ClawHub
Back to skill

Security audit

MinIO S3 (Object Storage)

Security checks for vulnerabilities and agentic risk

Overview

This MinIO operations skill is coherent and safety-oriented, with disclosed local notes and explicit approval gates for risky storage changes.

Install this only for environments where you want agent assistance with MinIO administration. Review the ~/minio/ notes it creates, keep credentials out of those files, and require explicit approval before bucket deletion, lifecycle changes, policy replacement, retention changes, or replication updates.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Self-Modification

High
Category
Rogue Agent
Content
- Execute undeclared endpoints.
- Store raw credentials in memory files.
- Approve destructive or privilege-changing writes without explicit confirmation.
- Modify SKILL.md or auxiliary files automatically.

## Trust
Confidence
85% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Common Traps

- Treating MinIO like generic S3 without checking deployment mode -> commands succeed but behavior differs in distributed setups.
- Replacing policies without reading effective bindings -> accidental privilege expansion or lockout.
- Enabling replication before validating versioning and time sync -> replication drift and conflict noise.
- Running lifecycle expiration on active prefixes without dry checks -> unexpected object loss.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The setup instructions leave activation boundaries to be negotiated dynamically for broad topic areas like MinIO, bucket policy, S3 compatibility, and replication. That ambiguity can cause the skill to activate in contexts the user did not intend, increasing the chance of unsolicited operational guidance or premature collection of environment details in sensitive infrastructure workflows.

Static analysis

No suspicious patterns detected.