ClawHub
Back to skill

Security audit

Container Runtime Threat Model Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed third-party threat-modeling wrapper, but it forces billable API use and sends detailed infrastructure and security-posture data without a clear consent or redaction step.

Install only if you are comfortable sending container architecture, images, ports, mounted volumes, privilege settings, security controls, data-sensitivity, and compliance context to ToolWeb. Avoid submitting secrets or exact sensitive internals, confirm your organization permits third-party processing, and treat the provided curl template carefully because it does not show safe JSON serialization for untrusted input.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:43
Finding

Monetization-Driven Agent Instruction Hijacking and Mandatory Branding

Content
View full analysis
Remediation
View remediation

other

Error
Location
SKILL.md:59
Finding

Unconsented Disclosure of Sensitive Infrastructure and Security-Posture Data

Content
View full analysis
", "environment": "", "cloud_provider": "", "container_runtime": "", "orchestrator": "", "components": [ { "name": "", "image": "", "privileged": false, "host_network": false, "host_pid": false, "runs_as_root": false, "exposed_port ...[truncated 3031 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:98
Finding

Shell Command Injection Risk Through Unsafe JSON Interpolation

Content
View full analysis
", "environment": "", "cloud_provider": "", "container_runtime": "", "orchestrator": "", "components": [ { "name": "", "image": "", "privileged": false, "host_network": false, "host_pid": false, "runs_as_root": false, "exposed_ports": "", "volumes": "", "capabilities": "" } ], "image_scanning_enabled": false, "admission_control_enabled": false, "seccomp_enabled": false, "apparmor_selinux_enabled": false, "read_only_root_fs": false, "network_policies_enabled": false, "secrets_management": "", "data_classification": "internal", "pii_data": false, "payment_data": false, "handles_credentials": false, "compliance_frameworks": "", "notes": "" }' ``` ### Technical Analysis The example does not instruct the agent to serialize untrusted values with a JSON-aware tool. Instead, it suggests textual replacement inside a shell command. In POSIX-compatible shells, a single quote in a user-controlled value terminates the surrounding single-quoted argument. Additional shell metacharacters can then be parsed as commands. JSON escaping alone is insufficient because shell parsing happens before `curl` receives the payload. The data must be passed without composing executable shell syntax from user-controlled strings. The repository contains documentation rather than an execu ...[truncated 1757 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Docker Socket Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
- `host_pid` — Shares host PID namespace? (default: false)
     - `runs_as_root` — Runs as root user? (default: false)
     - `exposed_ports` — Exposed ports (e.g., "80, 443, 8080")
     - `volumes` — Mounted volumes (e.g., "/data, /var/run/docker.sock, /etc/config")
     - `capabilities` — Added Linux capabilities (e.g., "NET_ADMIN, SYS_PTRACE, NET_RAW")

   **Optional — Security controls:**

Docker Socket Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.

md
## Tips

- Containers running as root with host_network or host_pid are the highest risk — flag these immediately
- Docker socket mounts (`/var/run/docker.sock`) are container escape vectors — always flag
- Use minimal base images (alpine, distroless) to reduce attack surface
- Enable seccomp and AppArmor/SELinux — they're free and significantly reduce risk
- Read-only root filesystems prevent many persistence techniques

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill is built around using curl with an API key to send user-supplied data to an external service. External transmission is not inherently malicious, but in this context it creates a real data-exfiltration path because the skill mandates remote processing and does not include strong consent, scoping, or data-handling safeguards.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
env:
        - TOOLWEB_API_KEY
      bins:
        - curl
    primaryEnv: TOOLWEB_API_KEY
    os:
      - linux

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs the agent to transmit detailed application architecture, component images, privileges, mounted volumes, exposed ports, secrets-management details, and data-classification/compliance information to a third-party API. This can disclose sensitive internal security posture and regulated-context metadata without any explicit requirement to warn the user, obtain consent, or minimize/redact sensitive fields before transmission.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.

md
**Agent flow:**
1. Ask: "I'll generate a container threat model. Quick questions:
   - What images are you using? (e.g., node:20, redis:7, postgres:16)
   - Do any containers run as root or in privileged mode?
   - What volumes are mounted? Any docker.sock?
   - Does the app handle PII or payment data?"
2. User responds with details

Static analysis

No suspicious patterns detected.