ClawHub
Back to skill

Security audit

Mailserver Maintenance

Security checks for vulnerabilities and agentic risk

Overview

This mailserver maintenance skill is mostly a disclosed runbook, but it relies on undeclared administrator SSH access with host verification disabled and can affect production mail services.

Install only if this is your own mailserver environment and you are comfortable granting the agent access to the Docker mailserver and the cloud relay SSH key. Before use, replace administrator SSH with a least-privileged account, enable strict host-key verification, declare the required credential/config paths, and remove or redirect the real outbound email test to a controlled sink address.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:11
Finding

SSH Host Verification Disabled for a Privileged Relay Connection

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-18
Vulnerability Type: Insecure SSH configuration
Risk Level: High

Vulnerable Code:

text
Host cloudrelay
    HostName 101.43.110.225
    User administrator
    IdentityFile /home/cloudrelay/.ssh/id_rsa
    StrictHostKeyChecking=no
    BatchMode=yes

Technical Analysis

The SSH configuration explicitly sets StrictHostKeyChecking=no. Consequently, the SSH client does not require the relay to present a previously trusted host key before using the configured private key to attempt authentication.

This removes SSH's primary protection against server impersonation and machine-in-the-middle attacks. An attacker able to redirect or intercept traffic to 101.43.110.225 could present an attacker-controlled SSH endpoint that the client accepts without an authenticity warning.

The connection also uses the Windows administrator account. Relay status checks and scheduled-task operations do not inherently require unrestricted administrator access, so the account appears broader than the minimum privilege required by the declared mail-server maintenance functionality. Although the Skill does not print, overwrite, or directly extract the private key, it causes that credential to be used against an unverified endpoint.

An impersonating SSH server cannot derive the private key merely from public-key authentication. Nevertheless, it can observe attempted connection metadata and submitted commands, return forged status or log output, and potentially influence subsequent maintenance decisions. Separately, compromise of the configured credential would grant the privileges available to the remote administrator account.

Attack Path

  1. An attacker obtains a network position capable of redirecting traffic intended for 101.43.110.225, such as through route manipulation, local network compromise, or host-level redirection.
  2. The attacker operates ...[truncated 1490 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove StrictHostKeyChecking=no and require strict verification:
    text
    StrictHostKeyChecking=yes
UserKnownHostsFile=/home/cloudrelay/.ssh/known_hosts
  2. Provision the relay's verified host key into a protected known_hosts file through a trusted channel. Do not obtain and trust the key automatically during each invocation.
  3. Replace the administrator login with a dedicated service account that can only:
    • Query port 2526 status.
    • Read the two required relay log files.
    • Start and stop the named relay scheduled task.
  4. Apply server-side SSH restrictions where supported, including command allowlisting, source-address restrictions, and denial of interactive shells, forwarding, and unrelated subsystem access.
  5. Protect the private key with restrictive ownership and permissions, and use a key dedicated exclusively to this relay.
  6. Fail closed when host-key verification fails. The Skill should not instruct an Agent to bypass or replace an unexpected host key without independent verification.

T09 · Insecure Skill Coding Practices

Warning
Location
_meta.json:7
Finding

Credential and Configuration Requirements Are Incorrectly Declared as Absent

Content
View full analysis

Vulnerability Details

File Location: _meta.json, lines 7-13
Vulnerability Type: Undeclared credential access and inaccurate security metadata
Risk Level: Medium

Vulnerable Code:

json
"requiredEnvVars": [],
"requiredConfigPaths": [],
"primaryCredential": null,
"persistence": null,
"credentialSetup": {
  "type": "none",
  "description": "No credentials required."
},

The declaration conflicts with the following operational requirements in SKILL.md, lines 14-20:

text
User administrator
IdentityFile /home/cloudrelay/.ssh/id_rsa
StrictHostKeyChecking=no
BatchMode=yes
text
ssh -F /home/cloudrelay/.ssh/config cloudrelay "..."

Technical Analysis

The metadata states that the Skill requires no credentials or configuration paths. In practice, its cloud-relay maintenance commands depend on both:

  • /home/cloudrelay/.ssh/id_rsa
  • /home/cloudrelay/.ssh/config

SSH then automatically uses the private key to authenticate as the configured remote account. This discrepancy can prevent users, deployment systems, or policy engines from recognizing that invocation may use an existing privileged credential.

The Skill also contains a troubleshooting command that lists the key file's metadata:

bash
docker exec mailserver ls -la /home/cloudrelay/.ssh/id_rsa

That command does not read or modify the private-key contents, but it confirms that credential-path access is an intentional prerequisite of the workflow. The reference documentation likewise identifies the key and SSH configuration as required architecture components.

