queue-aiops

• Outcome: Review
• Latest audit: Oct 15, 2026 · 10:01 AM UTC
• Version: 0.11.0

Overview

This skill is openly built for Redis/RabbitMQ operations, but its MCP surface can perform destructive broker writes without an enforced approval or read-only gate.

Install only for environments where you can give the tool least-privilege Redis/RabbitMQ credentials. Prefer read-only Redis ACLs or RabbitMQ monitoring-only users by default, widen permissions only for a specific maintenance session, and do not expose purge/delete capabilities to an agent unless you are comfortable with irreversible message loss. Protect QUEUE_AIOPS_MASTER_PASSWORD and avoid putting real master passwords in shared or checked-in MCP config files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: references/capabilities.md:84

Finding

Destructive MCP operations lack an enforced approval gate

Content

View full analysis

Vulnerability Details

File Location: references/capabilities.md:84-89
Vulnerability Type: Missing authorization and confirmation enforcement for destructive operations
Risk Level: High

Relevant snippet:

markdown

| `purge_queue(vhost, name)` | **high** | message count about to be destroyed | none — messages unrecoverable |
| `delete_queue(vhost, name)` | **high** | full queue definition + message count | re-declare the captured definition (**messages NOT restored**) |

Every write takes `dry_run` (MCP) / `--dry-run` + double-confirm (CLI); the two
high-risk writes (`purge_queue`, `delete_queue`) are gated by that same dry-run
preview + double confirmation at the CLI, nothing more.

Corroborating instructions state:

• SKILL.md:215-218: the tool does not decide whether a write is permitted and has no read-only switch, policy file, or approval gate.
• SKILL.md:228-229: dry-run is supported, but double confirmation applies only at the CLI.
• references/agent-guardrails.md:13-25: authorization is delegated to the agent or broker account rather than enforced by the tool.

Technical Analysis

The MCP interface exposes irreversible purge_queue and destructive delete_queue operations. Although these operations accept a dry_run parameter, the reviewed instructions do not require a successful preview before execution. The double-confirmation control is explicitly limited to the CLI.

Consequently, an MCP caller can invoke either operation in execution mode without presenting an approval token, completing an interactive confirmation, or passing a server-enforced policy check. Audit logging and risk labels provide accountability but do not prevent an unauthorized or mistaken operation. The runaway guard also does not address a single destructive call.

This is especially significant because purge_queue has no undo mechanism. For delete_queue, the recorded inverse can recreate only the que ...[truncated 1305 chars]

Remediation

View remediation

Remediation Suggestions

• Enforce authorization in the MCP implementation rather than relying on agent instructions.
• Default every state-changing MCP operation to dry-run and reject omitted or ambiguous execution intent.
• Require a two-stage workflow:
  1. Generate a preview containing the exact target, operation, and captured prior-state digest.
  2. Return a short-lived, single-use confirmation token bound to that preview.
  3. Require the token in a separate execution call and reject it if the target, parameters, state, or expiry differs.
• Add a server-enforced read-only mode and allow administrators to disable destructive tools independently.
• Require explicit approval metadata for high-risk operations and validate it as an authorization condition rather than merely recording optional annotations.
• Continue broker-side least privilege by using monitoring-only RabbitMQ accounts by default and granting purge/delete permissions only for narrowly scoped maintenance sessions.
• Retain audit logging and runaway protection as defense-in-depth controls, but do not treat either as a substitute for authorization.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (9)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

The documented '--skip-auth' option can enable unauthenticated connectivity checks, which weakens assurance that the tool is validating the real target under proper access controls. If misused in production workflows, it may normalize bypassing authentication checks and could hide credential/configuration problems or allow interaction patterns that should require authenticated verification.

Content

Scanner excerpt · references/cli-reference.md (reported line 11)May include surrounding context.

bash

queue-aiops init                 # onboarding wizard (targets + encrypted secrets)
queue-aiops doctor [--skip-auth] # config/secret/connectivity check (PING / /api/overview)
queue-aiops overview [-t T]      # one-shot health summary (platform-dispatched)
queue-aiops mcp                  # run the MCP server (stdio)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-reference.md (reported line 22)May include surrounding context.

queue-aiops secret set # add/update an encrypted secret queue-aiops secret list # names only — values are never printed queue-aiops secret rm queue-aiops secret migrate # legacy .env / env vars → encrypted store queue-aiops secret rotate-password

