ClawHub
Back to skill

Security audit

Ops Cert Check

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent certificate-operations checklist, but it needs Review because it gives production TLS, DNS API, root access, and cron/deploy-hook instructions without enough safety controls.

Use this only as an experienced ops runbook. Before following it on production, require approval, back up current certs and configs, verify certificate/key/full-chain matching, confirm file ownership and permissions, protect DNS API tokens with least privilege, test renewal with a dry run, and ensure any cron/deploy hook is administrator-owned, minimally scoped, logged, and reviewed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger list uses broad terms like 'ssl certificate', 'tls certificate', and 'certbot', which can cause the skill to activate in situations outside a narrow certificate-renewal SOP. Over-broad activation is dangerous because it may surface high-impact operational instructions, including live certificate replacement and privileged commands, when the user only wanted general information or unrelated troubleshooting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The procedure instructs users to replace live certificate and key files and reload Nginx, but it does not explicitly warn about outage risk, permissions/ownership issues, chain mismatch, or rollback requirements. In an ops skill, this omission can lead to accidental service disruption or failed TLS deployment if a user follows the steps on production without backups and validation beyond a basic config test.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The Let's Encrypt wildcard section involves root-level changes and DNS/API-backed certificate issuance, but it lacks explicit handling guidance for sensitive credentials and privilege boundaries. This is risky because DNS API tokens or root-owned deploy hooks can grant broad infrastructure control, and poor operational hygiene can expose secrets or enable persistent privileged execution.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md
### Prerequisites
- Linux server with internet access
- Root/sudo access
- Domain DNS already pointing to the server
- DNS provider with API access (Alibaba Cloud DNS, Cloudflare, Route53, etc.)

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The cron-based auto-renewal example creates persistent execution and references a root-owned deploy hook path without describing hardening requirements. Persistent scheduled jobs and hooks are dangerous if misconfigured because they can run with elevated privileges repeatedly, expose secrets, or be modified to execute unauthorized commands.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

Auto-Renewal

bash
# Set up cron job (runs every 2 days)
crontab -e
# 0 0 */2 * * certbot renew --deploy-hook "/root/your-hook.sh"

# Manual dry-run (doesn't actually renew)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The warning about not committing private key files is written only in Chinese, while the rest of the skill is in English. This creates a language inconsistency that may prevent some users from understanding a critical safety instruction and effectively forces a locale for an important policy statement without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.