ClawHub
Back to skill

Security audit

Aionis

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent memory-service purpose, but its automatic bootstrap can run persistent Docker code and handle local credentials with weak safeguards.

Install only if you trust the Aionis container source and are comfortable with a persistent local Docker service. Before use, prefer digest-pinned images, review or disable automatic bootstrap, protect `.runtime` credential files with restrictive permissions, avoid sourcing untrusted env files, and stop/remove the container and volume when no longer needed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
bootstrap-local-standalone.sh:114
Finding

Arbitrary Shell Execution Through a Sourced Runtime Environment File

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Warning
Location
bootstrap-local-standalone.sh:139
Finding

Cross-Session Container Persistence Enabled by Default

Content
View full analysis
/dev/null ``` The same persistent configuration is presented in `README.md`, lines 24–28: ```bash docker run -d --name aionis-standalone-local --restart unless-stopped \ -p 127.0.0.1:3001:3001 \ --env-file ./.runtime/aionis.env \ -v aionis-standalone-data:/var/lib/postgresql/data \ ghcr.io/cognary/aionis:standalone-v0.2.5 ``` ### Technical Analysis The bootstrap installs a detached Docker container with the `unless-stopped` restart policy. This directs Docker to restart the workload following Docker daemon or host restarts unless an operator explicitly stops it. The container also uses a named volume, preserving application data independently of the current shell session and container lifecycle. Although persistence can be operationally useful for a local service, enabling it automatically during a one-command skill bootstrap creates cross-session execution without a separate opt-in step. This persistence increases the impact of any compromised or substituted container image because its code can regain execution after system restarts. ### Attack Path 1. A user follows the skill documentation and runs the bootstrap script. 2. The script creates a detached container with `--restart unless-stopped`. 3. The initiating shell or agent session ends, but the container continues running. 4. When Docker or the host restarts, Docker automatically launches the container again. 5. If the image is compromised or later abused, its code retains cross-session execution until the operator explicitly stops and removes it. ### Impact A ...[truncated 509 chars]
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
bootstrap-local-standalone.sh:129
Finding

Remote Container Image Is Pulled and Executed Without Integrity Verification

Content
View full analysis
/dev/null 2>&1; then if ! docker pull "$AIONIS_IMAGE" >/dev/null; then echo "failed to pull image: ${AIONIS_IMAGE}" >&2 echo "hint: set AIONIS_IMAGE to an available local image, or run docker login for private registry" >&2 exit 1 fi fi docker rm -f "$AIONIS_CONTAINER_NAME" >/dev/null 2>&1 || true docker run -d \ --name "$AIONIS_CONTAINER_NAME" \ --restart unless-stopped \ -p "127.0.0.1:${AIONIS_PORT}:3001" \ --env-file "$ENV_FILE" \ -v "${AIONIS_VOLUME}:/var/lib/postgresql/data" \ "$AIONIS_IMAGE" >/dev/null ``` ### Technical Analysis The bootstrap fetches a container image from an external registry and immediately executes it. The image is referenced by the mutable tag `standalone-v0.2.5`, not by an immutable content digest. No cryptographic signature, provenance attestation, publisher identity, or expected digest is verified. The `AIONIS_IMAGE` environment variable also permits the caller's environment to replace the expected image with an arbitrary image reference. Therefore, the payload that actually executes can differ from the artifact reviewed in this audit. This creates a supply-chain execution boundary: compromise of the registry account, replacement of the tag, a malicious environment override, or use of an untrusted local image can cause different code to run. ### Attack Path A registry-based exploitation path is: 1. An attacker compromises the publishing account or otherwise causes the mutable tag to reference a malicious image. 2. A user runs the bootstrap on a system where that image is not already present. 3. The script runs `docker pull "$AIONIS_IMAGE"` wi ...[truncated 1137 chars]
Remediation
View remediation
`. - Verify an image signature and trusted publisher identity using a mechanism such as Cosign before execution. - Publish provenance or an SBOM and validate it as part of bootstrap. - Do not silently accept arbitrary `AIONIS_IMAGE` overrides. Require a dedicated explicit option and display a warning and confirmation when the verified image is replaced. - Reject tag-only references in production or persistent bootstrap modes. - Avoid running an already-present local image solely because its tag matches; verify that its digest equals the approved digest. - Apply container hardening such as a non-root user, dropped capabilities, `no-new-privileges`, a read-only root filesystem where supported, and resource limits. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
bootstrap-local-standalone.sh:51
Finding

API and Administrative Credentials Are Written Without Enforced Restrictive Permissions

Content
View full analysis
"$ENV_FILE" } write_clawbot_env_file() { local memory_api_key="$1" local admin_token="$2" { echo "AIONIS_BASE_URL=http://127.0.0.1:${AIONIS_PORT}" echo "AIONIS_API_KEY=${memory_api_key}" echo "AIONIS_ADMIN_TOKEN=${admin_token}" echo "AIONIS_TENANT_ID=default" echo "AIONIS_SCOPE_PREFIX=clawbot" } >"$CLAWBOT_ENV_FILE" } ``` ```bash mkdir -p "$RUNTIME_DIR" ``` ### Technical Analysis The script stores the generated memory API key and administrative token in plaintext files. When the MiniMax provider is selected, the provider API key is also written to `aionis.env`. Neither the runtime directory nor the files are created with explicit restrictive permissions. The effective permissions depend on the invoking process's ambient `umask` and any pre-existing directory or file modes. With a common `02 ...[truncated 1493 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

Health check:

bash
curl -fsS http://127.0.0.1:3001/health

Auth check (x-api-key):

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill advertises a memory-loop integration but declares no explicit tool scope while instructing use of shell capabilities later in the document. This creates an authority gap: an agent may invoke shell commands without a narrowly declared permission boundary, increasing the risk of unintended command execution or privilege expansion in environments that trust skill metadata for enforcement or review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs the agent to execute a broad local shell bootstrap command and source an environment file if the service is not running. This goes beyond normal API interaction and can execute arbitrary local code from the workspace, making the skill dangerous in adversarial or untrusted repositories where the script or env file could be modified to run malicious commands or exfiltrate secrets.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · bootstrap-local-standalone.sh (reported line 19)May include surrounding context.

sh
MINIMAX_GROUP_ID="${MINIMAX_GROUP_ID:-}"
MINIMAX_EMBED_MODEL="${MINIMAX_EMBED_MODEL:-embo-01}"
MINIMAX_EMBED_TYPE="${MINIMAX_EMBED_TYPE:-db}"
MINIMAX_EMBED_ENDPOINT="${MINIMAX_EMBED_ENDPOINT:-https://api.minimax.chat/v1/embeddings}"

need() {
  command -v "$1" >/dev/null 2>&1 || {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script generates or reuses sensitive credentials and writes them in plaintext to local env files under .runtime without setting restrictive permissions or clearly warning the user about persistence. On multi-user systems, in shared workspaces, or if the directory is later committed, these tokens could be exposed and then used to access the local Aionis service with API or admin privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

Sourcing an existing env file executes shell syntax from that file, not just variable assignments. Because the file contains secrets and is loaded from a writable runtime directory, a local attacker or accidental modification could inject arbitrary shell commands that run with the user's privileges when the bootstrap script is executed.

Content

No source excerpt is available for this finding.