Doc Sysadmin

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:27 AM UTC
• Version: 1.0.0

Overview

This Ubuntu maintenance skill is mostly aligned with system cleanup, but it grants elevated authority and includes broad destructive cleanup commands that can delete shared temporary data and remove packages without clear confirmation.

Review this skill carefully before installing. It should be treated as capable of changing the host system, not just reporting status: the included cleanup script can remove packages, wipe shared temporary directories, vacuum logs, and change kernel cache state. Only use it after narrowing cleanup commands, adding dry-run output and explicit confirmations, and separating read-only diagnostics from privileged remediation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/cleanup.sh:16
• Finding: Indiscriminate deletion of shared temporary files## Vulnerability Details **File Location**: `scripts/cleanup.sh:16-18` **Vulnerability Type**: Unsafe recursive file deletion **Risk Level**: High **Complete Code Snippet**: ```bash # 3. Temp Files rm -rf /tmp/* /var/tmp/* echo "Temp files cleared" ``` ### Technical Analysis The script recursively and forcibly deletes all visible entries under `/tmp` and `/var/tmp` without checking file age, ownership, type, mount boundaries, or whether an entry is actively used. These directories are shared by applications, users, and system services and can contain sockets, lock files, session state, staged data, and active working files. This implementation contradicts the documented policy in `SKILL.md`, which describes deleting only old `.tmp` files and provides an age-filtered example. Glob expansion also omits hidden entries, so the operation is simultaneously destructive and incomplete. Although this issue does not provide an attacker with additional privileges by itself, elevated execution substantially increases the affected scope. A user or process can trigger loss of temporary data belonging to other users and root-owned services. ### Attack Path 1. A user invokes the skill believing it will perform the documented safe cleanup. 2. The cleanup script runs with root privileges or through the skill's elevated execution setting. 3. Shell glob expansion resolves every visible entry immediately below `/tmp` and `/var/tmp`. 4. `rm -rf` recursively removes those entries without age, ownership, or active-use validation. 5. Applications and services using the deleted files may lose data, malfunction, or enter an inconsistent state. ### Impact Assessment When run as root, the command can delete temporary data owned by every local user and system service. Potential consequences include application failures, destroyed session or working data, removal of lock files or sockets, interrupted installations, and system instability. Th ...[truncated 143 chars]
• Remediation: ## Remediation Suggestions - Prefer the operating system's temporary-file lifecycle manager, such as `systemd-tmpfiles --clean`. - If custom cleanup is required, restrict it to old regular files and prevent traversal across filesystems: ```bash find /tmp /var/tmp -xdev -type f -atime +7 -print ``` - Present the resulting file list and obtain explicit confirmation before replacing `-print` with `-delete`. - Do not remove sockets, device files, directories, or actively used files through a blanket recursive command. - Run cleanup with the minimum required privileges and separate per-user cleanup from system-wide cleanup. - Update the implementation to match the restrictions documented in `SKILL.md`.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cleanup.sh:10
• Finding: Unattended removal of installed packages## Vulnerability Details **File Location**: `scripts/cleanup.sh:10-13` **Vulnerability Type**: Unconfirmed destructive package management **Risk Level**: Medium **Complete Code Snippet**: ```bash # 2. Apt Clean apt autoremove -y apt autoclean apt clean ``` ### Technical Analysis `apt autoremove -y` automatically approves removal of packages classified by APT as no longer required. Automatically installed packages can still be operationally important to applications, scripts, drivers, or manually managed workloads. The `-y` option prevents users from reviewing and rejecting the proposed transaction. This exceeds the cache-cleaning behavior described elsewhere in the skill and conflicts with its stated requirement to obtain confirmation before destructive operations. `apt autoclean` and `apt clean` remove cached package files, while `apt autoremove` changes the installed software set and therefore has materially different consequences. ### Attack Path 1. A user requests routine disk or cache cleanup. 