Attack Path

  1. A user or policy engine evaluates _meta.json and approves the Skill as requiring no credentials and no protected configuration paths.
  2. The Agent follows SKILL.md and invokes SSH with /home/cloudrelay/.ssh/config.
  3. The SSH client loads /home/cloudrelay/.ssh/id_rsa automatically.
  4. The existing c ...[truncated 1111 chars]
Remediation
View remediation

Remediation Suggestions

  1. Update the metadata to declare the required SSH configuration and credential paths.
  2. Replace "primaryCredential": null and the "No credentials required." statement with an accurate SSH credential declaration supported by the Skill platform.
  3. Add prerequisite validation for:
    • Existence of the SSH configuration and key.
    • Correct file ownership.
    • Restrictive private-key permissions, such as mode 0600.
    • A strictly verified relay host key.
  4. Ensure validation never prints, reads into Agent-visible output, copies, or transmits private-key contents.
  5. Document the remote identity and its exact authorization scope so users can assess the privileges granted before invocation.
  6. Use a dedicated, least-privileged relay credential rather than a general administrator credential.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (26)

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

The SSH configuration block exposes the sensitive .ssh directory structure for a privileged remote access account. This materially aids an attacker or an over-privileged agent by revealing exactly where administrative credentials are stored and how they are used.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Host cloudrelay HostName 101.43.110.225 User administrator IdentityFile /home/cloudrelay/.ssh/id_rsa StrictHostKeyChecking=no BatchMode=yes

text

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

The SSH configuration block exposes the sensitive .ssh directory structure for a privileged remote access account. This materially aids an attacker or an over-privileged agent by revealing exactly where administrative credentials are stored and how they are used.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Host cloudrelay HostName 101.43.110.225 User administrator IdentityFile /home/cloudrelay/.ssh/id_rsa StrictHostKeyChecking=no BatchMode=yes

text

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

Repeated inline use of the SSH config path embeds the location of privileged connection material throughout the skill, increasing the blast radius of documentation leakage and making misuse easier. In this context, the skill is effectively operationalizing credential-backed access to a public cloud host.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

StrictHostKeyChecking=no BatchMode=yes

text
连接：`ssh -F /home/cloudrelay/.ssh/config cloudrelay "..."`

## 启动（DMS Docker）

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This command operationally uses the sensitive SSH configuration to access a cloud relay host for administrative actions. Embedding this access pattern in the skill lowers barriers to privileged remote control and increases risk if the skill is invoked in the wrong context or by an untrusted operator.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

bash
# 检查状态
ssh -F /home/cloudrelay/.ssh/config cloudrelay "cmd /c netstat -ano | findstr :2526 | findstr LISTEN"

# 启动
ssh -F /home/cloudrelay/.ssh/config cloudrelay "powershell -Command Start-ScheduledTask -TaskName MailRelay2526Watchdog"

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The skill provides a direct command to start a scheduled task on a cloud Windows host using privileged SSH-backed access. This is dangerous because it combines exposed credential locations with remote administrative control, enabling unauthorized service manipulation if the environment is compromised.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
ssh -F /home/cloudrelay/.ssh/config cloudrelay "cmd /c netstat -ano | findstr :2526 | findstr LISTEN"

# 启动
ssh -F /home/cloudrelay/.ssh/config cloudrelay "powershell -Command Start-ScheduledTask -TaskName MailRelay2526Watchdog"

# 停止
ssh -F /home/cloudrelay/.ssh/config cloudrelay "powershell -Command Stop-ScheduledTask -TaskName MailRelay2526Watchdog"

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The stop command likewise exposes and uses privileged SSH configuration for remote service control. In the context of a mail relay, unauthorized stopping of the watchdog can interrupt outbound email delivery and potentially create denial-of-service conditions.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

ssh -F /home/cloudrelay/.ssh/config cloudrelay "powershell -Command Start-ScheduledTask -TaskName MailRelay2526Watchdog"

停止

ssh -F /home/cloudrelay/.ssh/config cloudrelay "powershell -Command Stop-ScheduledTask -TaskName MailRelay2526Watchdog"

text

## 状态检查

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

Even a status-check command becomes sensitive here because it relies on the same exposed SSH configuration path tied to privileged access. Repetition throughout the skill amplifies the likelihood of unauthorized reuse or disclosure of the access method.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

bash
# Cloud relay 端口
ssh -F /home/cloudrelay/.ssh/config cloudrelay "cmd /c netstat -ano | findstr :2526 | findstr LISTEN"

