ClawHub
Back to skill

Security audit

Pihole Ctl

Security checks for vulnerabilities and agentic risk

Overview

This Pi-hole skill is a disclosed local monitoring and management helper, with no evidence of hidden execution, exfiltration, persistence, or deceptive behavior.

Install only if you want an agent to inspect local Pi-hole query logs and help run Pi-hole administrative commands. Treat enable, disable, gravity update, whitelist, and blacklist operations as explicit-confirmation actions because they can change DNS filtering for the network.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The declared description says the skill can both monitor and manage Pi-hole, including controlling the service via CLI and handling requests like 'pihole status' or 'update gravity.' The supplied code does not invoke Pi-hole CLI commands, alter service state, or perform any management action. It only opens the Pi-hole FTL SQLite database in read-only mode and computes summary counts plus top domains. This is partially aligned with the monitoring/database-query portion of the description, but materially narrower than declared. There is also a specific mismatch between 'top clients' in the description and 'top domains' in the code.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The reference documentation exposes `pihole -w` and `pihole -b` capabilities that modify filtering policy, even though the declared skill scope is limited to status, gravity updates, and statistics. This scope mismatch can enable prompt- or tool-confusion attacks where an agent uses undocumented-but-documented commands to alter DNS policy, expanding the skill's effective authority beyond what users or reviewers expect.

Missing User Warnings

Low
Confidence
89% confidence
Finding
The skill documents privileged service-management actions such as enabling/disabling blocking and updating gravity, but does not clearly warn that these operations change system state and may require elevated privileges. In an agent context, that can lead to unsafe execution of administrative commands without adequate user awareness or confirmation, causing unintended DNS filtering outages or policy changes.

Static analysis

No suspicious patterns detected.