2. The script executes in an elevated context. 3. APT identifies automatically installed packages as removable. 4. The `-y` option approves the removal without presenting an interactive confirmation. 5. Applications or workloads that still rely on those packages can stop functioning. ### Impact Assessment The operation can remove system-wide packages when executed as root. It does not inherently allow an attacker to obtain new privileges, but it can impair applications, drivers, runtime environments, and services. Recovery may require package reinstallation and reconfiguration, resulting in availability loss and administrative overhead.
• Remediation: ## Remediation Suggestions - Remove `apt autoremove -y` from routine cache cleanup. - Limit unattended cache cleanup to `apt autoclean` or `apt clean` when that behavior has been authorized. - Before package removal, run: ```bash apt autoremove --dry-run ``` - Display the complete package-removal plan and obtain explicit user approval. - Execute the approved removal as a separate, clearly labeled operation. - Record the package list before removal to support recovery. - Do not use automatic approval flags for package removal unless a separately reviewed policy explicitly permits the exact transaction.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:3
• Finding: Global elevated execution violates least privilege## Vulnerability Details **File Location**: `SKILL.md:3-7` and supporting rule at `SKILL.md:98` **Vulnerability Type**: Excessive privilege configuration **Risk Level**: Medium **Complete Code Snippet**: ```yaml metadata: model: "grok-4-1-fast" elevated: true ``` The document reinforces this setting at line 98: ```markdown 1. **elevated: true** - Pode usar sudo quando necessário ``` ### Technical Analysis The skill globally requests elevated execution even though most documented health checks—such as `df`, `free`, `uptime`, and `ps`—are read-only and ordinarily do not require root access. This violates least-privilege principles by placing routine operations and destructive maintenance actions in the same broad privilege context. The configuration does not demonstrate a conventional privilege-escalation exploit that bypasses authentication. Instead, it unnecessarily authorizes system-level execution for the entire skill, amplifying defects such as the unrestricted deletion in `scripts/cleanup.sh:17` and unattended package removal at `scripts/cleanup.sh:11`. ### Attack Path 1. The skill is loaded with `elevated: true`. 2. A user invokes a routine health-check or cleanup workflow. 3. Commands execute with broader permissions than most of the workflow requires. 4. The destructive temporary-file and package-management commands affect system-wide resources. 5. Any future command-injection or path-handling defect introduced into the skill would likewise inherit the elevated context. ### Impact Assessment Elevated execution allows commands to modify files and package state across the host rather than being confined to the invoking user's resources. In the current implementation, this broadens temporary-file deletion to data owned by other users and services, permits system-wide package removal, enables journal deletion, and permits modification of kernel cache controls. No evidence was found that the skill ...[truncated 82 chars]
• Remediation: ## Remediation Suggestions - Remove the global `elevated: true` setting. - Execute disk, memory, process, load, and service-status checks without elevation. - Request elevation only for the individual command that demonstrably requires it. - Require explicit confirmation immediately before every system-wide destructive operation. - Split read-only diagnostics and mutating cleanup into separate scripts or execution profiles. - If automation is required, use a narrowly scoped `sudoers` policy that permits only reviewed commands with constrained arguments. - Avoid granting unrestricted shell or arbitrary-command execution through the privileged policy.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The skill claims only '.tmp' files in /tmp older than 7 days are safe to delete, but the actual cleanup command later uses a broad 'find /tmp -type f -atime +7 -delete' pattern that can remove arbitrary files in /tmp regardless of extension or ownership. In a host-maintenance skill with elevated privileges, this mismatch is dangerous because it can cause destructive data loss or break running applications that legitimately store temporary state in /tmp.

