ClawHub
Back to skill

Security audit

Eternal System Health

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local system-health reporting skill, but its reports can expose process command snippets and it performs an external DNS check.

Install only if you are comfortable with a local health tool reading system stats, listing top process command snippets, and making a DNS lookup to google.com during network checks. Avoid running it as root unless needed, and treat saved reports as potentially sensitive because they may include host details, IP addresses, mount information, and process arguments.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/syshealth.py:161
Finding

Process Command-Line Arguments Are Exposed in Plaintext Health Reports

Content
View full analysis
= 11: processes.append({ "user": parts[0], "pid": parts[1], "cpu": parts[2], "mem": parts[3], "command": parts[10][:60], }) except (subprocess.SubprocessError, FileNotFoundError): pass return processes ``` The collected process arguments are subsequently displayed and may be saved: ```python procs = get_top_processes(5) if procs: log(f"\n📋 Top Processes (by memory)") log(f" {'PID':<8} {'CPU%':<7} {'MEM%':<7} {'Command'}") log(f" {'─' * 8} {'─' * 7} {'─' * 7} {'─' * 40}") for p in procs: log(f" {p['pid']:<8} {p['cpu']:<7} {p['mem']:<7} {p['command']}") log(f"\n{'═' * 60}") if output: with open(output, "w") as f: f.write("\n".join(lines)) print(f"\n📝 Report saved to {output}") ``` ### Technical Analysis The `ps aux` command returns complete process command lines, including arguments. Applications and administrative scripts sometimes place credentials, API tokens, database connection strings, private URLs, session identifiers, or sensitive filesystem paths in those arguments. The implementation copies up to 60 characters of each command line into the report w ...[truncated 2487 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises shell execution and file output behavior through its documented commands and options, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and review gap: an agent may invoke shell commands or write files beyond what a user or platform expects, increasing the risk of unintended command execution or filesystem modification.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/syshealth.py (reported line 92)May include surrounding context.

python
"""Get disk usage information."""
    disks = []
    try:
        output = subprocess.check_output(["df", "-h"], text=True, timeout=5)
        for line in output.strip().split("\n")[1:]:
            parts = line.split()
            if len(parts) >= 6 and parts[0].startswith("/"):

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/syshealth.py (reported line 132)May include surrounding context.

python
try:
        # Get IP addresses
        result = subprocess.run(["ip", "-4", "addr", "show"], capture_output=True, text=True, timeout=5)
        current_if = None
        for line in result.stdout.split("\n"):
            if line and not line.startswith(" "):

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill performs an external DNS lookup to google.com, causing unsolicited outbound network activity in a tool described as local system health monitoring. This can leak host usage patterns, violate restricted-network expectations, and create compliance/privacy issues in environments where passive local checks are expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The external DNS lookup occurs without user-facing warning, so users may believe the tool only inspects local system state when it actually reaches out to an external domain. This lack of disclosure is dangerous in air-gapped, monitored, or privacy-sensitive environments because it can trigger alerts or leak metadata unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Enumerating top processes and their command lines exceeds basic system-health reporting and can expose sensitive operational data such as service names, file paths, tokens embedded in command arguments, or proprietary workload details. In many environments, process command lines are materially more sensitive than CPU, memory, and disk statistics.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/syshealth.py (reported line 164)May include surrounding context.

python
"""Get top processes by CPU/memory."""
    processes = []
    try:
        result = subprocess.run(
            ["ps", "aux", "--sort=-%mem"],
            capture_output=True, text=True, timeout=5
        )

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest description emphasizes monitoring and reports, which suggests observation and presentation of system state. The implementation additionally persists report contents to a user-specified file path, introducing filesystem write behavior that is not conveyed by the description.

Content

No source excerpt is available for this finding.