ClawHub
Back to skill

Security audit

Vagrant Skill

Security checks for vulnerabilities and agentic risk

Overview

This VM sandbox skill is mostly purpose-aligned, but it needs review because its default setup forwards the host SSH agent into the VM and uses mutable installer patterns.

Review before installing or using for untrusted code. Disable SSH agent forwarding by default, avoid exposing host credentials to the VM, pin installer and plugin versions, replace curl-to-bash setup patterns with verified downloads, and make checksum verification fail closed. The skill does not show artifact-backed exfiltration or host-destructive intent, but its default isolation posture is weaker than its safety wording implies.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:156
Finding

Mutable NodeSource Setup Script Can Be Executed as Root

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:156-159
Vulnerability Type: Remote script retrieval and direct shell execution
Risk Level: High

bash
# Node.js:
#   curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
#   apt-get install -y -qq nodejs

Technical Analysis

The Skill provides a provisioning pattern that pipes a mutable HTTPS response directly into Bash. Although shown as a commented example, the surrounding instructions require the agent to enable the relevant tooling block when a project uses Node.js. The resulting command is expected to run in a privileged Vagrant provisioner.

The downloaded script is neither pinned to an immutable version nor verified using a locally trusted checksum or signature before execution. HTTPS protects the connection in transit but does not protect against compromise of the upstream account, server, build pipeline, DNS infrastructure, or future changes to the remote script.

This also undermines the auditability of the Skill: the effective code executed during provisioning can differ from the code reviewed in this package.

Attack Path

  1. The user invokes the Skill for a Node.js project.
  2. The agent detects package.json and enables the documented Node.js provisioning block.
  3. Vagrant executes the provisioning block as root inside the VM.
  4. Bash immediately executes the current response from deb.nodesource.com.
  5. A compromised or malicious response executes arbitrary commands before Node.js installation.
  6. The payload can access synchronized project files and any credentials exposed to the guest, including a forwarded SSH agent if that configuration remains enabled.

Impact Assessment

A malicious response obtains arbitrary root-level code execution inside the VM. It can modify the guest, tamper with synchronized project content, implant build artifacts, steal source code, access network-reachable services, and abuse credentials ...[truncated 160 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation pattern.
  • Prefer Node.js packages from a trusted operating-system repository or a version manager with integrity verification.
  • If NodeSource is required, download the setup artifact to a temporary file, verify a pinned cryptographic digest or trusted signature, inspect its exit status, and only then execute it.
  • Pin the repository configuration and Node.js major/minor version rather than relying on mutable setup behavior.
  • Fail closed if signature or checksum verification cannot be completed.
  • Run repository setup with only the privileges it needs and avoid exposing host credentials during provisioning.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:89
Finding

Host SSH Agent Is Forwarded into a VM Intended for Untrusted Code

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:89-94
Vulnerability Type: Credential-boundary violation through SSH agent forwarding
Risk Level: High

ruby
config.vm.hostname = "dev"
config.vm.boot_timeout = 300
config.ssh.forward_agent = true

# ─── Sync project into VM at /project ─────────────────────────────────────

Technical Analysis

The base Vagrant configuration enables host SSH-agent forwarding by default. This conflicts with the Skill's stated purpose of running dangerous or untrusted code in an isolated sandbox.

Agent forwarding does not normally copy private-key files into the VM, but it exposes an authentication socket through which guest processes can request signatures. Code with access to that socket may authenticate to services permitted by the identities loaded in the host agent. Because workloads can run with root privileges inside the VM, guest user-level socket permissions do not provide a reliable security boundary.

This also makes the claim that VM activity cannot affect the host or external resources too broad: the guest can potentially act using host-backed identities.

Attack Path

  1. The user has one or more SSH identities loaded in the host SSH agent.
  2. The Skill creates a Vagrantfile with config.ssh.forward_agent = true.
  3. Vagrant exposes the forwarded agent socket in the VM.
  4. The user runs an untrusted project build, dependency installer, test, or generated command in the VM.
  5. Malicious guest code discovers SSH_AUTH_SOCK or accesses the socket through guest root privileges.
  6. The code uses the forwarded agent to authenticate to source-control systems, servers, or other SSH-accessible infrastructure.
  7. The attacker performs actions allowed by the loaded identity without extracting the underlying private key.

