ClawHub
Back to skill

Security audit

Dev Machine Cleanup

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate cleanup purpose, but it can asynchronously delete files and Docker artifacts on a remote development machine without tight scoping or confirmation.

Install only if you intend this skill to let an agent SSH to the datax development machine and delete old .log and tmp_* files under /mnt/www, plus optionally prune Docker images. Before using it, add an explicit confirmation step, make the first run a dry run/list-only report, restrict cleanup to known log/temp directories, avoid daemon-wide Docker pruning unless separately approved, and ensure backups or audit logs exist.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:45
Finding

Overly Broad and Unverified Recursive File Deletion

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:45-55
Vulnerability Type: Unsafe destructive file cleanup
Risk Level: Medium

Complete Code Snippet:

bash
SSH to the datax development machine and execute:

# Check disk status before cleanup
df -h

# Delete .log files older than 7 days
find /mnt/www -name '*.log' -mtime +7 -delete

# Delete tmp_* files older than 3 days
find /mnt/www -name 'tmp_*' -mtime +3 -delete

Technical Analysis

The skill instructs a delegated agent to connect to a remote development machine and recursively delete files throughout /mnt/www. Selection is based only on filename patterns and modification age. The commands do not:

  • Restrict candidates to regular files with -type f.
  • Limit cleanup to an explicit allowlist of dedicated log and temporary directories.
  • Verify file ownership, application association, active use, or backup status.
  • Exclude protected business or configuration paths.
  • Preview candidates or require approval before deletion.
  • Preserve a deletion manifest sufficient for recovery or investigation.

Consequently, the documented safety claim that business and configuration data will not be removed is not technically enforced. A legitimate application artifact whose name matches *.log or tmp_* can be deleted solely because it resides below /mnt/www and exceeds the age threshold.

Attack Path

  1. A legitimate application, deployment process, or malicious local actor creates or renames a valuable file under /mnt/www so that its name matches *.log or tmp_*.
  2. The file's modification time exceeds the configured threshold, naturally or through timestamp manipulation.
  3. A user invokes one of the documented cleanup trigger phrases.
  4. The main agent delegates the cleanup to a sub-agent with SSH access to datax.
  5. The sub-agent executes the recursive find ... -delete command.
  6. The matching file is permanently r ...[truncated 534 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace /mnt/www with an explicit allowlist of dedicated cleanup directories.
  • Add -type f and enforce expected ownership and filesystem boundaries.
  • Exclude protected application, configuration, backup, and audit-log paths.
  • Generate and review a candidate manifest before deletion.
  • Require explicit user confirmation when candidates exceed defined count or size thresholds.
  • Prefer application-native log rotation and retention mechanisms.
  • Record exact deleted paths, sizes, timestamps, and command outcomes in an access-controlled audit log.
  • Use backups, quarantine, or a reversible staging period before permanent deletion.
  • Run cleanup using a narrowly scoped account that cannot modify unrelated applications.
  • Add locking so concurrent cleanup jobs cannot run against the same paths.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:57
Finding

Unscoped Non-Interactive Docker Image Pruning

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:57-58
Vulnerability Type: Host-wide destructive resource cleanup
Risk Level: Medium

Complete Code Snippet:

bash
# Prune dangling Docker images (optional)
docker image prune -f

Technical Analysis

The skill directs the agent to invoke Docker image pruning with -f, suppressing interactive confirmation. Docker pruning operates against the connected daemon rather than a project-specific directory or namespace. The command therefore affects all dangling images visible to that daemon, including resources belonging to unrelated users, applications, or deployment workflows.

Labeling the operation “optional” does not establish a technical authorization gate, dependency check, ownership boundary, or user confirmation requirement. Although dangling images are not currently tagged, they may still be useful for rollback, caching, investigation, or an in-progress operational workflow.

Attack Path

  1. An unrelated build or deployment leaves an image dangling on the shared Docker daemon.
  2. The image remains useful for rollback, build caching, or forensic analysis.
  3. A user triggers the development-machine cleanup skill.
  4. The delegated agent executes docker image prune -f.
  5. Docker removes all qualifying dangling images accessible through the daemon without requesting confirmation.
  6. The unrelated workflow loses the image and must rebuild it, or loses evidence or rollback capability.

Impact Assessment

The operation can remove dangling images daemon-wide under the Docker permissions available to the SSH identity. It does not directly remove running containers, but it can affect unrelated projects by destroying build caches, rollback artifacts, and forensic evidence. Access to the Docker daemon is itself highly privileged; misuse may affect the availability and operational integrity of workloads across the host.

Remediation
View remediation

Remediation Suggestions

  • Remove automatic daemon-wide pruning from the default cleanup procedure.
  • Inventory candidate images and report their IDs, labels, creation times, sizes, and known dependencies before removal.
  • Require explicit user authorization for Docker cleanup.
  • Apply and validate project ownership labels, pruning only resources belonging to the intended project.
  • Check active deployments, rollback policies, build jobs, and incident-retention requirements before deletion.
  • Avoid -f unless a separate reviewed approval mechanism already exists.
  • Use a least-privileged operational service capable only of managing approved resources.
  • Maintain an access-controlled audit trail of every removed image and the authorization for its deletion.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill describes deletion commands and safety boundaries, but it does not provide an explicit user-facing warning that the operation is destructive and may permanently remove files or alter Docker state. In the context of remote SSH execution on a development machine, the lack of a warning and confirmation increases the chance of accidental data loss and unsafe operator assumptions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrase "打扫卫生" is common everyday language and is not clearly scoped to destructive filesystem cleanup. In this skill, that vague phrase can invoke asynchronous deletion of logs and temporary files on a development machine, increasing the chance of accidental activation without explicit user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Several triggers like "清理开发机", "清理日志", and references to named agents are ambiguous for a skill that performs destructive operations. Because the workflow asynchronously spawns another agent to SSH and delete files, insufficiently specific triggers raise the risk of unintended execution and reduce human oversight.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

All user-facing descriptions, trigger phrases, examples, and notifications are written only in Chinese, and the skill does not indicate that language selection is optional or region-specific. Under the stated policy, fixed language behavior without user opt-in can be a locale-policy issue unless clearly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.