ClawHub
Back to skill

Security audit

Adguard Test

Security checks for vulnerabilities and agentic risk

Overview

This AdGuard Home skill mostly does what it claims, but it can send administrator credentials and session cookies over unencrypted HTTP while also exposing sensitive DNS activity data.

Review before installing. Use HTTPS-only AdGuard URLs, avoid plaintext adguard-instances.json with real admin passwords, prefer environment variables or a secrets manager, and assume querylog/clients output may reveal browsing history and internal network details. Do not use this in shared or multi-user workspaces without tightening credential handling and redacting outputs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
index.js:62
Finding

Administrator Credentials and Session Cookies May Be Transmitted over Plaintext HTTP

Content
View full analysis
{ const fullUrl = new URL(endpoint, baseUrl); const protocol = fullUrl.protocol === 'https:' ? https : http; const options = { hostname: fullUrl.hostname, port: fullUrl.port || (fullUrl.protocol === 'https:' ? 443 : 80), path: fullUrl.pathname + fullUrl.search, method: method, headers: { 'Content-Type': 'application/json', 'Accept': 'application/json', } }; if (cookie) { options.headers['Cookie'] = cookie; } if (postData) { options.headers['Content-Length'] = Buffer.byteLength(postData); } const req = protocol.request(options, (res) => { const cookies = res.headers['set-cookie']; let cookieValue = null; if (cookies) { cookieValue = cookies.map(c => c.split(';')[0]).join('; '); } let data = ''; res.on('data', chunk => data += chunk); res.on('end', () => { resolve({ statusCode: res.statusCode, data: data, cookie: cookieValue }); }); ...[truncated 3901 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (25)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 33)May include surrounding context.

md
**Attack Vector:**
- Malicious instance configuration with crafted `url`, `username`, or `password`
- Example: `password: "admin' && rm -rf / #"`
- Shell command injection via unescaped parameters

**Fix:**

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · TEST_REPORT.md (reported line 39)May include surrounding context.

md
**Attack Vector:**
- Malicious instance configuration with crafted `url`, `username`, or `password`
- Example: `password: "admin' && rm -rf / #"`
- Shell command injection via unescaped parameters

**Fix:**

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 33)May include surrounding context.

md
**Attack Vector:**
- Malicious instance configuration with crafted `url`, `username`, or `password`
- Example: `password: "admin' && rm -rf / #"`
- Shell command injection via unescaped parameters

**Fix:**

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 33)May include surrounding context.

verity:** CRITICAL
CVSS Score: 9.8 (Critical)

Issue:

javascript
// VULNERABLE CODE (v1.1.1)
execSync(`curl -s -X POST ${url}/control/login -H "Content-Type: application/json" -d '{"name":"${username}","password":"${password}"}' -c ${cookieFile}`);

Attack Vector:

  • Malicious instance configuration with crafted url, username, or password
  • Example: password: "admin' && rm -rf / #"
  • Shell command injection via unescaped parameters

Fix:

javascript
// SECURE CODE (v1.2.0)
async function authenticate(baseUrl, username, password) {
  const response = await httpRequest(
    baseUrl, 
    '/control/login', 
    'POST', 
    JSON.stringify({ name: username, password: password })
  );
  return response.cookie;
}

Mitigation:

  • ✅ Removed all execSync and child_process usage
  • ✅ Implemented native http/https module for API calls
  • ✅ No shell command execution

2. Missing Input Validation (CWE-20) - FIXED ✅

Severity: H

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.

md
- **Entrypoint | 入口文件:** `index.js`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · TEST_REPORT.md (reported line 39)May include surrounding context.

1. Command Injection Prevention

Test: node index.js stats "invalid;rm -rf /"

Result: ✅ BLOCKED

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · TEST_REPORT.md (reported line 39)May include surrounding context.

1. Command Injection Prevention

Test: node index.js stats "invalid;rm -rf /"

Result: ✅ BLOCKED

text

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · TEST_REPORT.md (reported line 39)May include surrounding context.

1. Command Injection Prevention

Test: node index.js stats "invalid;rm -rf /"

Result: ✅ BLOCKED

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 28)May include surrounding context.

Issue:

javascript
// VULNERABLE CODE (v1.1.1)
execSync(`curl -s -X POST ${url}/control/login -H "Content-Type: application/json" -d '{"name":"${username}","password":"${password}"}' -c ${cookieFile}`);

Attack Vector:

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 206)May include surrounding context.

