sre-operator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:37 AM UTC
• Version: 0.0.1

Overview

This server-operations skill is mostly coherent, but some troubleshooting recipes present high-impact system changes as direct commands without enough local safeguards.

Review before installing if you expect the agent to operate on production systems. Keep it to read-only diagnostics by default, require explicit approval for every state-changing command, and do not run the troubleshooting-guide remediation snippets until paths, services, backups, rollback steps, and environment-specific managers such as firewall and DNS tooling have been verified.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: references/troubleshooting-guide.md:102

Finding

Unsafe Privileged Remediation Commands Can Cause Destructive System Changes

Content

View full analysis

Vulnerability Details

File Location: references/troubleshooting-guide.md, lines 102, 219, 223, 268, 319, 371, 648, and 665
Vulnerability Type: Unsafe privileged system-administration guidance
Risk Level: High

Vulnerable Code

bash

# Lines 102, 319, and 648
sync; echo 3 > /proc/sys/vm/drop_caches

bash

# Line 219
iptables -A INPUT -p tcp --dport port -j ACCEPT

bash

# Line 223
echo "nameserver 8.8.8.8" > /etc/resolv.conf

bash

# Line 268
find /tmp -type f -mtime +7 -delete

bash

# Line 371
fsck /dev/sda1

bash

# Line 665
echo -1000 > /proc/$(pidof mysql)/oom_score_adj

Technical Analysis

The troubleshooting guide presents commands that directly alter kernel state, firewall policy, DNS configuration, filesystem contents, filesystem metadata, and Out-of-Memory Killer behavior. These operations generally require root or equivalent administrative privileges.

Although the Skill contains general safety principles elsewhere, the affected recipes do not place immediate safeguards around these commands. In particular:

• Dropping kernel caches can produce substantial I/O load and performance disruption without resolving the underlying memory problem.
• Appending an unrestricted firewall acceptance rule can expose a service on every applicable interface and source network.
• Overwriting /etc/resolv.conf destroys the existing DNS configuration and may conflict with NetworkManager, systemd-resolved, DHCP, or local resolver settings.
• Deleting every regular file in /tmp older than seven days can remove files still required by applications or users.
• Running fsck against a mounted or active filesystem can cause corruption or data loss.
• Assigning MySQL an OOM adjustment of -1000 makes it effectively exempt from OOM termination, potentially causing the kernel to terminate other critical processes or destabilize the h ...[truncated 2018 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, command-specific user authorization immediately before every state-changing or privileged operation.
2. Separate diagnosis from remediation. Default to read-only commands and provide proposed changes for review rather than executing them automatically.
3. Replace cache-dropping advice with root-cause analysis using free, vmstat, sar, pressure-stall information, process memory metrics, and application-specific profiling.
4. Before changing firewall policy:
   • Identify the required interface, source CIDR, protocol, and destination port.
   • Display the current ruleset.
   • Prefer a narrowly scoped rule.
   • Define and test a rollback command.
   • Confirm that the change will not expose the service publicly.
5. Never overwrite /etc/resolv.conf directly without detecting its manager. Back up the existing configuration and modify NetworkManager, systemd-resolved, DHCP, or the platform-specific resolver configuration through its supported interface.
6. Replace direct temporary-file deletion with a preview:

   bash

   find /tmp -xdev -type f -mtime +7 -print
   

   Review ownership and active use before removal, and prefer the operating system's temporary-file management mechanism.
7. Before fsck, identify the filesystem and backing device, verify backups, confirm it is unmounted, enter an appropriate maintenance environment, and use non-modifying inspection mode first where supported.
8. Do not set oom_score_adj to -1000 as a generic fix. Correct the memory shortage, apply service-level memory limits, and document the consequences of any OOM policy adjustment.
9. Add local warnings, prerequisite checks, expected effects, verification steps, and tested rollback instructions next to every high-impact command instead of relying only on general safety text elsewhere in the Skill.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

声明描述的是较完整的服务器运维辅助能力，涵盖安全检查、命令验证、故障排查和日志分析等多类运维流程；但代码仅执行基础系统信息采集与格式化输出，不包含安全审计、命令校验、日志读取/分析、性能优化建议或故障诊断逻辑。虽然“系统识别”与部分运维诊断场景相关，但整体主用途明显比声明狭窄，属于描述与实际行为不一致。

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/linux-commands.md (reported line 275)May include surrounding context.

• 示例：

  bash

  rm file.txt  # 删除文件
  rm -r directory/  # 删除目录（会提示）
  rm -rf directory/  # 强制递归删除（极度危险）
  

• 风险提示：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/linux-commands.md (reported line 276)May include surrounding context.

bash

  rm file.txt  # 删除文件
  rm -r directory/  # 删除目录（会提示）
  rm -rf directory/  # 强制递归删除（极度危险）

• 风险提示：
  • ⚠️ rm -rf 是最危险的命令之一

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/linux-commands.md (reported line 280)May include surrounding context.

text

- **风险提示**：
  - ⚠️ `rm -rf` 是最危险的命令之一
  - ⚠️ 永远不要使用 `rm -rf /`
  - ⚠️ 删除前先确认路径和文件
  - ⚠️ 建议使用 `rm -i` 交互模式
  - ⚠️ 重要文件删除前先备份

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/safety-checklist.md (reported line 84)May include surrounding context.

