ClawHub
Back to skill

Security audit

Kibana Saved Objects

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Kibana management skill, but users should be careful because it can change, overwrite, or delete dashboards and saved objects.

Install only if you intend to let the agent manage Kibana saved objects. Verify the target Kibana host, prefer HTTPS or a trusted internal network, use least-privilege access, export backups before imports or deletes, and require explicit human approval for delete, overwrite, and bulk operations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill exposes a destructive delete endpoint without any warning, confirmation guidance, or mention of irreversibility. In an agent context, this makes accidental or prompt-induced deletion of dashboards and visualizations more likely, especially when object IDs can be supplied dynamically.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The import example enables `overwrite=true` but does not warn that existing saved objects may be silently replaced. This is dangerous because imported NDJSON can modify production dashboards, visualizations, and references at scale, causing configuration loss or operational confusion.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The troubleshooting section recommends deleting 'corrupted' objects as a fix without warning about data loss, dependency breakage, or the possibility of misdiagnosis. In Kibana, deleting a referenced saved object can break dashboards, panels, and links, making recovery harder if no backup exists.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script accepts an arbitrary Kibana URL and even defaults to plain HTTP, then uploads the full NDJSON payload over the network without enforcing TLS or warning the operator. Saved object exports can contain sensitive dashboard metadata, index patterns, connectors, or references, so sending them to a non-HTTPS endpoint can expose data to interception or redirect uploads to an unintended host.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.