ClawHub
Back to skill

Security audit

Alicloud Security Cloudfw

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Alibaba Cloud Firewall management skill, but it should be used only with least-privilege cloud credentials because it can guide real firewall changes.

Install only if you intend to let an agent help manage Alibaba Cloud Cloud Firewall. Use a dedicated least-privilege AccessKey, confirm the account, region, target resources, and intended changes before any mutation, and review saved outputs for accidental sensitive data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill exercises sensitive capabilities—reading credentials from environment/config, writing files, and making outbound network calls—without declaring permissions. This undermines least-privilege review because users and platform controls cannot easily understand or constrain what the skill can access before execution. In this context, the risk is elevated because the skill handles cloud credentials and performs API calls against security infrastructure.

Tp4

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding
The skill is presented as managing Cloud Firewall resources, but the documented workflow also performs OpenAPI metadata discovery and exports local API documentation artifacts. That mismatch can mislead reviewers and users about actual behavior, causing unintended network access and artifact generation beyond the stated purpose; for a security-management skill, hidden discovery behavior increases concern because it broadens the operational surface around cloud accounts.

VirusTotal

50/50 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.