ClawHub
Back to skill

Security audit

Ansible

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate Ansible automation skill, but it ships powerful playbooks and real-looking default server targets that could change remote systems if run casually.

Review and replace the bundled inventory before running anything. Use --list-hosts, --check, --diff, and --limit; verify console or out-of-band access before SSH/firewall hardening; avoid disabling host key checking; reconsider passwordless sudo; and pin or verify third-party package sources for production.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill promotes server provisioning, security hardening, firewall changes, SSH configuration, and deployment actions without an upfront warning that these operations modify remote systems and can cause lockout or service disruption if misapplied. In an automation context, omission of impact warnings increases the chance of unsafe execution against production hosts.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The inventory examples show plaintext-style credential placement patterns, including ansible_ssh_pass and host-specific connection details, without a clear warning not to store real secrets in inventories or documentation. This can normalize insecure secret handling and lead users to commit credentials into repositories or leave them unencrypted on disk.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The troubleshooting section suggests setting host_key_checking = False without warning that this disables SSH server identity verification and exposes users to man-in-the-middle attacks. In an infrastructure automation skill, encouraging this shortcut is especially dangerous because it can affect many hosts and normalize insecure trust behavior.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The guide explicitly recommends disabling SSH host key checking as a troubleshooting option, which weakens SSH's protection against machine-in-the-middle attacks and host impersonation. Although it notes this is 'less secure,' it still presents an insecure workaround that users may copy into routine use without strong guardrails or temporary-use guidance.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This task grants the deploy user unrestricted passwordless sudo via `NOPASSWD:ALL`, which creates a full privilege-escalation path from that account to root. In an infrastructure automation skill, this is especially dangerous because the role also provisions SSH access for the same user, so compromise of that account or key immediately yields root-level control of the host.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
state: present
        exclusive: no
        
    - name: Allow deploy user passwordless sudo
      ansible.builtin.lineinfile:
        path: /etc/sudoers.d/{{ deploy_user }}
        line: "{{ deploy_user }} ALL=(ALL) NOPASSWD:ALL"
Confidence
97% confidence
Finding
sudo

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# Option 1: Ask for password
ansible-playbook site.yml --ask-become-pass

# Option 2: Use passwordless sudo on target
# /etc/sudoers.d/myuser:
myuser ALL=(ALL) NOPASSWD:ALL
Confidence
92% confidence
Finding
sudo

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
- common_deploy_ssh_pubkey is defined
  tags: [common, users, ssh]

- name: Allow deploy user passwordless sudo
  ansible.builtin.lineinfile:
    path: "/etc/sudoers.d/{{ common_deploy_user }}"
    line: "{{ common_deploy_user }} ALL=(ALL) NOPASSWD:ALL"
Confidence
90% confidence
Finding
sudo

Credential Access

High
Category
Privilege Escalation
Content
- name: Install NodeSource GPG key
  ansible.builtin.shell: |
    curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg
  args:
    creates: /etc/apt/keyrings/nodesource.gpg
  tags: [nodejs]
Confidence
88% confidence
Finding
keyring

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.