ClawHub
Back to skill

Security audit

Devops Engineer

Security checks across malware telemetry and agentic risk

Overview

This is a DevOps guidance skill with broad operational examples, but it does not install code, persist in the environment, or hide unrelated behavior.

Install this as an advisory DevOps reference, not an automation you should execute blindly. Before using any generated command against staging or production, confirm the target environment, RBAC/IAM scope, rollback plan, approval process, and whether the command can delete data, change infrastructure, expose logs, or incur cloud costs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger list includes very broad terms like 'deploy', 'release', and 'build' that can match many ordinary developer conversations and cause the skill to activate unexpectedly. In a DevOps skill, unintended invocation is risky because the generated guidance often concerns production systems, infrastructure, or operational commands that may influence high-impact actions.

Vague Triggers

Medium
Confidence
96% confidence
Finding
Many listed triggers are generic nouns and verbs such as 'incident', 'network', 'performance', 'backup', and 'copyright', which can appear in unrelated contexts. Because this skill contains operational, security-sensitive, and production-oriented instructions, overbroad matching increases the chance of accidental mode selection and unsafe or irrelevant recommendations.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill does not warn users that it may propose commands and workflows capable of affecting production infrastructure, credentials, networking, or live incident response. Without that warning, users may over-trust or directly execute guidance in sensitive environments without adequate review.

Credential Access

High
Category
Privilege Escalation
Content
steps:
      - name: Configure kubectl
        run: |
          aws eks update-kubeconfig --region ${{ vars.AWS_REGION }} --name staging-cluster
      - name: Deploy with Helm
        run: |
          helm upgrade --install app ./charts/app \
Confidence
82% confidence
Finding
kubeconfig

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.