Security audit

assethub-claw

Security checks across malware telemetry and agentic risk

Overview

The skill is useful for AssetHub asset work, but it exposes broad admin APIs and stores login credentials in local temporary files, so it should be reviewed before install.

Install only for trusted AssetHub operators with appropriately limited accounts. Avoid putting real passwords into prompts, prefer short-lived tokens or a protected secret store, restrict credentials with server-side RBAC, use HTTPS or localhost-only API targets, and treat backup, system-config, service-token, tenant, role, and generic wx-cloud commands as admin-only actions requiring explicit human approval.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documents direct shell, network, and environment-variable based capabilities but does not declare a corresponding permission model or constrain when those capabilities may be used. That mismatch increases the chance an agent can execute powerful local and network operations without clear least-privilege boundaries or user awareness.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: Although presented as an asset lifecycle assistant, the skill also exposes broad administrative surfaces such as tenant, permission, module, and system management. This is a scope expansion issue: operators may invoke privileged actions unrelated to the stated business purpose, increasing blast radius if the skill is misused or prompted adversarially.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The documentation includes backup restore and tenant/schema-migration style operations that can alter or damage the platform well beyond normal asset workflow handling. In the context of an asset assistant, such destructive infrastructure operations are unjustified and materially increase the chance of severe accidental or malicious impact.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill exposes system configuration changes, including database connection settings and credential modification, which are unrelated to ordinary asset management workflows. If invoked, these actions could disrupt service, redirect data flows, or replace credentials, leading to compromise or outage.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: User, role, and permission administration is included despite the skill being framed as an asset workflow assistant. That creates unnecessary privilege-management capability, enabling account changes or escalation paths that exceed the business purpose and increase security risk.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The document says web-invoked sessions must not switch tenants, yet it also documents a generic tenant-switch mechanism without binding that restriction to the command itself. This inconsistency can lead to cross-tenant access mistakes or abuse if session context is not enforced everywhere.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The catalog documents a large user/permission/organization surface, including role, tenant, menu, and user-management APIs, which exceeds the skill’s declared asset-lifecycle purpose. In an agent skill context, exposing undocumented administrative capability increases the chance of over-broad tool use, privilege misuse, and accidental access to identity-management functions unrelated to the user’s task.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file includes infrastructure and system-administration capabilities such as health, metrics, circuit-breakers, and other operational endpoints not reflected in the skill’s business description. In a tool-consuming agent environment, this broadens reachable attack surface and may expose sensitive operational data or control functions that can aid reconnaissance or service disruption.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Database backup, download, restore, and schema-altering operations are clearly unrelated to normal asset-lifecycle workflows and represent powerful administrative actions. If an agent or downstream user can reach these endpoints, they could exfiltrate full datasets, destroy integrity through rollback/restore, or alter tenancy isolation, making this especially dangerous in a business-data platform.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Service-token creation, listing, scope discovery, and revocation expose machine-auth management that is outside the declared asset-business intent. If misused, these APIs can enable credential proliferation, privilege escalation via token minting, and persistence across systems that trust those tokens.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The wx-cloud endpoints provide generic add/query/update/remove/count/aggregate operations over a cloud database, which is far broader than a task-specific asset-management interface. In an agent setting, generic data-plane CRUD can be repurposed to access or manipulate arbitrary collections, leading to mass data exposure, tampering, or cross-domain abuse if authorization is imperfect.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This reference file exposes and normalizes a much broader attack surface than the skill’s stated asset-lifecycle purpose, including tenant administration, backup/restore, auth, and system-management APIs. Even if only documentation, bundling these capabilities into the skill materially increases the chance that an agent will invoke privileged or out-of-scope operations through prompt confusion, overbroad tool selection, or future automation tied to this map.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documented backup endpoints include destructive and highly privileged capabilities such as restore and schema-altering operations that are unrelated to routine asset workflow assistance. If an agent can discover and act on these operations, accidental or malicious invocation could cause data loss, service disruption, or cross-tenant integrity issues.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Authentication and service-token administration functions are security-sensitive control-plane operations, not ordinary asset-business actions. Their presence in a general business assistant creates a path for token enumeration, revocation abuse, or privilege expansion if the agent is induced to interact with these endpoints.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: User, role, menu, and tenant configuration capabilities exceed the business-facing purpose described for the skill and expose identity/authorization administration functions. In an agent context, documenting these paths can enable privilege-affecting actions through prompt injection, task confusion, or misuse of broad backend credentials.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Low-level health, metrics, readiness, circuit-breaker, and similar system endpoints reveal operational internals and may permit control actions beyond the skill’s declared purpose. In aggregate, this information can aid reconnaissance and, where mutating endpoints exist, enable service-impacting actions inappropriate for a general asset assistant.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill instructs the agent to write user-provided usernames and passwords to a local temporary file for later reuse, without meaningful warning or safer alternatives. Persisting raw credentials on disk substantially raises the risk of credential theft, reuse by other processes, and unintended disclosure.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The skill documents many create, update, delete, approval, restore, and configuration actions but lacks a prominent global warning that the commands can modify or delete live business data. That omission increases the likelihood of unsafe operator use, especially when an agent may execute commands from natural-language requests.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script stores session tokens and temporary credentials in predictable files under /tmp, including a temp session file that may contain plaintext username/password. On multi-user systems, predictable temporary paths are vulnerable to symlink attacks, unauthorized reads, or clobbering by another local user/process unless strict creation permissions and safe temp-file handling are enforced.

