服务器监控

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:17 AM UTC
• Version: 1.0.0

Overview

This server monitoring skill is mostly purpose-aligned, but it includes recurring cron/heartbeat monitoring instructions without enough user-control, cleanup, or persistence disclosure.

Review before installing if you do not want agents creating recurring monitoring tasks. Only use scheduled checks after explicitly approving the exact cron or heartbeat change, where it runs, what it sends to notifications, and how to remove it later.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: SKILL.md:81

Finding

Persistent Recurring Monitoring Through Scheduled Tasks and Agent Heartbeat State

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 81-90
Vulnerability Type: Scheduled-task and cross-session persistence
Risk Level: High

Vulnerable Code

bash

*/15 * * * * /path/to/check.sh

The same section also directs the agent to add monitoring instructions to HEARTBEAT.md as an alternative persistence mechanism.

Technical Analysis

The skill instructs the agent to establish recurring monitoring through a cron entry or persistent heartbeat instructions. Both mechanisms can survive the interaction that initiated the skill and cause monitoring logic to execute in future sessions or at fixed intervals.

No explicit user-consent gate, expiration period, cleanup procedure, integrity validation for check.sh, or restriction on the commands that the scheduled script may execute is provided. The cron command therefore delegates recurring execution to a replaceable filesystem path. If another user or process can modify the referenced script, future scheduled invocations may execute altered commands under the privileges of the account that owns the cron entry.

Editing a crontab or HEARTBEAT.md also changes persistent system or agent state. This contradicts the skill's assertion that all of its commands are read-only.

Attack Path

1. A user invokes the server-monitoring skill or requests recurring resource checks.
2. The agent follows the scheduled-monitoring instructions and adds the displayed cron entry or writes monitoring instructions to HEARTBEAT.md.
3. The persistent mechanism remains active after the original interaction ends.
4. Cron or the heartbeat system repeatedly invokes the configured monitoring operation.
5. If /path/to/check.sh is subsequently replaced or modified, the scheduled task executes the modified content.
6. When notification integration is configured, collected hostname, process, load, storage, memory, and network telemetry may also be transmitted repeatedly through that channel.

Impa

...[truncated 637 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, informed user confirmation before creating any cron entry or modifying persistent heartbeat state.
• Display the exact proposed persistent changes, execution frequency, command path, privilege context, and removal procedure before applying them.
• Do not enable scheduled monitoring by default; prefer a one-time, read-only status check.
• Use an absolute, dedicated script path owned by the scheduled-task owner and not writable by untrusted users or groups.
• Validate script ownership and permissions before installation, and reject symbolic links or unexpectedly writable parent directories.
• Run the task under a dedicated least-privileged service account rather than a privileged or administrative account.
• Define a bounded lifetime or expiration mechanism for recurring monitoring.
• Provide explicit cleanup commands for removing the cron entry, monitoring script, and heartbeat instructions.
• Require separate consent before enabling any notification integration, and disclose exactly what telemetry will be transmitted and where.
• Update the documentation to clarify that installing cron entries or modifying HEARTBEAT.md is state-changing and is not read-only.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to match common, everyday requests such as checking how a system is doing, which can cause the skill to activate in contexts the user did not explicitly intend. In a skill that executes shell commands on a server, over-broad activation increases the chance of unintended command execution and disclosure of sensitive operational details like hostname, interface names, process lists, and resource usage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill is written entirely in Chinese and all example prompts and output strings are Chinese, with no indication that language choice is optional. This can violate language/locale policy when users have not opted into Chinese responses.

Content

No source excerpt is available for this finding.