Chaining Abuse

High

• Category: Tool Misuse

Content

### 3. Otimização RAM
```bash
# Sync e drop caches (seguro)
sync && echo 3 | sudo tee /proc/sys/vm/drop_caches

# Verificar swap usage
free -h | grep Swap

• Confidence: 92% confidence
• Finding: The pipeline 'echo 3 | sudo tee /proc/sys/vm/drop_caches' chains unprivileged input into a privileged write, which is a known risky pattern because it makes it easy to transform simple text output into root-authorized state changes. In this skill, the command modifies kernel memory-management behavior and is presented as routine, increasing the chance of unsafe privileged execution.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
#!/bin/bash
echo "Limpando lixeira..."
rm -rf ~/.local/share/Trash/files/* 2>/dev/null
rm -rf ~/.local/share/Trash/info/* 2>/dev/null

echo "Limpando /tmp antigos..."

• Confidence: 90% confidence
• Finding: The full matched command includes stderr suppression, which further reduces operator visibility into what was removed or whether the path was correct. Suppressing errors around recursive deletion is unsafe in a system-maintenance context because it hides failures and can mask unexpected behavior.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
#!/bin/bash
echo "Limpando lixeira..."
rm -rf ~/.local/share/Trash/files/* 2>/dev/null
rm -rf ~/.local/share/Trash/info/* 2>/dev/null

echo "Limpando /tmp antigos..."

• Confidence: 85% confidence
• Finding: The full matched command includes stderr suppression, which further reduces operator visibility into what was removed or whether the path was correct. Suppressing errors around recursive deletion is unsafe in a system-maintenance context because it hides failures and can mask unexpected behavior.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
#!/bin/bash
echo "Limpando lixeira..."
rm -rf ~/.local/share/Trash/files/* 2>/dev/null
rm -rf ~/.local/share/Trash/info/* 2>/dev/null

echo "Limpando /tmp antigos..."

• Confidence: 90% confidence
• Finding: The full matched command includes stderr suppression, which further reduces operator visibility into what was removed or whether the path was correct. Suppressing errors around recursive deletion is unsafe in a system-maintenance context because it hides failures and can mask unexpected behavior.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#!/bin/bash
echo "Limpando lixeira..."
rm -rf ~/.local/share/Trash/files/* 2>/dev/null
rm -rf ~/.local/share/Trash/info/* 2>/dev/null

echo "Limpando /tmp antigos..."
find /tmp -type f -atime +7 -delete 2>/dev/null

• Confidence: 90% confidence
• Finding: As with the previous deletion command, recursive forced removal plus hidden errors creates poor observability and weak safety controls. In a skill designed to act on the host system, this pattern is risky because it encourages silent destructive execution without operator awareness.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#!/bin/bash
echo "Limpando lixeira..."
rm -rf ~/.local/share/Trash/files/* 2>/dev/null
rm -rf ~/.local/share/Trash/info/* 2>/dev/null

echo "Limpando /tmp antigos..."
find /tmp -type f -atime +7 -delete 2>/dev/null

• Confidence: 85% confidence
• Finding: As with the previous deletion command, recursive forced removal plus hidden errors creates poor observability and weak safety controls. In a skill designed to act on the host system, this pattern is risky because it encourages silent destructive execution without operator awareness.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#!/bin/bash
echo "Limpando lixeira..."
rm -rf ~/.local/share/Trash/files/* 2>/dev/null
rm -rf ~/.local/share/Trash/info/* 2>/dev/null

echo "Limpando /tmp antigos..."
find /tmp -type f -atime +7 -delete 2>/dev/null

• Confidence: 90% confidence
• Finding: As with the previous deletion command, recursive forced removal plus hidden errors creates poor observability and weak safety controls. In a skill designed to act on the host system, this pattern is risky because it encourages silent destructive execution without operator awareness.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "Apt cleaned"

# 3. Temp Files
rm -rf /tmp/* /var/tmp/*
echo "Temp files cleared"

# 4. Logs

• Confidence: 100% confidence
• Finding: The combined command 'rm -rf /tmp/* /var/tmp/*' amplifies the risk by wiping two system-wide temporary areas in one step, again without checks or confirmation. In the context of a host-maintenance skill for Ubuntu that may be used for routine or automatic cleanup, this is more dangerous because /var/tmp is intended for longer-lived temporary files and deleting it wholesale can break applications or erase recoverable work.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "Apt cleaned"

# 3. Temp Files
rm -rf /tmp/* /var/tmp/*
echo "Temp files cleared"

# 4. Logs

• Confidence: 95% confidence
• Finding: The combined command 'rm -rf /tmp/* /var/tmp/*' amplifies the risk by wiping two system-wide temporary areas in one step, again without checks or confirmation. In the context of a host-maintenance skill for Ubuntu that may be used for routine or automatic cleanup, this is more dangerous because /var/tmp is intended for longer-lived temporary files and deleting it wholesale can break applications or erase recoverable work.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "Apt cleaned"

# 3. Temp Files
rm -rf /tmp/* /var/tmp/*
echo "Temp files cleared"

# 4. Logs

• Confidence: 100% confidence
• Finding: The combined command 'rm -rf /tmp/* /var/tmp/*' amplifies the risk by wiping two system-wide temporary areas in one step, again without checks or confirmation. In the context of a host-maintenance skill for Ubuntu that may be used for routine or automatic cleanup, this is more dangerous because /var/tmp is intended for longer-lived temporary files and deleting it wholesale can break applications or erase recoverable work.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: A frase "Use when" inclui condições muito abrangentes como "verificação de saúde do sistema", "resolver lentidão" e especialmente "checagem periódica automática", sem definir contexto, limites ou exemplos negativos. Esses gatilhos podem colidir com pedidos cotidianos de suporte e causar invocação não intencional do skill.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill describes dropping kernel caches as 'seguro' and includes a privileged write to /proc/sys/vm/drop_caches without an explicit warning about performance side effects, privilege requirements, or when it should not be used. In a sysadmin skill marked elevated, presenting this as routine optimization can normalize unnecessary privileged actions and lead to service disruption or misleading troubleshooting outcomes.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 3. Otimização RAM
```bash
# Sync e drop caches (seguro)
sync && echo 3 | sudo tee /proc/sys/vm/drop_caches