md

- `mkfs` - 创建文件系统
- `fdisk/parted` - 磁盘分区
- `iptables -F` - 清空防火墙规则
- `chmod 777` - 设置权限为完全开放
- `chown -R` - 递归修改所有者

**⚠️ 中风险命令**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/linux-commands.md (reported line 280)May include surrounding context.

text

- [ ] 使用 `echo` 预览完整命令
  ```bash
  echo "rm -rf /path/to/directory"

• 使用 -n 参数（如 rsync、make）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/safety-checklist.md (reported line 137)May include surrounding context.

text

- [ ] 使用 `echo` 预览完整命令
  ```bash
  echo "rm -rf /path/to/directory"

• 使用 -n 参数（如 rsync、make）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/safety-checklist.md (reported line 137)May include surrounding context.

text

- [ ] 使用 `echo` 预览完整命令
  ```bash
  echo "rm -rf /path/to/directory"

• 使用 -n 参数（如 rsync、make）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/safety-checklist.md (reported line 137)May include surrounding context.

text

- [ ] 使用 `echo` 预览完整命令
  ```bash
  echo "rm -rf /path/to/directory"

• 使用 -n 参数（如 rsync、make）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/safety-checklist.md (reported line 364)May include surrounding context.

执行命令

bash

# 使用交互模式
rm -i /path/to/file

# 或先移动到临时目录
mv /path/to/file /tmp/deleted_$(date +%Y%m%d_%H%M%S)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide recommends overwriting critical network configuration (for example replacing /etc/resolv.conf) and modifying firewall rules with direct commands, without strong warnings about persistence, environment differences, or lockout risk. In the context of an operational agent skill, these instructions are more dangerous because they can break connectivity, bypass change controls, or weaken host/network security if followed verbatim.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section contains irreversible cleanup commands such as truncating logs and deleting files from /tmp, but it does not provide prominent safeguards around data retention, forensic value, service impact, or path validation. In a troubleshooting skill, operators may execute these commands during incidents, which can destroy evidence, remove needed data, or interrupt running services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill name and all user-facing instructions are presented only in Chinese, indicating a language-specific experience, but the file does not state that this is optional or limited to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation condition says the skill applies when the user requests server maintenance, system diagnosis, performance optimization, fault repair, or routine operations, which is a very wide scope with no exclusion conditions or explicit trigger phrases. This makes it unclear when the skill should activate versus when a more specialized skill should handle the request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The title and all instructional content are presented only in Chinese, which can amount to a language-policy violation when users are not given an opt-in or alternative locale. The file does not state that it is intended only for a Chinese-speaking or region-specific audience, nor does it provide a language selection mechanism.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/linux-commands.md (reported line 129)May include surrounding context.

systemctl start service_name # 启动服务 systemctl stop service_name # 停止服务 systemctl restart service_name # 重启服务 systemctl enable service_name # 开机自启 systemctl disable service_name # 禁用开机自启

text

- **示例**：

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/linux-commands.md (reported line 417)May include surrounding context.

• 只读命令：

  bash

  systemctl status service_name  # 查看状态（安全）
  systemctl is-enabled service_name  # 检查是否启用（安全）
  systemctl list-units --type=service  # 列出所有服务（安全）
  

• 风险提示：

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

标题及全文内容均以中文编写，未说明这是区域性/本地化限定文档，也未提供语言选择或用户选择加入的机制。根据规则，强制特定语言而没有明确的用户选择或合理限定，属于自然语言层面的语言/区域策略违规。

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/safety-checklist.md (reported line 84)May include surrounding context.

md

- `mkfs` - 创建文件系统
- `fdisk/parted` - 磁盘分区
- `iptables -F` - 清空防火墙规则
- `chmod 777` - 设置权限为完全开放
- `chown -R` - 递归修改所有者

**⚠️ 中风险命令**

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/safety-checklist.md (reported line 93)May include surrounding context.

md

- `apt/yum upgrade` - 升级软件包
- `reboot/shutdown` - 重启/关机
- `mount/umount` - 挂载/卸载文件系统
- `crontab -e` - 编辑定时任务

**✅ 低风险命令（只读）**
- `cat`, `less`, `more` - 查看文件

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This section includes state-changing remediation commands such as killing processes and writing to /proc/sys/vm/drop_caches, but the guide does not prominently warn about privilege requirements, operational impact, or rollback considerations. In an agent skill for server operations, such commands may be surfaced or copied into production environments, increasing the chance of accidental service disruption or loss of diagnostic state.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/troubleshooting-guide.md (reported line 158)May include surrounding context.

md

# 权限问题
修改权限：chown -R user:group /path
chmod 644 /path/to/config

# 依赖服务未启动
systemctl start dependent_service

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The header comments explicitly characterize the script as using only read-only operations with no destructive side effects. In practice, lines L291-L293 write the generated report to a file path supplied by the caller, which contradicts the documented '只读操作' claim.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script gathers system inventory details such as OS version, kernel, CPU, memory, disks, load, and process count, and can persist them to disk without clearly warning users about the sensitivity of that data. In an ops skill context this is expected functionality, but the lack of disclosure and minimization can still expose environmental details useful for fingerprinting or later attacks if the report is shared or stored insecurely.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The help text and header describe the script as safely collecting basic system information for diagnostics, emphasizing read-only and non-destructive behavior. However, the --output option and file redirection later in the script persist the data to a user-specified file, which is a write side effect beyond purely read-only collection.

Content

No source excerpt is available for this finding.