Impact Assessment

The effective scope is determined by the host identities loaded into the SSH agent. Potential impact includes unau ...[truncated 291 chars]

Remediation
View remediation

Remediation Suggestions

  • Set config.ssh.forward_agent = false by default.
  • Do not enable forwarding for VMs used to execute untrusted code, dependencies, tests, or AI-generated commands.
  • If forwarding is essential, require explicit per-run user consent and clearly describe the affected identities.
  • Use a dedicated agent containing only a short-lived, narrowly scoped credential.
  • Prefer deploy keys or tokens restricted to one repository and read-only access.
  • Remove the forwarded socket before executing untrusted workloads.
  • Revise the safety documentation to state that synchronized files, forwarded agents, shared folders, and network credentials can weaken VM isolation.

T08 · Insecure Dependencies

Warning
Location
scripts/setup.sh:153
Finding

Executable Tools and Plugins Are Installed from Mutable Versions

Content
View full analysis

Vulnerability Details

File Locations:

  • scripts/setup.sh:153-162
  • README.md:146-149
  • README.md:180-183
  • README.md:211-214

Vulnerability Type: Unpinned executable third-party dependencies
Risk Level: Medium

bash
install_mage() {
    export PATH="/usr/local/go/bin:$HOME/go/bin:$PATH"
    export GOPATH="$HOME/go"

    if command -v mage &>/dev/null; then
        info "Mage already installed"
        return 0
    fi

    info "Installing mage..."
    go install github.com/magefile/mage@latest
    cp "$HOME/go/bin/mage" /usr/local/bin/mage
}
bash
npx clawhub@latest install vagrant
bash
vagrant plugin install vagrant-parallels
bash
vagrant plugin install vagrant-libvirt

Technical Analysis

These installation commands resolve mutable versions at execution time. The Mage provisioner explicitly uses @latest, then copies the resulting executable into a system-wide binary directory while provisioning as root. The ClawHub command similarly executes the package currently associated with the mutable latest tag.

The Vagrant plugin commands do not specify reviewed versions, so their resolved code can change between installations. Package managers provide transport and registry-level controls, but those controls do not make a mutable release equivalent to an audited, immutable dependency.

Attack Path

  1. An upstream maintainer account, package registry, release process, or dependency is compromised, or a future release introduces malicious behavior.
  2. A user follows the documented installation instructions or runs VM provisioning.
  3. The package manager resolves the mutable latest release or current plugin version.
  4. Installation or build hooks execute attacker-controlled code.
  5. For Mage, the provisioning process installs the resulting executable system-wide inside the VM as root.
  6. For ClawHub and Vagrant plugins, malic ...[truncated 696 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace github.com/magefile/mage@latest with an explicitly reviewed version.
  • Pin the ClawHub CLI to a specific release rather than @latest.
  • Specify reviewed versions for vagrant-parallels and vagrant-libvirt.
  • Maintain a dependency update process that reviews release notes and integrity information before changing pins.
  • Where supported, verify downloaded package checksums or signatures.
  • Avoid installing build outputs system-wide until their provenance and integrity have been verified.
  • Document the exact tested dependency versions in one authoritative manifest.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/setup.sh:130
Finding

Go Toolchain Integrity Verification Fails Open

Content
View full analysis

Vulnerability Details

File Location: scripts/setup.sh:130-142
Vulnerability Type: Fail-open integrity validation of a root-installed archive
Risk Level: Medium

bash
expected_hash=$(curl -fsSL "https://go.dev/dl/?mode=json&include=all" \
    | jq -r ".[] | select(.version==\"go${GO_VERSION}\") | .files[] | select(.filename==\"${go_tarball}\") | .sha256")

if [[ -z "$expected_hash" ]]; then
    warn "Could not fetch checksum from Go API — skipping verification"
else
    echo "${expected_hash}  ${go_tarball}" > "${tmpdir}/checksum"
    (cd "${tmpdir}" && sha256sum -c checksum)
fi

info "Extracting Go to /usr/local..."
tar -C /usr/local -xzf "${tmpdir}/${go_tarball}"

Technical Analysis

The script retrieves both the Go archive and its expected digest from network services at runtime. If checksum metadata is unavailable, empty, or cannot be selected by the jq expression, the script logs a warning and continues extracting the archive into /usr/local.

Integrity checks protecting executable toolchains must fail closed. Treating absent verification data as a warning permits unverified network content to become root-installed executable code.

Retrieving the archive and checksum through related online infrastructure also provides weaker assurance than checking against a digest pinned in reviewed project source.

Attack Path

  1. The provisioning process downloads the configured Go archive.
  2. The checksum API returns data that does not contain the selected version or filename, or returns content that causes an empty result.
  3. expected_hash is empty.
  4. The script prints a warning but does not terminate.
  5. The unverified archive is extracted into /usr/local as root.
  6. Subsequent provisioning invokes that toolchain to build and install Mage.
  7. A malicious archive can therefore execute directly or produce a malicious system-wide build tool.