# Verificar swap usage
free -h | grep Swap

• Confidence: 91% confidence
• Finding: This command performs a privileged write via sudo to a kernel control interface, which increases the blast radius of mistakes and bypasses normal user-level safety boundaries. In an elevated maintenance skill, normalizing sudo-based actions without strict gating, validation, and warnings makes accidental harmful execution more likely.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

find /tmp -type f -atime +7 -delete 2>/dev/null

echo "Limpando cache apt..."
sudo apt-get autoclean

echo "Done."
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## Regras

1. **elevated: true** - Pode usar sudo quando necessário
2. **Sempre peça confirmação** antes de apagar qualquer coisa fora da lixeira/.tmp
3. **Relatório claro** - Mostre antes/depois dos números
4. **Proativo** - Alerte quando disco < 10% ou RAM > 90%

• Confidence: 88% confidence
• Finding: Declaring 'elevated: true' and explicitly authorizing sudo when necessary broadens the skill's operational authority and lowers friction for privileged execution. In a host-maintenance skill containing deletion and kernel-tuning commands, this context materially increases the risk of destructive actions being carried out on the host system.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The command `sync; echo 3 > /proc/sys/vm/drop_caches` is a privileged, state-altering operation that modifies kernel cache behavior and is presented as a routine performance command without any warning, prerequisites, or explanation of tradeoffs. In a sysadmin skill focused on automated health checks and cleanup, this is more dangerous because an agent or user may treat it as safe maintenance and run it unnecessarily, causing temporary performance degradation, masking root-cause analysis, or disrupting active workloads.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script performs multiple destructive system-maintenance actions immediately, including package removal, deletion of temporary files, log vacuuming, and cache dropping, without any confirmation, dry-run mode, or safeguards. In a sysadmin skill that may be invoked automatically, this increases the risk of accidental data loss, service disruption, or removal of artifacts needed by users or running applications.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: A descrição e as instruções do skill estão integralmente em português e não oferecem alternativa de idioma nem indicam que a escolha depende da preferência do usuário. Isso configura uma restrição de idioma não opcional em linguagem natural.

Static analysis

No suspicious patterns detected.