ClawHub
Back to skill

Security audit

Rauto Operator

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real rauto operations helper, but it needs Review because it can handle network-device credentials and destructive changes with weak scoping and redaction safeguards.

Install only if you want an agent to run rauto against real devices. Prefer protected saved connections or an external secret manager, avoid inline passwords and --save-password unless you understand where secrets are stored, require sanitized command output, protect ~/.rauto records/backups/history, and insist on dry-run plus explicit confirmation before deletes, replace restores, orchestration, or configuration changes.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:69
Finding

Plaintext SSH Credentials Exposed Through Process Arguments and Agent Responses

Content
View full analysis
--username --password \ --ssh-port 22 --device-profile cisco ``` `references/cli.md:29-37` repeats the direct plaintext-password pattern: ```bash # Direct execute rauto exec "show version" \ --host --username --password --ssh-port 22 # Direct execute with mode rauto exec "show ip route" \ --host --username --password \ --mode Enable ``` `references/cli.md:113-127` also uses plaintext credentials when saving connections and explicitly supports password persistence: ```bash # Add/update saved connection rauto connection add lab1 \ --host --username --password \ --ssh-port 22 --device-profile cisco # List/show/delete rauto connection list rauto connection show lab1 rauto connection delete lab1 # Save effective connection after successful run rauto exec "show version" \ --host --username --password \ --s ...[truncated 3399 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (22)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md
- Runnable workflow JSON templates (EN): `references/workflow-json-template.md`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md
- Web tab/card mapping (only when user asks for Web operations): `references/web.md`

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill trigger text is extremely broad and encourages activation for many ordinary operational requests, increasing the chance the agent will invoke this skill in contexts the user did not clearly intend. Because the skill is designed to execute infrastructure/device commands directly, overbroad routing materially raises the risk of unintended command execution or disclosure of operational data.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
4. For explicit read-only commands (for example `show`), tx/workflow is not required.
5. Resolve connection in this priority:
   - explicit command args > `--connection <name>` > ask for missing fields.
6. Do not ask the user to manually run commands if agent can run them.
7. Summarize outputs with important fields:
   - target, mode, success/failure, key errors, next action.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The instruction 'If user explicitly asks to execute destructive action, proceed' weakens safety gating for operations like restore with replace, deletion, or configuration changes across devices. In a skill whose purpose is direct execution against infrastructure, obeying destructive requests without an additional confirmation or scope verification can lead to irreversible outages, mass misconfiguration, or data loss from a single prompt.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
- Prefer `tx`/`tx-workflow`/`orchestrate` with rollback-aware planning over direct apply patterns.
- Run/offer `--dry-run` first for workflow-based changes.
- For `orchestrate`, review target scope, `fail_fast`, concurrency, and rollback boundary before execution.
- Never auto-run agent-generated change commands without confirmation.
- Include rollback path in the proposal before execution.

If user explicitly asks to execute destructive action, proceed.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The default prompt uses broad trigger language such as 'run rauto directly for me' and 'ask only for missing required inputs,' which encourages execution-oriented behavior with minimal friction. In a skill explicitly designed to operate devices, run workflows, orchestrate multiple devices, and perform restore/replay actions, this broad invocation scope increases the chance of unintended or unsafe execution from ambiguous user requests.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
71% confidence
Finding

This playbook explicitly supports backup creation and restore operations, which can persist and reapply potentially sensitive system state across sessions. In an agent that executes user requests directly, restore and history/replay capabilities increase the chance of sensitive data exposure or unintended reuse of prior state unless access controls, scoping, and confirmation boundaries are strict.

Content

Scanner excerpt · references/agent-execution.md (reported line 61)May include surrounding context.

md
- `rauto orchestrate ...`
- `rauto connection add ...`
- `rauto templates create|update ...`
- `rauto backup create [...]`
- `rauto backup restore <archive>` (merge mode)

## 4) Destructive operations (confirmation required)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The playbook allows destructive commands to be executed immediately when the user includes certain phrases such as '删除' or 'replace 恢复', which weakens the explicit-confirmation safeguard and creates a language-trigger bypass. In an agent-execution context, natural-language ambiguity, prompt injection, or quoted text could cause unintended destructive actions like delete or replace-restore without a separate affirmative confirmation step.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The recording examples advertise --record-level full without warning that recordings may capture sensitive command output, configuration data, secrets, or authentication material entered during sessions. Because this skill is intended for direct execution, replay, and history handling, users are likely to follow the example verbatim and create durable artifacts containing sensitive operational data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli.md (reported line 86)May include surrounding context.

md
rauto device show cisco

# Copy builtin profile to custom
rauto device copy-builtin cisco my-cisco --overwrite

# Delete custom profile
rauto device delete-custom my-cisco

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The examples explicitly use --save-password when saving a connection, which encourages credential persistence without any warning about secure storage, file permissions, or secret exposure risk. In a skill designed to execute network-device operations directly, this increases the chance that operators will store reusable device credentials locally where they may be recovered by other users, malware, backups, or logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The restore examples show merge and especially --replace operations without warning that restore can overwrite or materially alter local state, including saved connections, templates, history, and possibly stored credentials. In an automation skill that manages profiles, connections, and backups, this can lead to accidental destructive changes or restoration of unsafe state from an untrusted archive.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/examples.md (reported line 133)May include surrounding context.

Execution-style answer:

text
Operation: Duplicate builtin profile to custom profile
Command: rauto device copy-builtin cisco my-cisco --overwrite
Result: Custom profile my-cisco created/updated
Notes: Inspect with: rauto device show my-cisco

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation instructs users to pass passwords directly on the command line when testing and saving connections. Command-line secrets can be exposed via shell history, process listings, logs, screenshots, or terminal recording, which creates unnecessary credential leakage risk in an operational network automation context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The recording and replay guidance encourages capturing and reusing session data without warning that recordings may contain credentials, device configuration, topology, prompts, and other sensitive operational details. In a network administration tool, saved session artifacts can become a high-value source of secrets and internal infrastructure information if stored insecurely or shared broadly.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · references/scenarios.md (reported line 113)May include surrounding context.

md
### Web UI

1. Execute any command with recording enabled.
2. Open Recording drawer (REC floating button).
3. Use List/Raw view, filters; click “Use in Replay”.
4. Replay tab → List Records / Replay Command.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/scenarios.md (reported line 510)May include surrounding context.

CLI

  1. Create backup with auto timestamp name:
text
rauto backup create

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The restore example includes a destructive --replace operation with only minimal labeling and no strong operational safeguards. In this context, an incautious restore can overwrite current configuration/state, causing outages, loss of data, or rollback of security-relevant settings across the automation environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction 'Use this file when the user asks for Web operations' is ambiguous and overly broad for a markdown reference file. It does not define specific trigger phrases, scope boundaries, or exclusion conditions, so many ordinary requests involving web activity could unintentionally invoke this skill content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Line L001 labels the skill content as '(EN)', which signals an English-only requirement in natural language. The file does not offer an alternate language option or explain why English is required for a region-specific or compliance reason, so it appears to impose a locale constraint without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file labels multiple references as "(EN)" and "English Q/A examples" without indicating that other languages are supported or that English is optional. This can constitute a language-policy issue when the skill appears to assume English content by default rather than offering a user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The heading explicitly labels the template as "(EN)", which imposes an English-language constraint in natural language without offering an opt-in, alternative locale, or a justification that this template is region-specific. This matches the language/locale policy violation category for natural-language content.

Content

No source excerpt is available for this finding.