# Docker 容器
docker ps | grep -E "mailserver|relay"

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

This step retrieves logs from the cloud relay via the exposed SSH configuration path, again exercising privileged remote access. The repeated pattern shows the skill is tightly coupled to static credential material, which is risky in shared or semi-trusted agent environments.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

docker exec mailserver tail -20 /var/log/mail/mail.log

Cloud relay 日志

ssh -F /home/cloudrelay/.ssh/config cloudrelay "powershell -Command Get-Content C:\smtp_auth_relay.log -Tail 10"

text

## 故障排查

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The troubleshooting flow begins with another privileged SSH-backed connection to the relay host, reinforcing that the skill assumes ready access to sensitive credentials. In a maintenance skill, this context makes the issue more dangerous because the commands are framed as normal operational behavior and may be run frequently.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

bash
# 1. Cloud relay 在线？
ssh -F /home/cloudrelay/.ssh/config cloudrelay "cmd /c netstat -ano | findstr :2526 | findstr LISTEN"

# 2. SSH key 权限？
docker exec mailserver ls -la /home/cloudrelay/.ssh/id_rsa

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

By instructing an operator to inspect /home/cloudrelay/.ssh/id_rsa, the skill directly references a private key file used for privileged access. This creates a concrete credential exposure risk beyond mere documentation, especially because the same skill also explains how that key is used to administer a public cloud relay.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
ssh -F /home/cloudrelay/.ssh/config cloudrelay "cmd /c netstat -ano | findstr :2526 | findstr LISTEN"

# 2. SSH key 权限？
docker exec mailserver ls -la /home/cloudrelay/.ssh/id_rsa

# 3. SSH 测试
docker exec mailserver ssh -F /home/cloudrelay/.ssh/config cloudrelay echo OK

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

By instructing an operator to inspect /home/cloudrelay/.ssh/id_rsa, the skill directly references a private key file used for privileged access. This creates a concrete credential exposure risk beyond mere documentation, especially because the same skill also explains how that key is used to administer a public cloud relay.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
ssh -F /home/cloudrelay/.ssh/config cloudrelay "cmd /c netstat -ano | findstr :2526 | findstr LISTEN"

# 2. SSH key 权限？
docker exec mailserver ls -la /home/cloudrelay/.ssh/id_rsa

# 3. SSH 测试
docker exec mailserver ssh -F /home/cloudrelay/.ssh/config cloudrelay echo OK

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The SSH connectivity test again uses the explicit sensitive config path, making the privileged access mechanism callable as part of routine operations. This combination of reusable command snippets and exposed credential locations increases misuse potential.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
docker exec mailserver ls -la /home/cloudrelay/.ssh/id_rsa

# 3. SSH 测试
docker exec mailserver ssh -F /home/cloudrelay/.ssh/config cloudrelay echo OK

# 4. 强制重试
docker exec mailserver postqueue -f

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The command queries processes on the cloud host via the same credential-backed SSH path, demonstrating broad administrative reach. This is a high-impact pattern because compromise or misuse of the underlying key could expose host-level process information and enable further operational abuse.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

bash
# watchdog 进程？
ssh -F /home/cloudrelay/.ssh/config cloudrelay "powershell -Command Get-Process python | Select Id"

# 错误日志
ssh -F /home/cloudrelay/.ssh/config cloudrelay "powershell -Command Get-Content C:\smtp_auth_relay_err.log -Tail 10"

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

Fetching error logs over privileged SSH continues the pattern of embedding secret-dependent administrative access in general documentation. This increases the chance that sensitive host access is copied, automated unsafely, or exposed to unintended readers.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md
ssh -F /home/cloudrelay/.ssh/config cloudrelay "powershell -Command Get-Process python | Select Id"

# 错误日志
ssh -F /home/cloudrelay/.ssh/config cloudrelay "powershell -Command Get-Content C:\smtp_auth_relay_err.log -Tail 10"

# 重启 watchdog
ssh -F /home/cloudrelay/.ssh/config cloudrelay "powershell -Command Stop-ScheduledTask -TaskName MailRelay2526Watchdog; Start-ScheduledTask -TaskName MailRelay2526Watchdog"

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

This restart command gives direct remote control over a scheduled task on the cloud relay using the exposed SSH configuration path. In the skill context, that means anyone following the documented flow can perform impactful service actions with privileged credentials, raising both abuse and outage risks.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

ssh -F /home/cloudrelay/.ssh/config cloudrelay "powershell -Command Get-Content C:\smtp_auth_relay_err.log -Tail 10"

重启 watchdog

ssh -F /home/cloudrelay/.ssh/config cloudrelay "powershell -Command Stop-ScheduledTask -TaskName MailRelay2526Watchdog; Start-ScheduledTask -TaskName MailRelay2526Watchdog"

text

### 收件卡住 / deferred

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The shutdown step again relies on explicit privileged SSH configuration for remote service control. Because stopping the relay watchdog can disrupt mail flow, documenting this with exposed credential paths heightens the risk of accidental or unauthorized denial of service.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

bash
# Cloud relay
ssh -F /home/cloudrelay/.ssh/config cloudrelay "powershell -Command Stop-ScheduledTask -TaskName MailRelay2526Watchdog"

# DMS
cd ~/docker-mailserver && docker compose down

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill manifest explicitly says it is not responsible for email usage, yet it includes an end-to-end test that sends a real email to an external recipient. This expands the skill from maintenance into active message transmission, creating a risk of unintended outbound mail, data leakage, or misuse of a production mail path during troubleshooting.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The document discloses the exact filesystem location of a private SSH key inside the container environment. In an operational mailserver skill focused on maintenance and troubleshooting, revealing credential material locations meaningfully lowers the barrier for credential theft or misuse if an attacker gains partial access to the system or logs.

