endpoint-aiops

• Outcome: Review
• Latest audit: Aug 10, 2026 · 7:04 AM UTC
• Version: 0.9.0

Overview

The skill is coherently aimed at endpoint fleet management, but it exposes disruptive reboot and profile-change actions without a built-in read-only or approval gate for agent/MCP use.

Install only with least-privileged, preferably read-only endpoint-management credentials until you have external approval/RBAC controls in place. Treat ~/.endpoint-aiops/secrets.enc and ENDPOINT_AIOPS_MASTER_PASSWORD as highly sensitive, especially for igel-ums administrator passwords, and do not expose MCP write tools to an agent unless reboots and profile changes are separately approved and scoped.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The skill markets a bundled 'governance harness' with audit, policy, budgets, and risk tiers, but later clarifies that it does not actually enforce write authorization or approvals. This mismatch can cause an agent or operator to overtrust the skill's safety controls and execute state-changing actions under the false assumption that policy gating exists.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The manifest says state-changing operations require double confirmation, but the body later limits that guarantee to the CLI path. In MCP/agent usage, this can create a false expectation that destructive actions like reboot or profile assignment always get an interactive confirmation step when they may not.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This documentation explicitly states that write authorization is not enforced by the tool itself and that there is no read-only mode or approval gate. For a skill that exposes endpoint reboot and profile-assignment actions, relying only on external account scoping or prompt discipline creates a real safety gap: a misconfigured account, overprivileged token, or prompt-injected agent can perform destructive writes without an in-tool guard.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The file presents the harness as enforcing guardrails, but then narrows that claim by excluding write authorization from enforcement. This mismatch can mislead operators into assuming stronger protections than actually exist, increasing the chance they deploy the skill with write-capable credentials under the false belief that the harness will block unsafe actions.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The guide states the encrypted store contains only API keys, but elsewhere documents that the `igel-ums` dialect stores an administrator password in that same store. This is a security-relevant documentation inconsistency because operators may underestimate the sensitivity of `secrets.enc`, apply weaker handling, or make incorrect assumptions during audits, backup, rotation, and incident response.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Authorization is not this tool's job — decide it where it belongs

Whether a write should happen is your decision, or the account's. The tool does
not gate it — there is no read-only switch and no approval prompt to configure.
The two right places to control read vs write:

- **The account you connect with.** Give it a management-console account or API

• Confidence: 93% confidence
• Finding: The statement that there is 'no approval prompt to configure' confirms the skill supports operationally significant writes without a built-in human-approval checkpoint. In the context of endpoint fleet management, autonomous execution of reboot or profile changes can disrupt many devices at once if triggered by model error, prompt injection, or misuse of privileged credentials.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Governance & Safety

The skill delivers reads and writes and records them; it does **not** decide
whether a write is permitted. That is your agent's judgement, or the permission
of the account you connect it with (a management-console account or API token
scoped to a read-only role — writes then fail at the server). There is no
read-only switch, policy file, or approval gate.

• Confidence: 82% confidence
• Finding: The governance section explicitly states there is no read-only switch, policy file, or approval gate, leaving authorization entirely to the calling agent or the connected account's privileges. In an agentic context, this increases the risk of unintended state-changing actions if the agent invokes write tools with an overprivileged token or without separate approval logic.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/agent-guardrails.md:43