  1. Restrict config file permissions:
    bash
    chmod 600 ~/.openclaw/workspace/adguard-instances.json
ls -la ~/.openclaw/workspace/adguard-instances.json
# Should show: -rw------- (only owner can read/write)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This report explicitly labels the skill as 'SECURE' and recommends production deployment even though it also documents a remaining plaintext credential risk and warns against multi-user use. That creates a misleading security assurance that could cause operators to deploy the skill in environments where credential compromise is still plausible.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 205)May include surrounding context.

  1. Secure the config file | 保护配置文件:

    bash
    chmod 600 ~/.openclaw/workspace/adguard-instances.json

  2. Test the skill | 测试技能:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

  1. Secure the config file | 保护配置文件:

    bash
    chmod 600 ~/.openclaw/workspace/adguard-instances.json

  2. Test the skill | 测试技能:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · TEST_REPORT.md (reported line 120)May include surrounding context.

  1. Secure the config file | 保护配置文件:

    bash
    chmod 600 ~/.openclaw/workspace/adguard-instances.json

  2. Test the skill | 测试技能:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill prominently supports retrieving recent DNS query logs and shows examples containing domains and client IP addresses, which are sensitive operational and browsing-activity data. Without an explicit privacy warning, access-control expectations, and guidance on safe handling/redaction, users may expose personal or organizational telemetry in shared terminals, logs, screenshots, or chat transcripts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The version history asserts plaintext credential storage instructions were removed, but the document still includes examples that place admin usernames and passwords in JSON configuration files. This mismatch can mislead users into believing the skill has been fully hardened when it still normalizes insecure secret handling, increasing the chance of credential disclosure through local file leakage, backups, or accidental commits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The report explicitly acknowledges plaintext credential storage in adguard-instances.json with world-readable/group-readable permissions, yet still concludes the skill is 'Production Ready' and recommends deployment. This weak warning can normalize insecure handling of sensitive secrets and lead users to deploy a configuration where local users or backup/sync systems can read administrative credentials.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 225)May include surrounding context.

md
### Recommendations
1. ✅ **Deploy to production** - Safe for use
2. ⚠️ **Restrict config file permissions** - `chmod 600`
3. 📝 **Update ClawHub** - Publish v1.2.0
4. 🔍 **Monitor for updates** - Security patches as needed

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · TEST_REPORT.md (reported line 153)May include surrounding context.

md
### Recommendations
1. ✅ **Deploy to production** - Safe for use
2. ⚠️ **Restrict config file permissions** - `chmod 600`
3. 📝 **Update ClawHub** - Publish v1.2.0
4. 🔍 **Monitor for updates** - Security patches as needed

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module header explicitly claims secure credential handling, but the implementation still loads plaintext credentials from a local JSON file in the skill directory. This creates a misleading security posture and increases the risk of accidental credential exposure through source control, workspace sharing, backups, or local compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The querylog command retrieves and prints recent DNS queries, including domains, clients, timestamps, and filtering rules, which can reveal sensitive browsing history and internal network activity. In an agent skill context, exposing this data without an explicit privacy warning, confirmation step, or output minimization increases the chance of unintended disclosure to users, logs, transcripts, or downstream tooling.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
80% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 203)May include surrounding context.

cat ~/.openclaw/workspace/adguard-instances.json

text

3. **Restrict config file permissions:**
```bash
chmod 600 ~/.openclaw/workspace/adguard-instances.json
ls -la ~/.openclaw/workspace/adguard-instances.json

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation is internally inconsistent about where configuration is stored and searched: the changelog claims workspace-only behavior, while earlier install/FAQ text references a broader global workspace path. Such inconsistency can cause users to place secrets in unexpected locations, weakening assumptions about access controls and making credentials easier to overlook, expose, or retain unintentionally.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
98% confidence
Finding

The file permissions shown (-rw-rw-r--) allow group and other read access to a file containing plaintext credentials. On a multi-user system or in environments with shared accounts, this can expose admin credentials to unauthorized local users and facilitate takeover of the managed AdGuard Home instances.

Content

Scanner excerpt · TEST_REPORT.md (reported line 113)May include surrounding context.

Issue: Credentials stored in plaintext in adguard-instances.json

Current Permissions:

bash
-rw-rw-r-- 1 foxleoly foxleoly 268 Feb 24 00:39 adguard-instances.json

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The clients command enumerates configured and auto-discovered client information, exposing device names, identifiers, and policy details that form a useful network inventory. While this is an intended administrative function, presenting it without warning or scoping can leak internal topology and host metadata through console output, logs, or agent transcripts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.