ClawHub
Back to skill

Security audit

Devops Engineer

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent DevOps guidance skill with expected infrastructure commands, but users should review destructive examples before letting an agent run them.

Install only if you want a broad DevOps/SRE assistant. Before allowing it to execute commands, require explicit confirmation for production changes, Terraform apply/destroy, Kubernetes mutations, Docker pruning, and payment operations, and verify the target environment and rollback plan.

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill includes destructive operational commands such as rollback, destroy, prune, and other system-altering actions without prominent safety framing or confirmation guidance. In an agent setting, this can normalize or encourage execution of impactful commands in production or on developer machines without adequate safeguards.

Tool Parameter Abuse

Low
Category
Tool Misuse
Content
docker build -t app:latest --target production .
docker buildx build --platform linux/amd64,linux/arm64 -t app:latest --push .
docker scan app:latest  # Snyk vulnerability scan
docker run --rm -p 8080:8080 --read-only --tmpfs /tmp app:latest
docker compose up -d --build
docker compose logs -f
docker system prune -a --volumes  # clean everything unused
Confidence
78% confidence
Finding
The quick-reference section includes `docker system prune -a --volumes`, a highly destructive cleanup command that can remove images, containers, networks, and volumes. In an agent-assisted workflow, presenting this without strong warnings or confirmation guidance creates a real risk of accidental data loss and service disruption.

Static analysis

No suspicious patterns detected.