ClawHub
Back to skill

Security audit

DevOps Bridge

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for DevOps automation, but it can broadly connect repos, CI, messaging, and issue trackers with automatic posting, updates, scheduled workflows, and persistent team mappings that need closer review before installation.

Review this skill before installing. It is not evidence of malware, but you should only use it with explicit repo and channel allowlists, avoid the 'all repos I have push access to' option unless intended, limit CI logs and issue details posted to chat, and require confirmation for external posts, issue updates, reruns, merges, and recurring schedules.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: devops-bridge
description: >
  Unified developer operations bridge connecting GitHub, CI/CD (GitHub Actions), Slack, Discord, and
  issue trackers (Linear, Jira, GitHub Issues) into cross-tool automated workflows. Sends context-rich
  CI failure notifications to Slack with failing test details, tracks PR review lifecycle with escalating
  reminders, generates daily dev standup summaries, syncs issue status when PRs are merged, detects
  flaky tests, and monitors repository health. Use this skill for: PR review reminders, CI build alerts,
  "what happened in my repos", "any failing builds", "who needs a revi

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill advertises activation on very broad conditions such as any mention of GitHub plus another dev tool, which can cause the agent to invoke this bridge for ordinary conversations that did not clearly request cross-system automation. In this context, overbroad triggering is dangerous because the skill is designed to aggregate repository, CI, messaging, and issue-tracker data and could disclose or act on information across services without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill describes automatically sending CI details, PR context, and linked issue information into Slack, Discord, or other tools, but does not warn that data from one system will be copied into another. That omission creates a real risk of oversharing internal code, test names, issue references, or operational context into broader channels than intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The configuration flow instructs persistent storage of workspace memory including monitored repos, notification destinations, and mappings between GitHub identities and Slack/Discord handles, but gives no retention or access-control guidance. Persistent storage of team mapping and channel metadata increases privacy and security risk if the workspace memory is exposed, reused too broadly, or retained longer than necessary.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.