How SkillSpector Detects Privilege Escalation Attempts (sudo, credentials, SSH keys)

SkillSpector detects privilege escalation attempts using a static pattern analyzer that scans source code for three risk categories: broad permission requests, privileged command execution (sudo, su, pkexec), and access to sensitive credential files (SSH keys, cloud tokens).

NVIDIA's SkillSpector is a security analysis framework designed to identify risks in AI agent skill bundles. Understanding how it detects privilege escalation attempts reveals the static analysis techniques that uncover both intentional privileged operations and accidental credential exposure in automated workflows.

The Three Pattern Families (PE-1, PE-2, PE-3)

The static_patterns_privilege_escalation analyzer in SkillSpector categorizes risks into three distinct families, each targeting a specific attack vector.

PE-1: Overly Broad Permissions

This pattern identifies requests for excessive access rights that could enable privilege escalation. The analyzer searches for wildcard permission grants and explicit requests for full administrative access.

Key indicators include:

• permissions: ["*"]
• grant me full access
• Other patterns suggesting unrestricted capability grants

PE-2: Privileged Command Execution

This family detects direct invocation of system-level privilege escalation commands. The analyzer flags usage of:

• sudo and su commands
• pkexec for policy-based execution
• chmod +s for setting SUID bits
• Direct modifications to system files like /etc/passwd

Example matches include sudo apt-get install and chmod u+x /etc/passwd.

PE-3: Credential File Access

The highest-risk category identifies attempts to read sensitive authentication materials. This pattern targets:

• SSH private keys (~/.ssh/id_rsa, ~/.ssh/id_ed25519)
• Cloud provider credentials (~/.aws/credentials, ~/.azure/credentials)
• Environment files containing secrets (.env, .env.local)
• Token files and API key storage locations

Detection Workflow and Implementation

The analyzer operates as a node within SkillSpector's LangGraph workflow. When the CLI executes a scan, the system follows this precise execution path:

1. Graph Invocation – The CLI builds a SkillspectorState and invokes graph.invoke(state) to trigger the analysis pipeline

2. Static Pattern Registration – The static_runner.run_static_patterns function discovers the privilege escalation module via sys.modules[__name__] registration

3. Regex Scanning – The analyze(content, file_path, file_type) function in static_patterns_privilege_escalation.py executes re.finditer against three compiled pattern lists: PE1_PATTERNS, PE2_PATTERNS, and PE3_PATTERNS

4. Location Resolution – Helper functions get_line_number and get_context from common.py calculate exact line numbers and extract surrounding code snippets

5. Documentation Filtering – The _is_documentation_example helper rejects matches that appear in code comments, markdown fences, or example blocks containing phrases like "example:" or "# note:"

6. Finding Generation – For each valid match, the analyzer creates an AnalyzerFinding object containing:

   • rule_id: "PE1", "PE2", or "PE3"
   • message: Descriptive text like "Sudo/Root Execution"
   • severity: LOW, MEDIUM, or HIGH (PE-3 files)
   • confidence: Score between 0.6 and 0.95 based on pattern specificity
   • location: File path and start line
   • tags: PRIVILEGE_ESCALATION classification
   • context: Surrounding source lines

Code Examples

Running a Scan from the Command Line

Execute the analyzer against a skill directory using the CLI:

# Scan a skill directory and output a JSON report

skillspector scan ./my-skill/ --format json --output report.json

The resulting JSON contains a findings array with privilege escalation detections:

{
  "rule_id": "PE2",
  "message": "Sudo/Root Execution",
  "severity": "MEDIUM",
  "location": { "file": "src/run.py", "start_line": 42 },
  "confidence": 0.8,
  "tags": ["privilege_escalation"],
  "context": "    subprocess.run(['sudo', 'apt-get', 'install', 'curl'])",
  "matched_text": "sudo apt-get install curl"
}