Content

Scanner excerpt · references/architecture.md (reported line 40)May include surrounding context.

md
| Cloud watchdog | `C:\temp\smtp_auth_watchdog.py`（cloud Windows）|
| Cloud mail sender | `C:\temp\cloud_sendmail.py`（cloud Windows）|
| DMS relay script | `/tmp/dms_send4.sh`（容器内）|
| DMS SSH key | `/home/cloudrelay/.ssh/id_rsa`（容器内）|
| DMS SSH config | `/home/cloudrelay/.ssh/config`（容器内）|
| DMS Postfix master.cf | `/etc/postfix/master.cf`（容器内）|

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The document discloses the exact filesystem location of a private SSH key inside the container environment. In an operational mailserver skill focused on maintenance and troubleshooting, revealing credential material locations meaningfully lowers the barrier for credential theft or misuse if an attacker gains partial access to the system or logs.

Content

Scanner excerpt · references/architecture.md (reported line 40)May include surrounding context.

md
| Cloud watchdog | `C:\temp\smtp_auth_watchdog.py`（cloud Windows）|
| Cloud mail sender | `C:\temp\cloud_sendmail.py`（cloud Windows）|
| DMS relay script | `/tmp/dms_send4.sh`（容器内）|
| DMS SSH key | `/home/cloudrelay/.ssh/id_rsa`（容器内）|
| DMS SSH config | `/home/cloudrelay/.ssh/config`（容器内）|
| DMS Postfix master.cf | `/etc/postfix/master.cf`（容器内）|

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/architecture.md (reported line 41)May include surrounding context.

md
| Cloud mail sender | `C:\temp\cloud_sendmail.py`（cloud Windows）|
| DMS relay script | `/tmp/dms_send4.sh`（容器内）|
| DMS SSH key | `/home/cloudrelay/.ssh/id_rsa`（容器内）|
| DMS SSH config | `/home/cloudrelay/.ssh/config`（容器内）|
| DMS Postfix master.cf | `/etc/postfix/master.cf`（容器内）|

## 日志位置

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/architecture.md (reported line 50)May include surrounding context.

md
| Cloud mail sender | `C:\temp\cloud_sendmail.py`（cloud Windows）|
| DMS relay script | `/tmp/dms_send4.sh`（容器内）|
| DMS SSH key | `/home/cloudrelay/.ssh/id_rsa`（容器内）|
| DMS SSH config | `/home/cloudrelay/.ssh/config`（容器内）|
| DMS Postfix master.cf | `/etc/postfix/master.cf`（容器内）|

## 日志位置

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/architecture.md (reported line 51)May include surrounding context.

md
| Cloud mail sender | `C:\temp\cloud_sendmail.py`（cloud Windows）|
| DMS relay script | `/tmp/dms_send4.sh`（容器内）|
| DMS SSH key | `/home/cloudrelay/.ssh/id_rsa`（容器内）|
| DMS SSH config | `/home/cloudrelay/.ssh/config`（容器内）|
| DMS Postfix master.cf | `/etc/postfix/master.cf`（容器内）|

## 日志位置

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/architecture.md (reported line 59)May include surrounding context.

md
| Cloud mail sender | `C:\temp\cloud_sendmail.py`（cloud Windows）|
| DMS relay script | `/tmp/dms_send4.sh`（容器内）|
| DMS SSH key | `/home/cloudrelay/.ssh/id_rsa`（容器内）|
| DMS SSH config | `/home/cloudrelay/.ssh/config`（容器内）|
| DMS Postfix master.cf | `/etc/postfix/master.cf`（容器内）|

## 日志位置

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description and all operational guidance are written in Chinese, with no indication that the skill can operate in another language or that Chinese is a required, justified locale for a region-specific workflow. This creates a natural-language policy issue under the language/locale rule because the skill appears to impose a specific language without opt-in.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
ssh -F /home/cloudrelay/.ssh/config cloudrelay "cmd /c netstat -ano | findstr :2526 | findstr LISTEN"

# 2. SSH key 权限？
docker exec mailserver ls -la /home/cloudrelay/.ssh/id_rsa

# 3. SSH 测试
docker exec mailserver ssh -F /home/cloudrelay/.ssh/config cloudrelay echo OK

Static analysis

No suspicious patterns detected.