ClawHub
Back to skill

Security audit

Arquitecto de migracion

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent migration-planning skill, but it generates ready-to-run destructive rollback and SQL guidance with unsafe automatic rollback defaults that users should review before use.

Review generated SQL and rollback runbooks manually before execution, especially DROP, DELETE, restore, Terraform, Kubernetes, AWS, systemctl, and curl commands. Do not enable automatic rollback actions without explicit human approval, tested backups, staging validation, scoped credentials, and rollback drills.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/compatibility_checker.py:235
Finding

Untrusted Schema Values Embedded in Generated SQL Statements

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill instructs the agent to invoke local Python scripts and read reference files, which implies shell and file access, but it does not declare any explicit tool scope or permissions boundary. Without an allowlist, a host system may grant broader-than-necessary capabilities, increasing the chance of unintended file access, arbitrary command execution, or network-enabled side effects if the referenced scripts are modified or misused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The CDC reconciliation example applies INSERT, UPDATE, and DELETE operations directly, including deletion of target records, without a clear warning that the example is state-changing and potentially destructive. In migration contexts, delete behavior is especially risky because replay, malformed CDC events, or targeting mistakes can remove valid data and amplify operational impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The document includes concrete automated correction logic that inserts and updates target data, and the surrounding markdown does not prominently warn that these actions can modify production systems if dry-run protections are disabled. In a migration skill, operators may treat reference code as implementation guidance, so omission of explicit safety guardrails increases the risk of unintended data corruption or unauthorized production changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The example includes DROP COLUMN email and renaming steps in a reference catalog without an explicit warning that the contract phase is destructive and should only occur after verified backups, rollback readiness, and migration validation. In a migration-planning skill, users may copy these snippets into real runbooks, so omission of cautionary guidance increases the chance of irreversible data loss or premature schema removal.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/zero_downtime_techniques.md (reported line 777)May include surrounding context.

md
async def external_api_check():
    """Check external API availability"""
    response = await http_client.get("https://api.example.com/health")
    return response.status_code == 200

async def memory_check():

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The tool auto-generates executable rollback SQL containing destructive operations such as DROP TABLE IF EXISTS and presents them as migration guidance without prominent safety warnings, confirmation requirements, or environment scoping. In a migration skill, operators may copy these scripts directly into production workflows, increasing the chance of accidental data loss or service disruption during rollback or testing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The generated rollback for added columns uses ALTER TABLE ... DROP COLUMN, which can permanently delete data accumulated after deployment. Because the script is emitted as a ready-to-use rollback artifact without explicit disclosure of destructive consequences, users may execute it under incident pressure and unintentionally lose production data.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/rollback_generator.py (reported line 78)May include surrounding context.

python
condition: str
    metric_threshold: Optional[Dict[str, Any]]
    evaluation_window_minutes: int
    auto_execute: bool
    escalation_contacts: List[str]

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/rollback_generator.py (reported line 537)May include surrounding context.

python
condition: str
    metric_threshold: Optional[Dict[str, Any]]
    evaluation_window_minutes: int
    auto_execute: bool
    escalation_contacts: List[str]

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/rollback_generator.py (reported line 584)May include surrounding context.

python
condition: str
    metric_threshold: Optional[Dict[str, Any]]
    evaluation_window_minutes: int
    auto_execute: bool
    escalation_contacts: List[str]

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/rollback_generator.py (reported line 602)May include surrounding context.

python
condition: str
    metric_threshold: Optional[Dict[str, Any]]
    evaluation_window_minutes: int
    auto_execute: bool
    escalation_contacts: List[str]

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/rollback_generator.py (reported line 977)May include surrounding context.

python
condition: str
    metric_threshold: Optional[Dict[str, Any]]
    evaluation_window_minutes: int
    auto_execute: bool
    escalation_contacts: List[str]

