ClawHub
Back to skill

Security audit

Grafana

Security checks for vulnerabilities and agentic risk

Overview

This Grafana skill is powerful and needs careful use, but its write access, credentials, automation, and approval requirements are disclosed and aligned with its purpose.

Install only if you are comfortable giving Maton-mediated access to your Grafana instance. Use least-privilege Grafana credentials, confirm every write with exact resource identifiers, avoid raw API keys unless the CLI cannot be used, and treat optional functions, triggers, destinations, and --exec watchers as separate persistent automation that should be approved and removed when no longer needed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill states alert-rule operations are effectively read-only except on specific confirmed requests, but elsewhere it admits the generic passthrough can forward arbitrary Grafana paths and methods, including provisioning writes. This creates a capability/expectation mismatch that could lead an agent or user to underestimate that instance-wide alerting configuration can be modified or deleted through the same skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The description says only documented Grafana endpoints are used unless the user asks for another endpoint by name, yet the file later documents a generic passthrough that forwards any Grafana path and method. That inconsistency weakens the security boundary and may cause unsafe reliance on documentation as if it were an enforced allowlist when it is not.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill bundles broad hosted-function, trigger, destination, and local --exec automation capabilities alongside the Grafana integration. Even though the text includes many warnings, these constructs materially expand the operational surface from one-off Grafana API access to persistent automation, code execution, and data forwarding, increasing the chance of misuse or over-privileged workflows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest says Grafana is not an event source and that trigger reference files under references//triggers.md are platform event catalogues shared across skills, not Grafana capabilities. This file nevertheless embeds detailed Linear webhook event types, parameters, and payload schemas, which introduces a capability context outside the Grafana integration's purpose even if framed as shared reference material.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

Saying the automation reference sections add no Grafana capability is misleading because they still document real executable capabilities: deploying hosted code, creating triggers and destinations, and running local handlers on events. Even if they do not expand Grafana's upstream API itself, they expand what an agent can cause to happen in the platform and can obscure that security-relevant increase in execution and exfiltration surface.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.