ClawHub
Back to skill

Security audit

etcd-manager

Security checks for vulnerabilities and agentic risk

Overview

This etcd skill is coherent, but needs review because it can modify or delete etcd data while overstating its backup, confirmation, production-safety, and audit controls.

Install only if you are comfortable with the skill using the current etcd credentials to read, write, and delete keys on endpoints you provide. Avoid production/shared clusters unless you add real backups, confirmation gates, endpoint/key-prefix allowlists, and audit logging; do not run the connection test against sensitive clusters. Verify package provenance and pin or remove the npm dependency before relying on it operationally.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
etcd_helper.sh:57
Finding

Destructive etcd Operations Lack the Documented Backup and Production Safety Controls

Content
View full analysis
>> Old value (if exists):" etcdctl --endpoints="$ENDPOINTS" get "$TARGET" 2>/dev/null || echo "(key does not exist)" echo "" echo ">>> Writing new value..." etcdctl --endpoints="$ENDPOINTS" put "$TARGET" "$VALUE" echo "" echo ">>> New value:" etcdctl --endpoints="$ENDPOINTS" get "$TARGET" ;; delete) if [ -z "$ENDPOINTS" ] || [ -z "$TARGET" ]; then echo "Error: Missing endpoints or key" show_usage exit 1 fi echo "Deleting key: $TARGET" echo "====================" echo ">>> Backup before delete:" etcdctl --endpoints="$ENDPOINTS" get "$TARGET" 2>/dev/null || echo "(key does not exist)" echo "" echo ">>> Deleting..." etcdctl --endpoints="$ENDPOINTS" del "$TARGET" echo ">>> Key deleted" ;; ``` The Skill specification promises stronger controls: ```markdown 1. **Read-first**: Always prefer read operations (list, get) over write operations 2. **Backup before modification**: Always show old value before put/delete 3. **Production protection**: Be extra cautious with prod environments 4. **Explicit confirmation**: Require clear user intent for destructive operations ``` The safety guidelines additionally require environment identification, production confirmation, rate limiting, persistent backups, and audit records. None of these controls are implemented by the executa ...[truncated 2424 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/test_connection.sh:24
Finding

Connection Test Performs Unsafe Writes and May Overwrite or Leave Data

Content
View full analysis
/dev/null || echo " ✅ Key successfully deleted" ``` The package exposes the script as a routine test: ```json "scripts": { "test": "./scripts/test_connection.sh", "lint": "shellcheck etcd_helper.sh scripts/*.sh" } ``` ### Technical Analysis A connection test is generally expected to be read-only unless mutation is explicitly requested. This script instead creates and deletes a key on any caller-selected endpoint. The key name uses `date +%s`, which has only one-second resolution and is predictable. The script does not test whether that key already exists before writing it. An existing value at the generated key can therefore be overwritten and subsequently deleted. The script enables `set -euo pipefail` but does not install an `EXIT`, `INT`, or `TERM` cleanup trap. Any command failure, process termination, or interruption after the `put` and before the `del` leaves test data in the cluster. Conversely, successful cleanup deletes the generated key even if another process created or changed it ...[truncated 1369 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
package.json:19
Finding

Unbounded Dependency and Unverified Installation Source Create Supply-Chain Risk

Content
View full analysis
=3.6.1" } ``` The installation guide provides an illustrative, unverified download: ```bash # Download from your distribution source # Example: wget https://example.com/openclaw-skill-etcd-1.0.0.tar.gz ``` ```bash tar -xzf openclaw-skill-etcd-1.0.0.tar.gz ``` The release notes do not provide an actual digest: ```text Package: openclaw-skill-etcd-1.0.0.tar.gz Size: 8.7 KB SHA256: (Add checksum here) Release Date: 2026-03-24 ``` ### Technical Analysis The npm version range `>=3.6.1` has no upper bound and permits installation of every future release satisfying that range. The project contains no reviewed lockfile in the supplied directory. Consequently, the dependency resolved during a later installation may differ from the version originally audited. This dependency is also inconsistent with the documentation, which treats `etcdctl` as an operating-system command installed through Homebrew, APT, or YUM. If the npm package is not required at runtime, declaring it adds unnecessary package-install execution and supply-chain exposure. The archive installation procedure lacks a real canonical release URL and does not verify a checksum or signature before extraction. If a user substitutes an untrusted distribution source, DNS or hosting compromise, repository impersonation, or social engineering can cause an altered Skill package to be installed. No malicious dependency or archive was observed in the audited files. The issue is that the current version and source controls do not ensure future installations reproduce the reviewed content. ### Attack Path Dependency path: 1. A user runs an npm install ...[truncated 1510 chars]
Remediation
View remediation
=3.6.1`. 3. Commit a package-manager lockfile with integrity hashes and use reproducible installation commands such as `npm ci`. 4. Review dependency provenance, maintainers, package contents, and lifecycle scripts before release. 5. Use automated dependency monitoring, but require security review before updating locked versions. 6. Publish packages only through an authenticated official release channel. 7. Replace the placeholder download URL with a canonical HTTPS release URL. 8. Publish a real SHA-256 checksum and preferably a signed checksum or provenance attestation. 9. Update installation instructions to verify the checksum or signature before extraction. 10. Avoid running package installation as root and isolate installation/build steps from production credentials. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (20)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 216)May include surrounding context.