Impact Assessment

...[truncated 423 chars]

Remediation
View remediation

Remediation Suggestions

  • Abort provisioning if the expected checksum is absent, malformed, or ambiguous.
  • Pin the expected SHA-256 digest for each supported Go version and architecture in reviewed source.
  • Validate that the digest matches exactly 64 hexadecimal characters before invoking sha256sum.
  • Verify the archive before deleting or replacing the existing Go installation.
  • Consider verifying official signatures or transparency information in addition to the checksum.
  • Extract into a staging directory first, validate the expected archive layout, and then atomically move it into place.
  • Ensure temporary directories are removed with an EXIT trap on both success and failure.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (68)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The declared description promises a disposable VM capability for safe isolated testing, including VM creation/recreation and broad sandbox use cases. The supplied code does not implement VM management at all. Instead, it is a provisioning script intended to run inside an existing machine, where it installs Docker CE, configures a sample nginx + Python API application, and starts that stack. While Docker installation aligns loosely with part of the description, the primary purpose is materially different: application/environment provisioning, not disposable VM orchestration or sandbox lifecycle management. Therefore the description overstates and misrepresents the code's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description presents a general-purpose disposable VM/sandbox capability with root access, Docker, Go, and nested KVM for isolated experimentation. The supplied code does not create, destroy, or manage VMs or provide a general sandbox environment. Instead, it performs a specific host/guest provisioning task: installing nginx, hardening firewall rules, persisting them, and starting the nginx service. While the comments mention that these actions are safer inside a VM, the script itself is not a VM-management skill. Therefore, the actual behavior is materially narrower and different from the declared primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description presents a capability for provisioning and managing disposable virtual machines for isolated testing. In contrast, the supplied code is a verification script that audits the current environment for expected dependencies and optional virtualization support. It performs checks only and does not spin up VMs, manage lifecycle, establish isolation, or provision the advertised environment. This is a materially different primary purpose, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Privileged Kubernetes Workload

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Code deploys a privileged Kubernetes workload (privileged container, hostPath mount, or host namespaces). This grants root on the node and is a node/cluster takeover vector.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
# ─── Provision: install project dependencies ──────────────────────────────
  # CUSTOMIZE THIS for the project. Inspect go.mod, package.json,
  # requirements.txt, Dockerfile, Makefile, etc. and install what's needed.
  config.vm.provision "shell", privileged: true, inline: <<-SHELL
    set -euo pipefail
    export DEBIAN_FRONTEND=noninteractive
    apt-get update -qq

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 339)May include surrounding context.

md
1. Create Vagrantfile with the project synced
2. `vagrant up`
3. `vagrant ssh -c "sudo cp /project/myservice.service /etc/systemd/system/"`
4. `vagrant ssh -c "sudo systemctl daemon-reload && sudo systemctl start myservice"`
5. `vagrant ssh -c "systemctl status myservice"` — check it works
6. `vagrant ssh -c "sudo journalctl -u myservice --no-pager"` — check logs
7. `vagrant destroy -f` — clean slate

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
apt-get update -qq
  apt-get install -y -qq ca-certificates curl gnupg

  install -m 0755 -d /etc/apt/keyrings
  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
    -o /etc/apt/keyrings/docker.asc
  chmod a+r /etc/apt/keyrings/docker.asc

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md
apt-get update -qq
  apt-get install -y -qq ca-certificates curl gnupg

  install -m 0755 -d /etc/apt/keyrings
  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
    -o /etc/apt/keyrings/docker.asc
  chmod a+r /etc/apt/keyrings/docker.asc

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md
apt-get update -qq
  apt-get install -y -qq ca-certificates curl gnupg

  install -m 0755 -d /etc/apt/keyrings
  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
    -o /etc/apt/keyrings/docker.asc
  chmod a+r /etc/apt/keyrings/docker.asc

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md
apt-get update -qq
  apt-get install -y -qq ca-certificates curl gnupg

  install -m 0755 -d /etc/apt/keyrings
  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
    -o /etc/apt/keyrings/docker.asc
  chmod a+r /etc/apt/keyrings/docker.asc

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · examples/mac-docker-compose/scripts/provision.sh (reported line 31)May include surrounding context.

sh
apt-get update -qq
  apt-get install -y -qq ca-certificates curl gnupg

  install -m 0755 -d /etc/apt/keyrings
  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
    -o /etc/apt/keyrings/docker.asc
  chmod a+r /etc/apt/keyrings/docker.asc

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · examples/mac-docker-compose/scripts/provision.sh (reported line 33)May include surrounding context.

