ClawHub
Back to skill

Security audit

Argocd Deployment Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent ArgoCD/Kubernetes diagnostic guide, with expected read-heavy access and one temp-file handling issue users should harden before using on sensitive manifests.

Installers should treat this as a read-only operational audit skill. Before using it, confirm the agent has only the ArgoCD/Kubernetes permissions needed for the requested app or project, avoid all-cluster scans unless intended, and replace the fixed /tmp manifest output examples with secure temporary files and cleanup.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:211
Finding

Predictable Temporary Files Expose Manifests to Disclosure and Symlink-Based File Clobbering

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 211–213
Vulnerability Type: Predictable and insecure temporary-file handling
Risk Level: Medium

Vulnerable Code

bash
# Extract rendered manifests
argocd app manifests <app-name> --source live > /tmp/live-manifests.yaml
argocd app manifests <app-name> --source git > /tmp/git-manifests.yaml

Technical Analysis

The documented commands write rendered Kubernetes manifests to fixed paths in the shared /tmp directory. They do not securely create the files, restrict their permissions, verify that the destinations are regular files, or remove them after use.

Shell output redirection opens the destination with truncation and ordinarily follows symbolic links. A local attacker able to create files in /tmp can therefore pre-create /tmp/live-manifests.yaml or /tmp/git-manifests.yaml as a symbolic link to another file writable by the account running the Skill. When the command executes, the linked file may be truncated and replaced with manifest data.

Rendered manifests may contain Kubernetes Secret objects, environment variables, internal service addresses, repository details, security settings, or other operationally sensitive configuration. Depending on the process umask and local environment, fixed output files may also be readable by other users and remain available after the analysis ends.

Attack Path

  1. A local attacker predicts the fixed temporary path, such as /tmp/live-manifests.yaml.
  2. Before the analysis runs, the attacker creates that path as a symbolic link to a file writable by the Skill's operating-system account.
  3. The operator follows the Skill instructions and runs the manifest extraction command.
  4. Shell redirection follows the symbolic link and truncates or overwrites the linked target with rendered Kubernetes manifests.
  5. Alternatively, if the resulting temporary file has permissive permis ...[truncated 1015 chars]
Remediation
View remediation

Remediation Suggestions

  • Create a private temporary directory with mktemp -d rather than using predictable filenames.
  • Set umask 077 before creating files so only the current operating-system user can access them.
  • Register a cleanup trap to remove the directory and its contents on normal exit, interruption, or failure.
  • Avoid storing rendered manifests when possible; stream command output directly into the required analysis tool.
  • Run the analysis under a dedicated, least-privileged account and avoid running it as root.
  • Treat all rendered manifests as sensitive because they may include Secret resources or credentials.
  • If files must be retained, use a protected directory with explicit ownership and mode 0600, and establish a defined retention policy.

Example hardened pattern:

bash
umask 077
tmpdir="$(mktemp -d)" || exit 1
trap 'rm -rf -- "$tmpdir"' EXIT HUP INT TERM

argocd app manifests "$app_name" --source live > "$tmpdir/live-manifests.yaml"
argocd app manifests "$app_name" --source git > "$tmpdir/git-manifests.yaml"

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Privileged Kubernetes Workload

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Code deploys a privileged Kubernetes workload (privileged container, hostPath mount, or host namespaces). This grants root on the node and is a node/cluster takeover vector.

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

md
**Security checks:**

- Containers running as root or with `privileged: true`
- Missing SecurityContext, `readOnlyRootFilesystem`, `runAsNonRoot`
- Missing resource limits (CPU/memory) — noisy neighbor risk
- `hostNetwork`, `hostPID`, `hostIPC` enabled