ClawHub
Back to skill

Security audit

Tailscale Manager

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only Tailscale helper, but its broad activation trigger and incomplete IP redaction deserve review before installation.

Install only if you are comfortable letting the agent read and display Tailscale device, hostname, owner/whois, status, and diagnostic information from your current tailnet. Treat the IP masking as best-effort rather than guaranteed until the stderr and fallback output paths are fixed, and prefer explicit Tailscale command requests over broad conversational triggers.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/tailscale_ctrl.py:146
Finding

Public IP Disclosure Through Unmasked Output Fallbacks

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding

The declared behavior does not fully match the exposed commands: whois and ip are available without being clearly disclosed, and serve/funnel inspection is described more broadly than implemented. Behavior mismatches weaken operator trust and review accuracy, and can expose network-identifying information or enable uses that were not evaluated under the stated security assumptions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises shell-backed capabilities but does not declare any explicit tool scope or allowed-tools boundary. In an agent environment, missing permission declarations can allow broader-than-intended command execution paths or make policy enforcement ambiguous, which is risky even if the documented commands are read-only.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Using tailnet as a trigger is overly broad and may cause the skill to activate during ordinary conversation rather than clear user intent to run network queries. Unintended invocation could disclose device status, internal hostnames, Tailscale IPs, or diagnostic data from a sensitive network context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script exposes a whois lookup capability that is outside the skill metadata's declared feature set, which creates a scope mismatch between what operators expect and what the code can actually do. In an agent setting, hidden or undocumented capabilities are dangerous because they may disclose identity, device-owner, or node-mapping information from the tailnet without users or reviewers realizing that this action is available.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tailscale_ctrl.py (reported line 49)May include surrounding context.

python
"""Execute a tailscale command and return raw stdout/stderr (NO masking)."""
    cmd = ["tailscale"] + args
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return {
            "returncode": result.returncode,
            "stdout": result.stdout.strip(),

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The trigger list includes "chi è connesso", which introduces a language-specific behavior, but the document does not state that multilingual triggering is optional or explain the locale policy. This can conflict with language/locale requirements when a skill silently forces or embeds support for a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The module documentation states public IPs are masked only in final output after JSON parsing. However, in main() JSON mode serializes the entire data structure and then applies regex masking over the full JSON text, which is broader than the documented behavior and not limited to parsed/display fields in the way described.

Content

No source excerpt is available for this finding.