sh
apt-get update -qq
  apt-get install -y -qq ca-certificates curl gnupg

  install -m 0755 -d /etc/apt/keyrings
  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
    -o /etc/apt/keyrings/docker.asc
  chmod a+r /etc/apt/keyrings/docker.asc

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · examples/mac-docker-compose/scripts/provision.sh (reported line 34)May include surrounding context.

sh
apt-get update -qq
  apt-get install -y -qq ca-certificates curl gnupg

  install -m 0755 -d /etc/apt/keyrings
  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
    -o /etc/apt/keyrings/docker.asc
  chmod a+r /etc/apt/keyrings/docker.asc

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · examples/mac-docker-compose/scripts/provision.sh (reported line 39)May include surrounding context.

sh
apt-get update -qq
  apt-get install -y -qq ca-certificates curl gnupg

  install -m 0755 -d /etc/apt/keyrings
  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
    -o /etc/apt/keyrings/docker.asc
  chmod a+r /etc/apt/keyrings/docker.asc

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 78)May include surrounding context.

sh
apt-get update -qq
  apt-get install -y -qq ca-certificates curl gnupg

  install -m 0755 -d /etc/apt/keyrings
  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
    -o /etc/apt/keyrings/docker.asc
  chmod a+r /etc/apt/keyrings/docker.asc

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 80)May include surrounding context.

sh
apt-get update -qq
  apt-get install -y -qq ca-certificates curl gnupg

  install -m 0755 -d /etc/apt/keyrings
  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
    -o /etc/apt/keyrings/docker.asc
  chmod a+r /etc/apt/keyrings/docker.asc

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 83)May include surrounding context.

sh
apt-get update -qq
  apt-get install -y -qq ca-certificates curl gnupg

  install -m 0755 -d /etc/apt/keyrings
  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
    -o /etc/apt/keyrings/docker.asc
  chmod a+r /etc/apt/keyrings/docker.asc

Credential Access

High
Category
Privilege Escalation
Confidence
77% confidence
Finding

The script downloads Docker's repository GPG key over the network and installs it into the system trust store without independently verifying the key fingerprint. If network traffic, DNS, or the upstream endpoint were compromised, a malicious signing key could be trusted, enabling installation of attacker-controlled packages as root.

Content

Scanner excerpt · scripts/setup.sh (reported line 79)May include surrounding context.

sh
info "Installing Docker..."
    install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
    chmod a+r /etc/apt/keyrings/docker.asc

    echo \

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/setup.sh (reported line 106)May include surrounding context.

sh
return 0
        fi
        info "Upgrading Go from v${installed_ver} to v${GO_VERSION}..."
        rm -rf /usr/local/go
    fi

    info "Installing Go v${GO_VERSION}..."

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/setup.sh (reported line 106)May include surrounding context.

sh
return 0
        fi
        info "Upgrading Go from v${installed_ver} to v${GO_VERSION}..."
        rm -rf /usr/local/go
    fi

    info "Installing Go v${GO_VERSION}..."

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

md
Provides disposable, fully-provisioned Ubuntu 24.04 VMs for safe experimentation:

- **Full sudo access** — agents and humans can do anything without risk to the host
- **Pre-installed tooling** — Go 1.24, Docker, mage, build-essential, network tools
- **Nested KVM** — hardware virtualization passthrough (Linux with libvirt)
- **Configurable** — sync any project, adjust CPU/RAM/Go version via env vars

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 36)May include surrounding context.

md
Provides disposable, fully-provisioned Ubuntu 24.04 VMs for safe experimentation:

- **Full sudo access** — agents and humans can do anything without risk to the host
- **Pre-installed tooling** — Go 1.24, Docker, mage, build-essential, network tools
- **Nested KVM** — hardware virtualization passthrough (Linux with libvirt)
- **Configurable** — sync any project, adjust CPU/RAM/Go version via env vars

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.

md
Provides disposable, fully-provisioned Ubuntu 24.04 VMs for safe experimentation:

- **Full sudo access** — agents and humans can do anything without risk to the host
- **Pre-installed tooling** — Go 1.24, Docker, mage, build-essential, network tools
- **Nested KVM** — hardware virtualization passthrough (Linux with libvirt)
- **Configurable** — sync any project, adjust CPU/RAM/Go version via env vars

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.

md
Provides disposable, fully-provisioned Ubuntu 24.04 VMs for safe experimentation:

- **Full sudo access** — agents and humans can do anything without risk to the host
- **Pre-installed tooling** — Go 1.24, Docker, mage, build-essential, network tools
- **Nested KVM** — hardware virtualization passthrough (Linux with libvirt)
- **Configurable** — sync any project, adjust CPU/RAM/Go version via env vars

Static analysis

No suspicious patterns detected.