AMG PostgreSQL Flexible Server Health Check

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:26 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for Azure PostgreSQL health checks, but its setup asks users to place a live Grafana bearer token directly in a command line and its recovery path broadens local parsing execution.

Install only if you are comfortable granting this skill access to Azure Managed Grafana and PostgreSQL monitoring data. Use a least-privilege, dedicated Grafana service-account token, prefer a secret-management mechanism over pasting the token into a shell command, and rotate the token if it appears in shell history, logs, screenshots, or support transcripts. Review the persistent memory report and avoid approving broad local parsing commands unless you trust the result file and path.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:20

Finding

Grafana Bearer Token Exposed in Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–24
Vulnerability Type: Credential exposure through command-line arguments
Risk Level: Medium

Vulnerable Code

bash

openclaw mcp set amg '{"url":"https://<your-grafana-instance>/api/azure-mcp","transport":"streamable-http","headers":{"Authorization":"Bearer <your-token>"}}'

The accompanying instruction explicitly tells the user to replace the placeholder with a valid Grafana service-account token:

text

Replace `<your-grafana-instance>` with your Azure Managed Grafana endpoint and `<your-token>` with a valid Grafana service-account token (starts with `glsa_`).

Technical Analysis

The setup procedure embeds a live Grafana bearer token directly in a shell command argument. Secrets supplied through command-line arguments may be exposed through:

• Shell history files.
• Process listings or process-monitoring tools while the command is running.
• Terminal session logging.
• Command auditing and diagnostic telemetry.
• Copy-and-paste records or support transcripts.

The token is an authentication bearer credential: possession may be sufficient to access the configured Azure Managed Grafana MCP endpoint within the permissions granted to the associated service account. The instructions do not prescribe secure secret input, prevent shell-history retention, or require token rotation after accidental exposure.

Attack Path

1. An operator follows the documented setup procedure and substitutes a valid glsa_ service-account token into the command.
2. The shell records the complete command in history, or a local process/audit collector observes its arguments.
3. An attacker with access to that history, process metadata, terminal log, or diagnostic record extracts the bearer token.
4. The attacker submits the token in an Authorization: Bearer header to the configured Grafana endpoint.
5. The attacker can invoke operations available to that service account until the token ...[truncated 470 chars]

Remediation

View remediation

Remediation Suggestions

1. Use OpenClaw's supported secret-management facility and reference the stored secret rather than placing its value in command-line arguments.
2. If supported, accept the token through an interactive, non-echoing prompt or standard input.
3. Avoid storing the raw token in workspace configuration, generated reports, shell scripts, or environment files committed to source control.
4. Document a least-privilege Grafana service-account role restricted to the monitoring operations required by this Skill.
5. Add instructions to rotate the token immediately if it has appeared in shell history, logs, screenshots, or diagnostic output.
6. If a secure input method is temporarily unavailable, explicitly instruct users to disable history for the command and securely clear any existing history record; this should be treated only as a fallback rather than the primary mitigation.
7. Ensure application logs and error messages redact the Authorization header.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · reference/analysis-patterns.md (reported line 29)May include surrounding context.

md

Grafana instances use a 30-second query timeout. When many sessions cluster at exactly 30.0xx seconds, it indicates queries are timing out rather than completing.

**Signals:**
- Disconnection log session times clustered at `0:00:30.0xx`
- High timeout percentage (>50% of all sessions)
- Cancel requests that don't match any process (query already timed out and was cleaned up)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The recovery guidance instructs saving tool output to /tmp and then parsing it with arbitrary shell or interpreter commands (node, python, jq, pwsh), which expands the skill's execution surface beyond its stated Azure/PostgreSQL monitoring purpose. Even though the examples are framed as data parsing, they normalize generic code execution and shell access in response to oversized results, creating a path for command misuse, unsafe copy/paste, or execution of attacker-influenced content in a sensitive analysis workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.