ClawHub
Back to skill

Security audit

experiment-lifecycle-governance

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent MLOps governance guidance, but it tells automation to bypass PIN protection for destructive experiment commands.

Review this skill before installing if agents or CI will manage real ClearML experiments. Prefer pinned package versions, avoid using --force as a default, and require a secure PIN or separate approval path for stop, cancel, delete, or PIN-clear operations.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Credential Access

High
Category
Privilege Escalation
Content
### 1. YAML/Env vs File Storage for PIN
PIN hash must NOT go into `config.yaml` (risk of git commit). Use `~/.expflow/pin.hash`.
Precedence: `pin.hash` file > `.env EXPFLOW_PIN_HASH` > `config.yaml pin.hash`.

### 2. `get_last_scalar_metrics()` clearml API
Returns nested dict: `{"Score": {"seg_total": {"last": 57.09, ...}}, ...}`. Flatten to `{"seg_total": 57.09}` for compare_scores.
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding
The documentation recommends `uvx --from expflow-pde expflow --help` without pinning an exact version. This allows execution of whatever package version is current at resolution time, increasing supply-chain risk and reducing reproducibility, especially for an MCP/server-integrated tool that may be invoked by agents.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly documents `--force` as a way to skip PIN checks on destructive operations like canceling runs, but does not prominently warn that this disables the safety control. In agentic or scripted contexts, operators may normalize bypassing the guard, making accidental or unauthorized destructive actions much easier.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The guidance says to 'Always provide `--force` / `-f` on PIN-guarded commands for CI/automation,' which operationalizes permanent bypass of the safeguard in exactly the environments where unattended destructive actions are riskiest. This weakens governance controls and could allow pipelines, agents, or compromised automation to stop/cancel/delete experiments without meaningful protection.

Static analysis

No suspicious patterns detected.