ClawHub
Back to skill

Security audit

Synology

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Synology NAS helper with optional local notes and explicit safety gates for risky changes.

Before installing, be aware that this skill is meant for sensitive NAS administration. Use the optional ~/synology/ memory only if you want continuity across sessions, do not store secrets there, and keep the built-in confirmation gates for destructive storage, restore, permission, package, or internet-exposure changes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md
- ask the user to paste DSM passwords, OTP codes, or private keys into chat
- claim SHR, RAID, or sync are backups when they are not
- expose DSM or SSH publicly by default
- promise package, filesystem, or model features without verification when support matters

## Trust

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The template instructs the skill to auto-activate on broad topics such as Synology, DSM, backup, storage, remote access, and container work. These triggers overlap with common admin and support conversations, which can cause the skill to engage unexpectedly, collect or reuse context too broadly, and increase the chance of unsafe or privacy-impacting actions in security-sensitive NAS discussions.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.md (reported line 31)May include surrounding context.

bash
mkdir -p ~/synology
touch ~/synology/{memory.md,inventory.md,services.md,incidents.md}
chmod 700 ~/synology
chmod 600 ~/synology/{memory.md,inventory.md,services.md,incidents.md}
  • If memory.md is empty, initialize it from memory-template.md.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.md (reported line 32)May include surrounding context.

mkdir -p ~/synology touch ~/synology/{memory.md,inventory.md,services.md,incidents.md} chmod 700 ~/synology chmod 600 ~/synology/{memory.md,inventory.md,services.md,incidents.md}

text
- If `memory.md` is empty, initialize it from `memory-template.md`.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · setup.md (reported line 52)May include surrounding context.

md
## Guardrails

- Never ask the user to paste passwords, OTP codes, recovery keys, or private keys into chat.
- Never recommend public DSM or SSH exposure as the default shortcut.
- Never treat delete, restore, migration, or reformat work as routine; require an explicit confirmation point.
- Never skip evidence collection when package failure, permission drift, or data risk is involved.

Static analysis

No suspicious patterns detected.