ClawHub
Back to skill

Security audit

Devcontainer Validator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a user-run devcontainer.json validator, and the scary strings appear to be detection rules and examples rather than actions the skill performs.

Install only if you want a local devcontainer.json checker. It is appropriate to run on devcontainer files you choose, but treat its output as lint guidance and review warnings before changing container security settings.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)

Privileged Kubernetes Workload

High
Category
Tool Misuse
Content
| Ports & networking (4) | forwardPorts not array, invalid port numbers, port out of range, portsAttributes referencing unlisted ports | `"forwardPorts": [99999]` |
| Lifecycle scripts (4) | Invalid command type, empty commands, shell injection patterns, onCreateCommand usage hints | `"postCreateCommand": ""` |
| Customizations (3) | extensions not array of strings, invalid extension ID format, settings not object | `"extensions": [123]` |
| Best practices (3+) | Missing remoteUser (root warning), privileged: true, missing workspaceFolder, dangerous capAdd entries | `"capAdd": ["SYS_ADMIN"]` |

### Output formats
Confidence
70% confidence
Finding
Code deploys a privileged Kubernetes workload (privileged container, hostPath mount, or host namespaces). This grants root on the node and is a node/cluster takeover vector.

Privileged Kubernetes Workload

High
Category
Tool Misuse
Content
| Ports & networking (4) | forwardPorts not array, invalid port numbers, port out of range, portsAttributes referencing unlisted ports | `"forwardPorts": [99999]` |
| Lifecycle scripts (4) | Invalid command type, empty commands, shell injection patterns, onCreateCommand usage hints | `"postCreateCommand": ""` |
| Customizations (3) | extensions not array of strings, invalid extension ID format, settings not object | `"extensions": [123]` |
| Best practices (3+) | Missing remoteUser (root warning), privileged: true, missing workspaceFolder, dangerous capAdd entries | `"capAdd": ["SYS_ADMIN"]` |

### Output formats
Confidence
70% confidence
Finding
Code deploys a privileged Kubernetes workload (privileged container, hostPath mount, or host namespaces). This grants root on the node and is a node/cluster takeover vector.

Privileged Kubernetes Workload

High
Category
Tool Misuse
Content
| Ports & networking (4) | forwardPorts not array, invalid port numbers, port out of range, portsAttributes referencing unlisted ports | `"forwardPorts": [99999]` |
| Lifecycle scripts (4) | Invalid command type, empty commands, shell injection patterns, onCreateCommand usage hints | `"postCreateCommand": ""` |
| Customizations (3) | extensions not array of strings, invalid extension ID format, settings not object | `"extensions": [123]` |
| Best practices (3+) | Missing remoteUser (root warning), privileged: true, missing workspaceFolder, dangerous capAdd entries | `"capAdd": ["SYS_ADMIN"]` |

### Output formats
Confidence
70% confidence
Finding
Code deploys a privileged Kubernetes workload (privileged container, hostPath mount, or host namespaces). This grants root on the node and is a node/cluster takeover vector.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
DANGEROUS_CAPS = {"SYS_ADMIN", "NET_ADMIN", "SYS_PTRACE", "SYS_RAWIO", "NET_RAW"}

SHELL_INJECTION_PATTERNS = [
    (r'\brm\s+-rf\s+/', "rm -rf / detected"),
    (r'curl\s+[^\|]*\|\s*(ba)?sh', "curl piped to shell"),
    (r'wget\s+[^\|]*\|\s*(ba)?sh', "wget piped to shell"),
    (r'chmod\s+777\b', "chmod 777 detected"),
Confidence
100% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
DANGEROUS_CAPS = {"SYS_ADMIN", "NET_ADMIN", "SYS_PTRACE", "SYS_RAWIO", "NET_RAW"}

SHELL_INJECTION_PATTERNS = [
    (r'\brm\s+-rf\s+/', "rm -rf / detected"),
    (r'curl\s+[^\|]*\|\s*(ba)?sh', "curl piped to shell"),
    (r'wget\s+[^\|]*\|\s*(ba)?sh', "wget piped to shell"),
    (r'chmod\s+777\b', "chmod 777 detected"),
Confidence
100% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High
Category
YARA Match
Content
eCommand", "shutdownAction",
    "init", "privileged", "capAdd", "securityOpt",
    "workspaceFolder", "workspaceMount",
}

LIFECYCLE_COMMANDS = [
    "postCreateCommand", "postStartCommand", "postAttachCommand",
    "onCreateCommand", "updateContentCommand",
]

DANGEROUS_CAPS = {"SYS_ADMIN", "NET_ADMIN", "SYS_PTRACE", "SYS_RAWIO", "NET_RAW"}

SHELL_INJECTION_PATTERNS = [
    (r'\brm\s+-rf\s+/', "rm -rf / detected"),
    (r'curl\s+[^\|]*\|\s*(ba)?sh', "curl piped to shell"),
    (r'wget\s+[^\|]*\|\s*(ba)?sh', "wget piped to shell"),
    (r'chmod\s+777\b', "chmod 777 detected"),
    (r'\beval\s+', "eval usage detected"),
    (r'>\s*/dev/sd[a-z]', "writing to raw block device"),
    (r'mkfs\b', "mkfs (format disk) detected"),
    (r':(){ :\|:& };:', "fork bomb detected"),
]

EXTENSION_ID_RE = re.compile(r'^[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+$')
OCI_REF_RE = re.compile(
    r'^(ghcr\.io/|docker\.io/|mcr\.microsoft\.com/|[a-zA-Z0-9._-]+\.azurecr\.io/)'
    r'[a-zA-Z0-9._/-]+(:[a-zA-Z0-9._-]+)?$
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
(r'\brm\s+-rf\s+/', "rm -rf / detected"),
    (r'curl\s+[^\|]*\|\s*(ba)?sh', "curl piped to shell"),
    (r'wget\s+[^\|]*\|\s*(ba)?sh', "wget piped to shell"),
    (r'chmod\s+777\b', "chmod 777 detected"),
    (r'\beval\s+', "eval usage detected"),
    (r'>\s*/dev/sd[a-z]', "writing to raw block device"),
    (r'mkfs\b', "mkfs (format disk) detected"),
Confidence
90% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# ---------------------------------------------------------------------------

def strip_jsonc(text):
    """Remove // and /* */ comments and trailing commas from JSONC text."""
    result = []
    i = 0
    length = len(text)
Confidence
90% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
(r'\brm\s+-rf\s+/', "rm -rf / detected"),
    (r'curl\s+[^\|]*\|\s*(ba)?sh', "curl piped to shell"),
    (r'wget\s+[^\|]*\|\s*(ba)?sh', "wget piped to shell"),
    (r'chmod\s+777\b', "chmod 777 detected"),
    (r'\beval\s+', "eval usage detected"),
    (r'>\s*/dev/sd[a-z]', "writing to raw block device"),
    (r'mkfs\b', "mkfs (format disk) detected"),
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
"""Best practices rules (3+)."""
    if "remoteUser" not in data:
        issues.append(("warning", "missing-remote-user",
                        "No 'remoteUser' specified — container will run as root"))

    if data.get("privileged") is True:
        issues.append(("warning", "privileged-container",
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
"""Best practices rules (3+)."""
    if "remoteUser" not in data:
        issues.append(("warning", "missing-remote-user",
                        "No 'remoteUser' specified — container will run as root"))

    if data.get("privileged") is True:
        issues.append(("warning", "privileged-container",
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.