ClawHub
Back to skill

Security audit

runbook-generator

Security checks for vulnerabilities and agentic risk

Overview

This runbook generator is coherent, but it needs Review because it can expose sensitive configuration details and generates privileged shell commands from untrusted project names without safe quoting.

Install only if you are comfortable with the skill reading operational configuration in the target project. Prefer running it on trusted repositories, remove or replace live .env files with .env.example before generation, review Markdown and JSON output for secrets before sharing, and treat every generated shell block as a draft rather than commands to paste blindly, especially sudo/systemctl commands.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/generate_runbook.py:577
Finding

Shell Command Injection Through Unquoted Project Paths and systemd Unit Names

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_runbook.py:785
Finding

Sensitive Environment Values Are Exposed in Markdown and JSON Output

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (35)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
python3 scripts/generate_runbook.py /path/to/project

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
python3 scripts/generate_runbook.py /path/to/project

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
python3 scripts/generate_runbook.py /path/to/project

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
python3 scripts/generate_runbook.py /path/to/project

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The skill explicitly scans .env and .env.example files, and .env files commonly contain API keys, database passwords, tokens, and other credentials. Even if the stated goal is only to extract required variable names, an implementation that reads these files can easily ingest and reproduce secret values in the generated runbook or agent context.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
| systemd units (.service) | ExecStart/Stop/Reload, dependencies, restart policy |
| Makefile | Targets (build, test, deploy, clean, etc.) |
| package.json | Scripts (start, build, test, dev, deploy) |
| .env / .env.example | Required environment variables |
| nginx.conf | Upstream servers, listen ports, locations |

## Generated Sections

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · STATUS.md (reported line 26)May include surrounding context.

md
"""Runbook Generator — create operational runbooks from project infrastructure files.

Scans Dockerfiles, docker-compose.yml, systemd units, Makefiles, package.json,
.env files, and nginx configs to produce step-by-step operational runbooks.

Pure Python stdlib — no external dependencies.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_runbook.py (reported line 5)May include surrounding context.

python
"""Runbook Generator — create operational runbooks from project infrastructure files.

Scans Dockerfiles, docker-compose.yml, systemd units, Makefiles, package.json,
.env files, and nginx configs to produce step-by-step operational runbooks.

Pure Python stdlib — no external dependencies.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_runbook.py (reported line 482)May include surrounding context.

python
"""Runbook Generator — create operational runbooks from project infrastructure files.

Scans Dockerfiles, docker-compose.yml, systemd units, Makefiles, package.json,
.env files, and nginx configs to produce step-by-step operational runbooks.

Pure Python stdlib — no external dependencies.

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The dedicated .env scanner function is a credential-adjacent capability because .env files routinely store API keys, database credentials, tokens, and other secrets. Even with partial value masking, parsing these files and exposing structured results materially increases the chance of sensitive information disclosure.

Content

Scanner excerpt · scripts/generate_runbook.py (reported line 284)May include surrounding context.

python
def scan_env_file(path):
    """Extract environment variables from .env or .env.example."""
    info = {
        "type": "env_file",
        "path": str(path),

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The project scanner explicitly looks for a live .env file and includes it in the scan set automatically. In a runbook-generation tool, this silent access to sensitive configuration increases exposure risk and may surprise users who only expected infrastructure metadata extraction.

Content

Scanner excerpt · scripts/generate_runbook.py (reported line 385)May include surrounding context.

python
if f.is_file() and "[Unit]" in f.read_text()[:200]:
            scanned.append(scan_systemd_unit(f))

    # Scan for .env (not .example)
    env_file = root / ".env"
    if env_file.exists():
        scanned.append(scan_env_file(env_file))

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

This line performs the live .env scan once the file exists, directly enabling structured extraction from a common secret store. Because the results are later surfaced in generated artifacts, the behavior can leak configuration inventory to logs, terminals, saved runbooks, or downstream consumers.

