monitoring-aiops

• Outcome: Review
• Latest audit: Aug 10, 2026 · 7:05 AM UTC
• Version: 0.9.0

Overview

The skill is coherent and disclosed, but it can make high-impact monitoring changes without a built-in read-only or approval gate.

Install only with least-privilege monitoring accounts, start read-only where possible, avoid exporting the master password except through a controlled secret manager or ephemeral process environment, enable SSL verification for production targets, and treat write tools such as acknowledge, mute, unmanage, pause, delete maintenance, and remove node as change-controlled operations.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly states that the tool does not gate writes and provides no read-only switch, while the skill metadata claims a built-in governance harness. In a monitoring/NOC skill that includes disruptive actions such as remove, unmanage, mute, pause, and maintenance creation, this mismatch can cause operators to overtrust the tool's safety properties and allow unauthorized or accidental state changes.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The file says authorization and approval are not handled by the tool, but later suggests disruptive writes require preview and double confirmation. This inconsistency creates unsafe ambiguity about which operations are truly protected, increasing the risk that users or downstream agents assume approval checks exist for actions that may execute immediately.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide explicitly recommends exporting the master password into an environment variable for unattended use but does not warn that environment variables can be exposed through shell history, process listings, crash dumps, CI logs, or inherited child processes. Because this password unlocks the encrypted credential store for monitoring platforms, compromise of the variable can lead to disclosure of Orion, PRTG, or Zabbix credentials and subsequent read/write access to monitoring operations.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Authorization is not this tool's job — decide it where it belongs

Whether a write should happen is your decision, or the account's. The tool does
not gate it — there is no read-only switch and no approval prompt to configure.
The two right places to control read vs write:

- **The account you connect with.** Give it a SolarWinds/PRTG/Zabbix login with

• Confidence: 90% confidence
• Finding: The statement that there is 'no approval prompt to configure' indicates the tool may permit autonomous execution of write-capable operations without an internal approval checkpoint. In this skill context, where the available actions can suppress alerts, alter monitoring state, or remove nodes, lack of built-in approval materially raises the chance of accidental or unauthorized operational impact.

Session Persistence

Medium

• Category: Rogue Agent

Content

metadata: {"openclaw":{"requires":{"env":["MONITORING_AIOPS_CONFIG"],"bins":["monitoring-aiops"],"config":["~/.monitoring-aiops/config.yaml","~/.monitoring-aiops/secrets.enc"]},"optional":{"env":["MONITORING_AIOPS_MASTER_PASSWORD"]},"primaryEnv":"MONITORING_AIOPS_CONFIG","homepage":"https://github.com/AIops-tools/Monitoring-AIops","emoji":"📡","os":["macos","linux"]}}
compatibility: >
  Standalone, self-governed monitoring operations across SolarWinds Orion (SWIS REST + SWQL, port 17774 on Orion 2023.1+ with an automatic one-shot fallback to the legacy 17778, HTTP Basic auth), Paessler PRTG (web API, port 443/8080, API token), and Zabbix 6.x/7.x (JSON-RPC 2.0 at /api_jsonrpc.php, API token as Bearer header on 6.4+/7.x with a legacy auth-field fallback for 6.0). Each target in the config names its own platform, so one config can span all NOCs. The governance harness (audit, policy, token/runaway budget, undo, risk-tiers) is bundled in the package — no external skill-family dependency.
  All write operations are audited to a local SQLite DB under ~/.monitoring-aiops/ (relocatable via MONITORING_AIOPS_HOME).
  Credentials: the Orion account password (SolarWinds), the PRTG API token, or the Zabbix API token is stored ENCRYPTED in ~/.monitoring-aiops/secrets.enc (Fernet/AES-128 + scrypt-derived key) — never plaintext on disk. Run 'monitoring-aiops init' to onboard (it asks for the platform), or 'monitoring-aiops secret set <target>' to add one. The store is unlocked by a master password from MONITORING_AIOPS_MASTER_PASSWORD (non-interactive/MCP/CI) or an interactive prompt (CLI on a TTY). A legacy plaintext env var MONITORING_<TARGET_NAME_UPPER>_SECRET is still honoured as a fallback with a deprecation warning (migrate with 'monitoring-aiops secret migrate'). The secret is used for HTTP Basic auth (SolarWinds) or as the PRTG/Zabbix API token at request time and held only in memory; secrets are never logged or echoed.
  Read-only SWQL passthrough (swql_query) is validated
...[truncated 25 chars]

• Confidence: 91% confidence
• Finding: The skill explicitly persists operational state locally via an audit SQLite database and an encrypted secrets store. While persistence is expected for this kind of monitoring tool, it still creates a security-relevant footprint: audit records, undo state, and encrypted credentials can become a source of sensitive data exposure if filesystem permissions, encryption handling, or host compromise are weak.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Common Workflows

> **No authorization gate**: the skill runs the operations you ask for and audits every one; it does not decide whether a write is permitted — that is the agent's judgement or the permissions of the SolarWinds/PRTG/Zabbix account it connects with (a read-only monitoring account makes writes fail at the server). There is no read-only switch, policy file, or approval gate. `MONITORING_AUDIT_APPROVED_BY` / `MONITORING_AUDIT_RATIONALE` are optional audit annotations, recorded when set.

### 1. The 3 a.m. alert storm — collapse it, then acknowledge what matters

• Confidence: 96% confidence
• Finding: The skill states there is 'no authorization gate' and that writes are executed based on agent judgment or whatever privileges the configured monitoring account already has. In this context, the tool exposes state-changing operations across production monitoring platforms, so the absence of an internal approval/read-only control materially increases the chance of unauthorized or unsafe persistent changes such as alert acknowledgements, muting, unmanaging nodes, pausing sensors, or deleting maintenance objects.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/agent-guardrails.md:42