ClawHub
Back to skill

Security audit

Celaut Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for operating Celaut nodes, but it asks an agent to manage privileged host services and expose sensitive workload observation features that need careful operator review.

Install only on a host you control and are willing to dedicate to a privileged Celaut node. Review the installer before running sudo commands, verify downloaded binaries where possible, keep wallet mnemonics out of shared workspaces, restrict any observe/Gateway.Observe access to trusted operators, and double-check TARGET_DIR before uninstalling.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The Laravel example's startup script runs `php /var/www/artisan migrate --force` automatically on service start, which embeds a state-changing administrative action into normal runtime initialization. In this packaging context, services may be instantiated repeatedly or in decentralized/untrusted environments, so automatic migrations can unintentionally alter production databases, create destructive schema changes, or allow a redeploy/restart to trigger privileged side effects without an explicit operator approval step.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The installation guide instructs users to run numerous network downloads and privileged system modifications, including writing under /etc/systemd/system, /usr/local/bin, and installing host packages, but does not present an explicit security warning about trust, origin verification, or host impact. Although some artifacts are checksum-verified, others such as the bootstrap yq binary and Cloud Hypervisor binary are fetched directly from the network without a documented signature-verification step, increasing supply-chain and operator-risk concerns.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The manual uninstall step instructs users to run `sudo rm -rf "$TARGET_DIR"`, which is irreversible and only depends on a shell variable that the user sets earlier. If `TARGET_DIR` is mistyped, empty due to editing mistakes, or points somewhere unexpected, the command can destroy unrelated host data; the absence of an immediate warning or safety validation increases the chance of operator error.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation explicitly exposes a remote streaming interface that can deliver live per-packet network telemetry, including raw packet records when `include_packets = true`, but it does not pair that capability with clear access-control, authorization, consent, retention, or privacy warnings. In a distributed/agent-accessible environment, this materially increases the risk of covert traffic inspection, credential/session leakage, and collection of sensitive metadata or payloads from workloads if the RPC is reachable by unauthorized peers.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
`.pcap` still records **every** frame verbatim, and `metrics.jsonl` remains
  metrics-only.

  **Network capture.** On the Linux/KVM host with `CAP_NET_RAW` (run as root),
  observe binds an `AF_PACKET` raw socket to the instance's *tap* interface and
  captures **every** frame in both directions — the Wireshark equivalent of the
  VM's whole NIC. Transport protocol (TCP/UDP/ICMP), ports, TCP flags and
Confidence
87% confidence
Finding
The guide states that running `observe` as root enables AF_PACKET raw-socket capture of every frame on the microVM tap interface. In context, this is a powerful surveillance capability, and the documentation presents it as routine functionality without strong warnings about sensitive data exposure, access restriction, or legal/privacy implications; if misused, it can expose credentials, internal service communications, and packet contents/metadata.

Static analysis

No suspicious patterns detected.