T01 · Skill Instruction Hijacking
Error
- Location
scripts/ops-incident-router.sh:63- Finding
Untrusted detector trigger is embedded in downstream agent instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
AgentOps Guardrails
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its ops-monitoring purpose, but its router can place untrusted alert text into downstream investigator instructions.
Install only if you will run it on trusted detector inputs or add trigger allowlisting before any agent consumes router task text. Review cleanup targets before running clean-generated.sh, and pin the ClawHub publisher command if republishing.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ops-incident-router.sh:94- Finding
Non-atomic guard acquisition permits duplicate incident workflows
- Content
View full analysis
> "$ROUTER_OUT" if [[ "$LIVE" == "true" ]]; then bash "$SCRIPT_DIR/incident-state-update.sh" --action start --check-id "$check_id" --severity "$severity" --state-file "$STATE_FILE" >/dev/null fi ``` The state writer also uses a shared predictable temporary path in `scripts/incident-state-update.sh:77-83`: ```python def write_state(path: str, state: dict): os.makedirs(os.path.dirname(path) or ".", exist_ok=True) tmp = f"{path}.tmp" with open(tmp, "w", encoding="utf-8") as f: json.dump(state, f, indent=2, ensure_ascii=True) f.write("\n") os.replace(tmp, path) ``` ### Technical Analysis Guard checking and state acquisition occur in separate processes without a shared lock or atomic compare-and-set operation. The router also emits and records the `spawn` action before marking the incident as in flight. Two concurrent live router processes can consequently both read the same state, both receive `allowed=true`, and both emit a spawn action. Their later updates ...[truncated 1347 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:7- Finding
Publishing instructions execute an unpinned mutable npm package
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/clean-generated.sh:8- Finding
Cleanup script recursively deletes files using broad filename patterns
- Content
View full analysis
/dev/null || true fi ``` ### Technical Analysis The cleanup command recursively removes every regular file ending in `.jsonl` or `.lock` anywhere below the project root. It then deletes every file and symbolic link under the example workspace, regardless of whether each entry was generated by this Skill. The script has no generated-artifact manifest, ownership validation, confirmation prompt, or dry-run mode. As the project evolves, legitimate fixtures, diagnostic evidence, or manually created files matching these broad criteria can be deleted. The fixed root is derived from the script location, which limits deletion to the project tree under normal execution. The issue is therefore destructive overreach within that tree rather than arbitrary path injection. ### Attack Path 1. A user or another process stores a legitimate `.jsonl` or `.lock` file under the project root, or stores any important file under `examples/workspace`. 2. The user follows the documented republishing procedure and executes `bash scripts/clean-generated.sh`. 3. `find` matches the legitimate file. 4. `unlink` removes it without confirmation or recovery support. ### Impact Assessment The script does not grant elevated privileges. It can delete any matching file within the project tree that is writable by the invoking user. Potential effects include loss of incident evidence, test fixtures, local runtime records, ...[truncated 152 chars]- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description presents itself as a production-safe anomaly detection and incident routing workflow, but the referenced behavior includes cleanup and possible workspace artifact removal that is outside that stated purpose. This kind of capability mismatch can mislead operators into granting trust or execution in environments where deletion side effects are unexpected, increasing the likelihood of accidental data loss or unsafe automation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill description presents itself as a production-safe anomaly detection and incident routing workflow, but the referenced behavior includes cleanup and possible workspace artifact removal that is outside that stated purpose. This kind of capability mismatch can mislead operators into granting trust or execution in environments where deletion side effects are unexpected, increasing the likelihood of accidental data loss or unsafe automation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill description presents itself as a production-safe anomaly detection and incident routing workflow, but the referenced behavior includes cleanup and possible workspace artifact removal that is outside that stated purpose. This kind of capability mismatch can mislead operators into granting trust or execution in environments where deletion side effects are unexpected, increasing the likelihood of accidental data loss or unsafe automation.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/ops-threshold-detector.sh`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/ops-threshold-detector.sh`
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The README instructs users to run
npx clawhub@latest publish, which fetches and executes the latest package version at runtime rather than a pinned, reviewed release. That creates a supply-chain risk: if the package is compromised or a breaking/malicious version is published later, anyone following the instructions could execute untrusted code on their system.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises and invokes shell scripts that read and write local files, but the manifest does not declare any explicit tool scope or permissions boundary. That makes the operational capability opaque to reviewers and increases the chance the skill is executed with broader file and shell access than intended, which is risky for a skill that manipulates state and generated artifacts.
- Content