  1. Remove old version:

    bash
    rm -rf ~/workspace/test/openclaw/skills/etcd

  2. Install new version using Method 1 or 2 above.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 229)May include surrounding context.

  1. Remove old version:

    bash
    rm -rf ~/workspace/test/openclaw/skills/etcd

  2. Install new version using Method 1 or 2 above.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 232)May include surrounding context.

  1. Remove old version:

    bash
    rm -rf ~/workspace/test/openclaw/skills/etcd

  2. Install new version using Method 1 or 2 above.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 216)May include surrounding context.

  1. Remove old version:

    bash
    rm -rf ~/workspace/test/openclaw/skills/etcd

  2. Install new version using Method 1 or 2 above.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 229)May include surrounding context.

  1. Remove old version:

    bash
    rm -rf ~/workspace/test/openclaw/skills/etcd

  2. Install new version using Method 1 or 2 above.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 232)May include surrounding context.

rm -rf ~/workspace/test/openclaw/skills/etcd

Remove from user skills directory

rm -rf ~/.openclaw/skills/etcd

text

## Support

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The code does interact with etcd and exercises get/put/delete/list-like behavior, so it is related to the declared domain. However, the declared description emphasizes managing etcd key-value store operations with safety checks and backup mechanisms, suitable for safe operational use. The actual script is specifically a test utility: it validates endpoint health, prints version info, and performs ephemeral CRUD operations on a generated test key. There is no backup functionality, and the primary purpose is connection verification rather than safe general etcd management. That makes the description materially broader and somewhat different from the code's actual behavior.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 17)May include surrounding context.

md
brew install etcd
   
   # On Ubuntu/Debian:
   sudo apt-get update
   sudo apt-get install etcd-client
   
   # On CentOS/RHEL:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 18)May include surrounding context.

md
brew install etcd
   
   # On Ubuntu/Debian:
   sudo apt-get update
   sudo apt-get install etcd-client
   
   # On CentOS/RHEL:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 21)May include surrounding context.

sudo apt-get install etcd-client

On CentOS/RHEL:

sudo yum install etcd

text

2. **bash** (version 4.0 or higher)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 61)May include surrounding context.

Method 2: Manual Installation

  1. Create the skill directory:
    bash
    mkdir -p ~/workspace/test/openclaw/skills/etcd

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The examples demonstrate put and delete operations against an etcd endpoint, which can alter or remove stored configuration data. The installation guide does not warn users that these actions may impact application state, especially if run against shared or production environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file documents rm -rf commands for upgrade and uninstallation, which can irreversibly delete installed skill directories. The surrounding text does not include any explicit warning or caution about permanent data loss or the need to verify paths before running the commands.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The "Through OpenClaw" example is written as an instruction to use the skill in Chinese ("请使用etcd技能") and does not indicate that other languages are supported or that Chinese is optional. This can violate language/locale policy because it imposes a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown mandates a Chinese-only output template and all invocation examples are written in Chinese, which imposes a specific language on users. There is no opt-in, alternative language option, or stated business/regional requirement that would justify the restriction.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · references/safety_guidelines.md (reported line 6)May include surrounding context.

md
## Core Principles

### 1. Read-First Approach
- Always prefer read operations over write operations
- Verify current state before making changes
- Use `list` and `get` to understand the data structure

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script performs real write and delete operations against whatever etcd endpoint the caller supplies, but presents itself as a connection test without an explicit warning or a dry-run/safe mode. In production or shared environments, even temporary test keys can violate change-control expectations, trigger watchers/controllers, or interact badly with automation that reacts to key creation and deletion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example invocation is written as a required Chinese prompt (请使用etcd技能) with no indication that other languages are supported or that Chinese is optional. This can violate language/locale policy by implicitly forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This example again presents the skill invocation exclusively in Chinese, with no alternative language option or documented reason for the locale restriction. Repeating the language constraint reinforces an unnecessary forced-locale pattern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description is written in Chinese and does not indicate that users may choose another language or that the skill is intended only for a Chinese-speaking or region-specific context. This can violate the language/locale policy criterion when a specific language is effectively imposed without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
INSTALL.md:232