Ssd 3

High

Confidence: 99% confidence
Finding: The instructions explicitly tell the agent to persist conversational login credentials in a local session file for automatic reuse. This is dangerous because plaintext credential storage creates a direct secret-at-rest exposure on the host and broadens compromise from a single session to any process or user able to read the file.

Ssd 3

High

Confidence: 99% confidence
Finding: The quick-start section repeats and normalizes the practice of automatically saving and reusing credentials from the conversation, reinforcing insecure secret handling as a standard workflow. Repetition in operational guidance makes accidental deployment of plaintext credential persistence more likely.

Ssd 3

High

Confidence: 99% confidence
Finding: The document explicitly instructs the agent to reconstruct and use a masked password value from Web context, even stating that the visible masked prefix is the real password and the ellipsis is not part of it. This is a direct credential disclosure pattern: it encourages recovery and reuse of a secret that was intentionally masked, increasing the risk of account compromise, cross-tenant access, and leakage into logs, temp files, or downstream tools.

Ssd 4

High

Confidence: 96% confidence
Finding: The checklist explicitly defines a high-risk write entrypoint with `bypass_high_risk_gate: true` and states it does not require secondary confirmation. In an asset-management and maintenance workflow, this weakens a deliberate safety control around state-changing operations, making it easier for prompt injection, user misunderstanding, or automation mistakes to submit repair requests without explicit re-authorization.

External Transmission

Medium

Category: Data Exfiltration
Content: fi local response response="$(curl -sS -X POST "$(normalize_url /users/login)" \ -H 'Content-Type: application/json' \ --data-binary "{\"username\":\"${username}\",\"password\":\"${password}\"}")"
Confidence: 94% confidence
Finding: curl -sS -X POST "$(normalize_url /users/login)" \ -H 'Content-Type: application/json' \ --data-binary

External Transmission

Medium

Category: Data Exfiltration
Content: fi local response response="$(curl -sS -X POST "$(normalize_url /users/login)" \ -H 'Content-Type: application/json' \ --data-binary "{\"username\":\"${username}\",\"password\":\"${password}\"}")"
Confidence: 94% confidence
Finding: curl -sS -X POST "$(normalize_url /users/login)" \ -H 'Content-Type: application/json' \ --data-binary

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.