Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent internet-outage diagnostic tool, but its monitor mode can execute any supplied shell command when the connection goes down, so it needs careful review before installation.
Install only if you are comfortable with a network diagnostic script that writes a local outage log and contacts public test endpoints. Avoid using --notify with arbitrary shell text; prefer running diagnose/report manually or replacing notification with a fixed, trusted notifier command you fully control.
The monitor feature includes a generic command-execution hook that is not necessary for diagnosing outages or building ISP evidence. Because it turns a connectivity monitor into a shell execution primitive triggered by network state changes, it creates a meaningful abuse path in environments where an agent may pass or transform parameters automatically.
This is a tool-parameter abuse issue because a normal-looking runtime parameter directly controls a shell execution sink. If an attacker can influence the notify string, they can escalate a benign outage-monitoring tool into arbitrary command execution, persistence, or data exfiltration on outage events.
print(f"{ts} {cur} ({v})")
if notify and cur == "DOWN":
try:
subprocess.run(notify, shell=True, timeout=15)
except Exception:
pass
state = cur
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# VERDICT: ISP (gateway ok, 100% loss to 1.1.1.1/8.8.8.8, DNS dead)
# actions: 1. check ISP status via mobile data 2. report once, get ticket
# 3. start monitor — this outage is now evidence 4. SLA credit accruing
python3 scripts/outage_warlord.py monitor --interval 120 --notify "curl -s -d 'NET DOWN' ntfy.sh/home >/dev/null"
# ...next day...
python3 scripts/outage_warlord.py report --sla-credit --contract "100Mbps, SLA 99.5%"
# OUTAGE WINDOWS (2): 16:02->16:49 [ISP] 18:02->18:50 [ISP]
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# VERDICT: ISP (gateway ok, 100% loss to 1.1.1.1/8.8.8.8, DNS dead)
# actions: 1. check ISP status via mobile data 2. report once, get ticket
# 3. start monitor — this outage is now evidence 4. SLA credit accruing
python3 scripts/outage_warlord.py monitor --interval 120 --notify "curl -s -d 'NET DOWN' ntfy.sh/home >/dev/null"
# ...next day...
python3 scripts/outage_warlord.py report --sla-credit --contract "100Mbps, SLA 99.5%"
# OUTAGE WINDOWS (2): 16:02->16:49 [ISP] 18:02->18:50 [ISP]
The skill describes capabilities that read and write local logs, invoke shell-based probes, and perform network diagnostics, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, that ambiguity can allow the skill to be executed with broader-than-necessary privileges, increasing the chance of unintended file access, arbitrary command execution, or uncontrolled network activity.
The listed triggers include very common phrases such as 'The internet is down', 'Wi‑Fi is down', and 'websites won't load', which are broad natural-language requests likely to occur in ordinary conversation. The file provides examples of when to use the skill, but it does not define explicit invocation boundaries or negative examples to prevent unintended activation.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
system = platform.system()
try:
if system == "Linux":
out = subprocess.run(["ip", "route", "show", "default"], capture_output=True, text=True, timeout=5).stdout
m = re.search(r"via (\d+\.\d+\.\d+\.\d+)", out)
return m.group(1) if m else None
if system == "Darwin":
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
m = re.search(r"via (\d+\.\d+\.\d+\.\d+)", out)
return m.group(1) if m else None
if system == "Darwin":
out = subprocess.run(["route", "-n", "get", "default"], capture_output=True, text=True, timeout=5).stdout
m = re.search(r"gateway: (\d+\.\d+\.\d+\.\d+)", out)
return m.group(1) if m else None
out = subprocess.run(["powershell", "-c", "(Find-NetRoute -RemoteIPAddress 1.1.1.1).NextHop[0]"],
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
out = subprocess.run(["route", "-n", "get", "default"], capture_output=True, text=True, timeout=5).stdout
m = re.search(r"gateway: (\d+\.\d+\.\d+\.\d+)", out)
return m.group(1) if m else None
out = subprocess.run(["powershell", "-c", "(Find-NetRoute -RemoteIPAddress 1.1.1.1).NextHop[0]"],
capture_output=True, text=True, timeout=10).stdout.strip()
return out or None
except Exception:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
tval = str(timeout * 1000) if system == "Windows" else str(timeout)
try:
cmd = ["ping", flag, str(count), tflag, tval, host]
out = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout * count + 5).stdout
ok = ("ttl=" in out.lower()) or ("time=" in out.lower()) or (", 0% loss" in out.lower()) or ("(0% loss)" in out.lower())
times = [float(x) for x in re.findall(r"time[=<]([\d.]+) ms", out)]
loss_m = re.search(r"(\d+)% (?:packet )?loss", out)
This code executes the user-supplied --notify value with shell=True whenever the monitor detects a DOWN event, allowing arbitrary shell command execution. In an agent or automation context, a crafted parameter can run any command with the privileges of the process, exceeding the skill's diagnostic scope.
print(f"{ts} {cur} ({v})")
if notify and cur == "DOWN":
try:
subprocess.run(notify, shell=True, timeout=15)
except Exception:
pass
state = cur
The CLI exposes --notify as an ordinary string parameter without clearly warning that it will be executed as a shell command. This increases the chance of unsafe use, accidental injection, or misuse by higher-level tooling that treats it as harmless configuration.
No suspicious patterns detected.