T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/gcp-roles.json:14- Finding
Excessive Project-Wide IAM Permissions Violate Least Privilege
- Content
View full analysis
- Remediation
View remediation
Security audit
AuditClaw Gcp
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to perform legitimate GCP compliance collection, but it asks users to grant broad project-wide read access and create a long-lived cloud key without enough scoping or credential-safety guidance.
Install only if you are comfortable granting this skill broad read visibility into the target GCP project and storing compliance evidence locally. Prefer keyless authentication or a tightly scoped custom role where possible; if you use a service account JSON key, keep it outside repositories, restrict file permissions, rotate it, and revoke it when no longer needed. Treat the local GRC database as sensitive compliance data.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/gcp_evidence.py:228- Finding
Connection Test Reports Unexpected API Failures as Successful Access
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared purpose emphasizes 'read-only checks,' but the skill also writes evidence and integration status into a local SQLite database and exposes a test-connection mode, while the documented check count/category mapping is inconsistent. This mismatch is dangerous because users and orchestrators may grant trust or permissions based on an incomplete description, leading to unexpected state changes, overbroad execution, or incorrect risk assumptions about what the skill actually does.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The markdown states that the skill runs checks against a GCP project and stores evidence in a shared database, which can affect user or organizational data handling. The description does not include any warning about what data is collected, persisted, or the implications of writing compliance evidence to shared storage.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises executable behavior and explicitly depends on environment variables and shell-invoked setup/usage commands, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates an authorization and transparency gap: an agent or reviewer cannot easily constrain or reason about what external capabilities the skill may exercise, increasing the chance of unintended command execution or environment access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The setup guide instructs users to create a long-lived service account JSON key and place it on disk, but it provides no warning about secret sensitivity, storage protections, rotation, or safer alternatives. Service account keys are highly valuable credentials; if leaked through logs, backups, shell history, shared filesystems, or misconfigured file permissions, an attacker could gain ongoing read access to the GCP project and potentially pivot further depending on granted roles.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes the skill as performing '12 read-only checks' across GCP services, which suggests observational behavior. However, this script not only runs checks but also inserts evidence records and updates integration status in a SQLite database, making persistent state changes outside the read-only checking scope described in the manifest.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "--file-content", json.dumps(result, default=str), ] proc = subprocess.run(cmd, capture_output=True, text=True) if proc.returncode != 0: return _store_evidence_direct(db_path, check_name, result)
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The function retrieves application default credentials and immediately uses them to call the Cloud SQL Admin API. While this is consistent with the check's purpose, the file contains no user-facing print/log statement or explicit warning that it will use ambient GCP credentials and contact Google APIs.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This code instantiates a GCP KMS client and enumerates key rings across the project, which is a network/API operation that transmits project context to an external cloud service. While the function has an internal docstring, there is no user-facing prompt, logging, or warning indicating that cloud KMS inventory data will be queried.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
This JSON manifest includes actionable setup commands for creating a service account, granting roles, and generating a key, but it does not describe when these commands should or should not be invoked. In a manifest-scoped file, the lack of trigger scope or negative examples can make activation or use conditions ambiguous for automation that consumes the manifest.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The connection test treats many unexpected exceptions as successful access, which can produce false 'ok' results even when APIs are unreachable, misconfigured, or failing for non-permission reasons. This can mislead operators into trusting broken monitoring or evidence collection, reducing visibility and potentially causing missed compliance or security issues.
- Content
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python for service_name, module_path, class_name, method_name, kwargs in optional_probes: try: mod = importlib.import_module(module_path) client_class = getattr(mod, class_name) if method_name: client = client_class() method = getattr(client, method_name)
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python client_class = getattr(mod, class_name) if method_name: client = client_class() method = getattr(client, method_name) list(method(**kwargs)) else: client_class(project=project_id)
Static analysis
No suspicious patterns detected.