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The generator emits rollback scripts containing destructive SQL, Kubernetes, Terraform, AWS, and file operations directly into output artifacts without any explicit danger labeling, approval gate, or safeguards. In the context of a migration skill, operators may treat generated runbooks as trusted and execute them during incidents, increasing the chance of accidental destructive actions against production systems.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/rollback_generator.py (reported line 156)May include surrounding context.

python
},
                "configuration_rollback": {
                    "restore_config_map": "kubectl apply -f {original_config_file}",
                    "revert_feature_flags": "curl -X PUT {feature_flag_api}/flags/{flag_name} -d '{\"enabled\": false}'",
                    "restore_environment_vars": "kubectl set env deployment/{deployment_name} {env_var_name}={original_value}"
                }
            },

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/rollback_generator.py (reported line 189)May include surrounding context.

python
"curl -f {health_check_url}",
                "kubectl get pods -l app={service_name} --field-selector=status.phase=Running",
                "kubectl logs deployment/{service_name} --tail=100 | grep -i error",
                "curl -f {service_endpoint}/api/v1/status"
            ],
            "infrastructure": [
                "aws ec2 describe-instances --instance-ids {instance_id} --query 'Reservations[*].Instances[*].State.Name'",

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The generated runbook includes rollback triggers marked auto_execute=True for error-rate spikes. In a migration context, publishing auto-executing rollback conditions without mandatory human approval, environment constraints, or anti-flapping controls can lead downstream automation to trigger disruptive production reversions automatically.

Content

Scanner excerpt · scripts/rollback_generator.py (reported line 523)May include surrounding context.

python
"duration_minutes": 5
                },
                evaluation_window_minutes=5,
                auto_execute=True,
                escalation_contacts=["on_call_engineer", "migration_lead"]
            ),
            RollbackTriggerCondition(

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

This generated availability-based trigger is marked auto_execute=True, enabling autonomous rollback on a short two-minute window. In migration operations, brief telemetry dips or monitoring faults can cause unnecessary rollback of critical systems, creating cascading outages or reverting healthy changes.

Content

Scanner excerpt · scripts/rollback_generator.py (reported line 551)May include surrounding context.

python
"duration_minutes": 2
                },
                evaluation_window_minutes=2,
                auto_execute=True,
                escalation_contacts=["sre_team", "incident_commander"]
            )
        ])

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The data-integrity trigger is configured for auto_execute=True, which could cause immediate automated rollback when any validation failure is observed. Although data integrity is sensitive, blindly automating rollback on single-failure signals can worsen incidents, especially if the signal is noisy or the rollback itself is destructive.

Content

Scanner excerpt · scripts/rollback_generator.py (reported line 570)May include surrounding context.

python
"duration_minutes": 1
                    },
                    evaluation_window_minutes=1,
                    auto_execute=True,
                    escalation_contacts=["dba_team", "data_team"]
                ),
                RollbackTriggerCondition(

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The memory-leak trigger is generated with auto_execute=True, encouraging unsupervised rollback based on inferred resource trends. In a zero-downtime migration setting, autonomous rollback from heuristic metrics can create instability, churn, and repeated reversion if thresholds are mis-tuned.

Content

Scanner excerpt · scripts/rollback_generator.py (reported line 616)May include surrounding context.

python
"duration_minutes": 20
                    },
                    evaluation_window_minutes=20,
                    auto_execute=True,
                    escalation_contacts=["development_team", "sre_team"]
                )
            ])

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/rollback_generator.py (reported line 977)May include surrounding context.

python
for trigger in runbook.trigger_conditions:
            output.append(f"• {trigger.name}")
            output.append(f"  Condition: {trigger.condition}")
            output.append(f"  Auto-Execute: {'Yes' if trigger.auto_execute else 'No'}")
            output.append(f"  Evaluation Window: {trigger.evaluation_window_minutes} minutes")
            output.append(f"  Contacts: {', '.join(trigger.escalation_contacts)}")
            output.append("")