ClawHub
Back to skill

Security audit

Infra As Code

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only infrastructure-as-code skill whose risky commands are expected for its purpose, but users should treat its apply and destroy examples as live cloud operations.

Before using this skill, confirm the active cloud account, region, workspace, and stack. Always review Terraform plans, CloudFormation change sets, or Pulumi previews before applying changes, and be especially careful with destroy or delete-stack commands because they can remove live resources and data.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The quick-start sequence presents `terraform apply` and especially `terraform destroy` without an adjacent warning about creating, modifying, or deleting real cloud resources. In an IaC skill, users may copy commands verbatim; omitting explicit caution increases the risk of accidental deployment charges, outage, or irreversible teardown in the wrong environment.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
Documenting `aws cloudformation delete-stack` without an explicit warning can lead users to remove production stacks and all dependent resources unintentionally. Because CloudFormation deletion is an operationally destructive action, the lack of contextual warning increases the chance of accidental service disruption or data loss.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
Listing `pulumi destroy` in the core workflow without a nearby caution normalizes a destructive command alongside routine preview/apply operations. In infrastructure tooling, this can cause accidental resource teardown, downtime, and data loss when users execute examples in the wrong stack or account.

Static analysis

No suspicious patterns detected.