ClawHub
Back to skill

Security audit

Infrastructure

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only infrastructure skill that gives user-run cloud and backup commands, with one retention-cleanup example that users should review carefully before using.

Before installing or using this skill, treat its commands as examples to review and adapt. Be especially careful with the S3 retention cleanup and restore commands: test with listing or dry-run behavior first, confirm the exact bucket and prefix, and make sure backups are versioned or recoverable before enabling automated deletion.

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
This markdown file contains example commands that permanently delete backup objects from S3 as part of retention cleanup. While the code comments describe the mechanics, the surrounding documentation does not clearly warn users that these commands remove backups and could cause data loss if retention logic is wrong or bucket contents are misidentified.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
aws s3 cp /tmp/backup_$TIMESTAMP.dump $BUCKET/

# Cleanup local
rm /tmp/backup_$TIMESTAMP.dump

# Cleanup old backups (keep 30 days)
aws s3 ls $BUCKET/ | while read -r line; do
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
olderThan=$(date -d "30 days ago" +%s)
  if [[ $createDate -lt $olderThan ]]; then
    fileName=$(echo $line | awk '{print $4}')
    aws s3 rm $BUCKET/$fileName
  fi
done
```
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

Low
Category
Tool Misuse
Content
### Docker Volumes
```bash
# Backup volume to tarball
docker run --rm -v myapp_data:/data -v $(pwd):/backup \
  alpine tar czf /backup/data_backup.tar.gz /data

# Restore
Confidence
15% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

Low
Category
Tool Misuse
Content
alpine tar czf /backup/data_backup.tar.gz /data

# Restore
docker run --rm -v myapp_data:/data -v $(pwd):/backup \
  alpine sh -c "cd /data && tar xzf /backup/data_backup.tar.gz --strip 1"
```
Confidence
15% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Static analysis

No suspicious patterns detected.