Programmatic Analysis in Python

Import the analyzer directly for custom scanning:

from skillspector.nodes.analyzers.static_patterns_privilege_escalation import analyze

with open("scripts/deploy.sh", "r", encoding="utf-8") as f:
    content = f.read()

findings = analyze(content, file_path="scripts/deploy.sh", file_type="sh")
for f in findings:
    print(f.rule_id, f.message, f.location.start_line, f.confidence)

Expected output:

PE2 Sudo/Root Execution 23 0.7
PE3 Credential Access 58 0.9

Integrating with Custom Graphs

For advanced use cases, integrate the node into a custom LangGraph workflow:

from skillspector.graph import graph
from skillspector.state import SkillspectorState

state = SkillspectorState(input_path="./my-skill")
result = graph.invoke(state)          # automatically runs the PE node

print(result["report_body"])          # rendered report containing PE findings

Severity Scoring and Confidence Weighting

SkillSpector assigns HIGH severity to all PE-3 findings (credential file access) due to the immediate risk of authentication compromise. PE-2 findings (privileged commands) typically receive MEDIUM severity, while PE-1 (broad permissions) may range from LOW to MEDIUM depending on context.

Each regex pattern includes a confidence score between 0.6 and 0.95. Higher scores indicate more specific pattern matches that are less likely to generate false positives. This weighting enables downstream risk ranking, ensuring that hardcoded SSH keys surface more prominently than generic sudo usage in final reports.

Key Implementation Files

The privilege escalation detection system spans four primary files in the NVIDIA/SkillSpector repository:

• src/skillspector/nodes/analyzers/static_patterns_privilege_escalation.py – Contains the PE1_PATTERNS, PE2_PATTERNS, and PE3_PATTERNS regex tables and the analyze() function implementation
• src/skillspector/nodes/analyzers/static_runner.py – Orchestrates pattern module discovery and executes analyze() for each source file
• src/skillspector/nodes/analyzers/common.py – Provides utility functions get_context() and get_line_number() used for location tracking
• src/skillspector/graph.py – Defines the LangGraph workflow that registers and executes the privilege escalation node

Summary

• SkillSpector uses the static_patterns_privilege_escalation analyzer to detect privilege escalation attempts through regex-based static analysis
• The system identifies three risk categories: PE-1 (broad permissions), PE-2 (privileged commands), and PE-3 (credential files)
• Detection occurs in static_patterns_privilege_escalation.py via the analyze() function, which scans raw source text using compiled pattern lists
• PE-3 findings (SSH keys, cloud credentials) receive HIGH severity with confidence scores ranging from 0.6 to 0.95
• The documentation filter (_is_documentation_example) reduces false positives by excluding code examples and comments
• Results integrate into JSON and SARIF reports via the LangGraph workflow defined in graph.py

Frequently Asked Questions

What types of privilege escalation attempts does SkillSpector detect?

SkillSpector detects three specific categories via the static pattern analyzer: PE-1 identifies overly broad permission requests like wildcard grants; PE-2 catches privileged command execution including sudo, su, pkexec, and chmod +s operations; PE-3 flags access to sensitive credential files including SSH private keys, AWS credentials, and environment files containing secrets.

How does SkillSpector reduce false positives from code examples?

The analyzer implements a documentation filter through the _is_documentation_example helper function in static_patterns_privilege_escalation.py. This function rejects matches that appear within example code blocks, markdown fences, or comments containing phrases like "example:" or "# note:", ensuring that documentation does not trigger false security alerts.

What severity level does SkillSpector assign to credential file access?

Access to credential files (PE-3) receives HIGH severity classification. This includes patterns matching SSH keys (~/.ssh/id_rsa), cloud provider credentials (~/.aws/credentials), and environment files. The high severity reflects the immediate security risk of credential exposure compared to medium severity assigned to PE-2 privileged command usage.

Can I run the privilege escalation analyzer independently of the full scan?

Yes, you can import and execute the analyzer directly in Python. Import analyze from skillspector.nodes.analyzers.static_patterns_privilege_escalation, pass the file content and metadata, and receive a list of AnalyzerFinding objects. This allows integration into custom security pipelines without invoking the full LangGraph workflow.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}