Security audit

Juniper Device Health

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Juniper health-check runbook, but it is labeled read-only while recommending device-changing and potentially disruptive remediation actions.

Review this as a runbook that mixes diagnostics with remediation. It should be installed only where operators understand that some recommended steps are not read-only, may require elevated JunOS privileges, may interrupt service, and may delete data useful for rollback, incident response, or vendor support.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:13
Finding: Read-Only Safety Classification Contradicted by Privileged and State-Changing Operations
Content: View full analysis
20/day | Persistent flapping | Hard bounce, replace, or disable until fixed | ``` ### Technical Analysis The skill advertises a `read-only` safety tier and states that all commands are read-only. However, several prescribed remediation actions alter device state or delete data: - `request system configuration rescue save` writes a persistent rescue configuration. - `request system storage cleanup` deletes logs, core dumps, and temporary files. - Removing old software images is destructive and may affect rollback or recovery capabilities. - Power cycling an FPC changes hardware state and can interrupt forwarding for interfaces on that line card. - Hard bouncing or disabling an interface changes operational state and can interrupt production traffic. These actions generally ...[truncated 2451 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The metadata advertises the skill as read-only while the body includes multiple write/remediation commands. This creates a trust-boundary failure: orchestrators, reviewers, or users may permit the skill under a low-risk policy even though it can trigger operational changes with service or evidence-preservation consequences.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The troubleshooting section recommends request system storage cleanup and selective file/image removal, which are state-changing and potentially destructive maintenance actions. In a skill presented as health-check triage, this can lead an automated agent or operator to delete logs, core dumps, or software artifacts that are operationally important for forensics, rollback, or vendor support.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is labeled read-only, but it instructs the operator to run request routing-engine login other-routing-engine, which changes session/device interaction state rather than only observing status. In an agent setting, this mismatch can cause automation to perform actions outside the declared safety boundary and normalize broader state-changing behavior in what should be a diagnostic-only skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The decision tree advises power-cycling an FPC, which is an intrusive remediation step that can disrupt traffic and alter device state. Including this in a diagnostic triage skill increases the risk that an agent exceeds a read-only or assessment-only mandate and causes avoidable service impact.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The procedure is framed as a structured health assessment but explicitly recommends request system configuration rescue save, which writes configuration state. Even though low-risk in many environments, it violates the claimed non-modifying scope and can cause policy or automation mismatches when the skill is treated as diagnostic-only.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill recommends cleanup and selective removal actions without explicit warning that logs, core dumps, and old images may be deleted and may be needed for incident response, vendor escalation, or rollback. Lack of safety framing makes accidental destructive action more likely, especially in automated or time-pressured troubleshooting contexts.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file explicitly claims all listed commands are read-only, but it includes a request command that is not a pure display operation. Even if request routing-engine login other-routing-engine is often used for diagnostics, it changes the operator session context and can normalize use of non-read-only commands in a supposedly safe reference, increasing the chance an agent or user executes unintended state-affecting actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: request routing-engine login other-routing-engine is an interactive/session-changing command and is out of place in a read-only health-check reference. In an agent skill, this is more dangerous because an automated system may treat the reference as safe to execute wholesale, causing unexpected context switching to the peer RE and undermining the guarantee that diagnostics remain passive and bounded.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.