ClawHub
Back to skill

Security audit

Aiter Ck Gemm Tune

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for AMD AITER kernel tuning, but it asks agents to modify installed project files and launch persistent multi-GPU background jobs without enough user control or cleanup guidance.

Review this skill before installing if you use shared GPU nodes or care about keeping your AITER checkout clean. Run it only in a controlled container or disposable branch, confirm every file it will modify, avoid detached nohup jobs unless you explicitly want them, and record how to stop any tuning process it starts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill instructs the agent to read logs and test files, write CSV/config/report files, and modify project files, but it does not declare any explicit tool scope or allowed-tools boundaries. In an agentic environment, missing scope increases the chance the skill will access or alter files beyond the intended AITER workspace, especially because it operates on user-provided paths and installed-package locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly tells the operator to modify checked-in test files and overwrite variant config CSVs to bypass argparse constraints and drive tuning. Without a warning or backup/restore workflow, this can silently change repository state, contaminate benchmarks, and introduce accidental code or config drift that later gets committed or used in production.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill launches long-running tuning jobs with nohup, multi-GPU parallelism, and background execution, which can continue after the session ends and consume substantial shared compute resources. Although the text notes tuning may take hours, it lacks an explicit safety checkpoint requiring user approval for persistent background execution and resource usage on remote or shared nodes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

Using nohup to start the GEMM tuning process creates session-persistent execution that survives disconnects and may continue consuming GPUs unattended. In a remote/containerized tuning environment, this persistence is operationally risky because it can outlive user awareness and interfere with other workloads.

Content

Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.

bash
cd $AITER_PATH
mkdir -p tune_logs
nohup python3 csrc/ck_gemm_a8w8_blockscale/gemm_a8w8_blockscale_tune.py \
  -i aiter/configs/a8w8_blockscale_untuned_gemm.csv \
  -o aiter/configs/a8w8_blockscale_tuned_gemm.csv \
  --libtype both --mp 8 --timeout 600 \

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The MoE tuning command likewise uses nohup for a session-persistent background job, enabling continued execution after logout or transport failure. Because the job can parallelize across multiple GPUs and write tuned outputs automatically, persistence increases the risk of unintended resource consumption and unnoticed system changes.

Content

Scanner excerpt · SKILL.md (reported line 311)May include surrounding context.

bash
cd $AITER_PATH
mkdir -p tune_logs
nohup python3 csrc/ck_gemm_moe_2stages_codegen/gemm_moe_tune.py \
  -i aiter/configs/untuned_fmoe.csv \
  -o aiter/configs/tuned_fmoe.csv \
  --mp 8 --timeout 120 \

Static analysis

No suspicious patterns detected.