.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.