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

metadata: {"openclaw":{"requires":{"anyBins":["queue-aiops","uvx"]},"optional":{"env":["QUEUE_AIOPS_CONFIG","QUEUE_AIOPS_MASTER_PASSWORD"]},"homepage":"https://github.com/AIops-tools/Queue-AIops","emoji":"📬","os":["macos","linux"]}}
compatibility: >
  Standalone, self-governed broker operations across redis (RESP wire protocol via the redis Python client; password optional — auth-less lab instances are supported — TLS optional) and rabbitmq (management HTTP API /api/..., HTTP Basic auth with a monitoring/management-tagged user). Each target in the config names its own platform, and a name-keyed platform registry selects the protocol shape, so one config can span a mixed estate. The governance harness (audit, policy, token/runaway budget, undo, risk-tiers) is bundled in the package — no external skill-family dependency.
  All write operations are audited to a local SQLite DB under ~/.queue-aiops/ (relocatable via QUEUE_AIOPS_HOME).
  Credentials: the redis password (optional) or the rabbitmq management password is stored ENCRYPTED in ~/.queue-aiops/secrets.enc (Fernet/AES-128 + scrypt-derived key) — never plaintext on disk. Run 'queue-aiops init' to onboard (it asks for the platform), or 'queue-aiops secret set <target>' to add one. The store is unlocked by a master password from QUEUE_AIOPS_MASTER_PASSWORD (non-interactive/MCP/CI) or an interactive prompt (CLI on a TTY). A legacy plaintext env var QUEUE_<TARGET_NAME_UPPER>_SECRET is still honoured as a fallback with a deprecation warning (migrate with 'queue-aiops secret migrate'). The secret is presented as AUTH at connect time (redis) or HTTP Basic auth (rabbitmq) and held only in memory; secrets are never logged or echoed.
  State-changing operations pass through the @governed_tool decorator (budget guard + audit + risk-tier labelling). purge_queue and delete_queue are risk=high with dry_run + double confirmation at the CLI; purge is irreversible (priorState = the message count about to be destroyed), and delete
...[truncated 25 chars]

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

md

3. `queue-aiops rabbitmq policies` → check no policy still targets its name pattern, so
   you are not leaving a dangling rule behind.
4. `queue-aiops rabbitmq delete-queue <name> --vhost / --dry-run` → preview.
5. Re-run without `--dry-run` (double-confirm, risk=high) — the write
   captures the queue's definition first, so the undo descriptor **re-declares exactly
   that queue** (durability and auto-delete flags included).
6. `queue-aiops rabbitmq queues` → confirm it is gone and nothing else changed.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The guardrail explicitly states the tool does not enforce read-only mode or require approval for write actions, leaving destructive broker operations to external account permissions or prompt discipline. In an agentic setting, this is dangerous because the skill includes governed write capabilities, and prompt-only restrictions can be bypassed or ignored by a model, enabling unintended queue purges, deletes, client kills, or configuration changes when connected credentials are overprivileged.

Content

Scanner excerpt · references/agent-guardrails.md (reported line 15)May include surrounding context.

md

## Authorization is not this tool's job — decide it where it belongs

Whether a write should happen is your decision, or the account's. The tool does
not gate it — there is no read-only switch and no approval prompt to configure.
The two right places to control read vs write:

- **The account you connect with.** Give the Redis connection an ACL user

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/cli-reference.md (reported line 11)May include surrounding context.

bash

queue-aiops init                 # onboarding wizard (targets + encrypted secrets)
queue-aiops doctor [--skip-auth] # config/secret/connectivity check (PING / /api/overview)
queue-aiops overview [-t T]      # one-shot health summary (platform-dispatched)
queue-aiops mcp                  # run the MCP server (stdio)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The guide explicitly permits connecting to Redis with no password and says 'nothing to prepare' without a strong warning that this is only acceptable for isolated lab environments. In the context of a tool designed to operate production brokers, this normalizes insecure deployment and could lead operators to expose unauthenticated Redis instances, enabling unauthorized reads, configuration changes, or destructive actions depending on network reachability and ACL state.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup-guide.md (reported line 28)May include surrounding context.

md

### rabbitmq

Enable the management plugin and create (or reuse) a user with at least the
`monitoring` tag (reads) — the `management`/`policymaker` tag is needed for
policy writes, and queue purge/delete needs configure permission on the vhost:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup guide shows QUEUE_AIOPS_MASTER_PASSWORD populated inline in the MCP configuration, which encourages storing a high-value secret in plaintext in client config files. If that file is readable by other local users, synced to source control, captured in logs, or exposed through workstation compromise, an attacker can decrypt the tool's encrypted secret store and access downstream Redis/RabbitMQ credentials.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.