ClawHub
Back to skill

Security audit

prisma-troubleshoot

Security checks for vulnerabilities and agentic risk

Overview

This Prisma Access troubleshooting skill is mostly coherent, but it presents a live configuration push as a status check without clear approval safeguards.

Install only if operators understand that the configuration-push step can affect live Prisma Access configuration. Use least-privilege SCM credentials, avoid granting push permissions for read-only troubleshooting, and require an explicit change approval before any candidate push.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:82
Finding

State-Changing Configuration Push Misrepresented as a Status Check

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82–86
Vulnerability Type: Unsafe state-changing API operation without explicit authorization
Risk Level: Medium

markdown
1. Check candidate config status:
   ```
   POST /sse/config/v1/config-versions/candidate:push
   ```
2. Monitor push job status:

Technical Analysis

The troubleshooting guide describes POST /sse/config/v1/config-versions/candidate:push as a method to “Check candidate config status.” However, both the HTTP method and the candidate:push action indicate a state-changing operation that may deploy pending configuration rather than perform a read-only status query.

The documented workflow does not require the agent to inspect pending changes, validate the candidate configuration, obtain explicit user approval, use a dry-run mechanism, or establish a rollback plan before initiating the push. This creates a risk that an agent following the skill will mistake a deployment action for a diagnostic query.

Exploitation does not grant privileges beyond those already associated with the configured SCM credentials. Nevertheless, an operator, misleading request, or automated troubleshooting flow could cause the agent to exercise those existing privileges in an unintended and disruptive manner.

Attack Path

  1. The skill is invoked to diagnose a Prisma Access configuration push failure.
  2. The agent follows the documented step labeled “Check candidate config status.”
  3. The agent authenticates to Strata Cloud Manager using the configured SCM_CLIENT_ID, SCM_CLIENT_SECRET, and SCM_TSG_ID.
  4. The agent sends POST /sse/config/v1/config-versions/candidate:push.
  5. Pending candidate changes are pushed without a separate, informed authorization step.
  6. Unreviewed or erroneous changes may alter production connectivity or security enforcement.

Impact Assessment

The operation can act within the configuration scope and ...[truncated 619 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the push request with a documented read-only endpoint for inspecting candidate configuration or status.
  2. Clearly label candidate:push as a mutating deployment operation rather than a diagnostic status check.
  3. Require explicit user confirmation immediately before any configuration push.
  4. Display or summarize pending changes and validate them before requesting approval.
  5. Verify the target tenant, folder, and configuration scope before execution.
  6. Use a dry-run or validation endpoint where the SCM API supports one.
  7. Check for concurrent edits and active jobs before initiating a push.
  8. Monitor the resulting job to completion and report all validation or deployment errors.
  9. Document a tested rollback or recovery procedure for failed or disruptive pushes.
  10. Use least-privilege SCM credentials so read-only troubleshooting cannot invoke configuration deployment operations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly includes a live configuration push operation (POST /sse/config/v1/config-versions/candidate:push) in a troubleshooting guide without any warning, confirmation requirement, or guardrail distinguishing read-only diagnosis from change-making actions. In this context, a user or agent could invoke a push during troubleshooting and unintentionally apply pending changes to production Prisma Access configuration, causing outages, policy drift, or deployment of unreviewed edits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.