Security audit

Cisco Device Health

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a read-only Cisco health-check guide, but it includes device state-changing and potentially service-disrupting NX-OS commands despite declaring itself read-only.

Review before installing. Use this skill only for diagnostic collection unless your workflow blocks or requires explicit human approval for `switchto vdc`, `poweroff module`, and `no poweroff module`. Treat crash and core data as sensitive and follow your organization's handling and change-control process.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:330
Finding: State-Changing Module Power Commands Conflict with Read-Only Safety Classification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill includes guidance to power-cycle NX-OS modules using poweroff module [n] / no poweroff module [n], which is an explicitly disruptive administrative action. In a skill presented as health-check or triage guidance, including such commands without strong segregation or safeguards creates a real risk of service interruption if an agent or operator follows them directly.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is labeled read-only, but it explicitly instructs the operator to run switchto vdc [name], which changes operational context on the device. Even if this is not a configuration change, it is a state-changing action that can mislead an agent or user into taking actions outside the promised safety boundary and increase the chance of follow-on commands being executed in the wrong VDC.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill mixes VDC switching and module power-cycling guidance into troubleshooting sections without a prominent warning that these actions can change device state or interrupt service. Because the surrounding content is framed as routine health-check guidance, users or agents may treat these steps as safe defaults rather than elevated-risk operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill directs collection of crashinfo, core dumps, and exception logs but does not warn that these artifacts can contain sensitive operational details, memory contents, topology, credentials, or configuration fragments. In troubleshooting contexts these files are commonly exported or shared, so missing handling guidance increases the risk of inadvertent data exposure.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Line L004 states that all commands are "read-only (show/display only)," which narrowly describes show/display commands only. However, the reference later includes dir crashinfo: as part of crash-data inspection, which is still read-only but is not a show/display command, so the documentation actively overstates the exact command class used.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.