Content

Scanner excerpt · scripts/generate_runbook.py (reported line 386)May include surrounding context.

python
scanned.append(scan_systemd_unit(f))

    # Scan for .env (not .example)
    env_file = root / ".env"
    if env_file.exists():
        scanned.append(scan_env_file(env_file))

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
96% confidence
Finding

The code aggregates environment variables from scanned sources, including live .env files, and then renders them into the generated runbook. This is dangerous because environment variables commonly encode secrets, service endpoints, account identifiers, and other privileged configuration details that can materially aid attackers even when some values are masked.

Content

Scanner excerpt · scripts/generate_runbook.py (reported line 415)May include surrounding context.

python
has_npm = any(s["type"] == "package_json" for s in scanned)
    has_nginx = any(s["type"] == "nginx" for s in scanned)

    # Collect all env vars
    all_env = {}
    for s in scanned:
        if s["type"] == "env_file":

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_runbook.py (reported line 483)May include surrounding context.

python
lines.append("")
        lines.append("```bash")
        lines.append("# Copy .env.example to .env and fill in values")
        lines.append("cp .env.example .env")
        lines.append("```")
        lines.append("")
        lines.append("| Variable | Default/Example | Required |")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_runbook.py (reported line 818)May include surrounding context.

python
lines.append("")
        lines.append("```bash")
        lines.append("# Copy .env.example to .env and fill in values")
        lines.append("cp .env.example .env")
        lines.append("```")
        lines.append("")
        lines.append("| Variable | Default/Example | Required |")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises and demonstrates shell execution plus reading and writing project files, but it does not declare any explicit tool scope or permissions boundaries. That makes its operational capabilities ambiguous and increases the chance an agent invokes it with broader access than intended, especially because it processes arbitrary user-supplied project paths.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: runbook-generator
description: Generate operational runbooks from project files. Scans Dockerfiles, docker-compose.yml, systemd units, Makefiles, package.json, and config files to produce step-by-step operational runbooks with start/stop/restart/deploy/rollback/troubleshoot procedures. Use when asked to create a runbook, generate ops docs, create operational documentation, build a deployment guide, document service procedures, or create an SRE runbook. Triggers on "create runbook", "ops documentation", "deployment guide", "operational docs", "SRE runbook", "service procedures", "how to deploy".
---

# Runbook Generator

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad and common, including terms like "deployment guide," "ops documentation," and "how to deploy," which can cause the skill to activate in contexts the user did not intend. Because the skill scans infrastructure and config files, accidental invocation can expose sensitive operational details from a repository during otherwise routine conversations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description explains that it scans project files, including configuration-related artifacts, but does not warn that these files may contain secrets, internal hostnames, tokens, or deployment details that could be surfaced in the generated runbook. Omitting that warning increases the risk of users unknowingly disclosing sensitive data into generated documentation or downstream outputs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

scan_env_file parses real .env content and returns structured variable data that is later surfaced in Markdown and JSON output. In the context of a documentation skill, this broadens the tool into configuration harvesting and can leak secret inventory, feature flags, internal hostnames, and other sensitive deployment details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script inspects live .env files and surfaces the resulting variable inventory without explicit disclosure or consent gating. In a skill designed to generate runbooks, silently extracting and publishing sensitive configuration metadata increases the chance of inadvertent information exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script reads a live .env file from the target project and incorporates discovered variable names and presence/status into generated output. Even though values are masked in many cases, enumerating secret-bearing variable names and configuration structure can expose sensitive operational metadata and exceed what users may expect from a runbook generator.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code generates operational instructions such as docker compose down, docker rm, systemctl start/stop, and sudo cp into system locations, which are safety-relevant and potentially disruptive. Although the generated runbook ends with a generic review note, the script itself does not provide a clear targeted warning that the generated commands may cause downtime, replace services, or require elevated privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/generate_runbook.py (reported line 577)May include surrounding context.

python
lines.append(f"### systemd Deploy ({unit_name})")
                lines.append("")
                lines.append("```bash")
                lines.append(f"sudo cp {s['path']} /etc/systemd/system/")
                lines.append("sudo systemctl daemon-reload")
                lines.append(f"sudo systemctl enable {unit_name}")
                lines.append(f"sudo systemctl start {unit_name}")

Static analysis

No suspicious patterns detected.