ClawHub
Back to skill

Security audit

Clawhub Skill Infra Watchdog

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local monitoring skill, but its SSL checks can falsely report certificates as valid, which is risky for infrastructure monitoring.

Review this carefully before relying on it for certificate or HTTPS security monitoring. It appears locally scoped and not malicious, but its SSL checks are not trustworthy as shipped, and several advertised features are incomplete or inconsistent with the code.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
watchdog.py:171
Finding

HTTPS and SSL Monitoring Disables TLS Certificate Validation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

infra-watchdog add-monitor
--type http
--name "Main API"
--url https://api.example.com/health
--expected-status 200
--timeout 5

text

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · watchdog.py (reported line 212)May include surrounding context.

python
def check_docker(self, container_id: str) -> Tuple[str, float, str]:
        """Check Docker container status. Returns (status, 0, details)."""
        try:
            result = subprocess.run(
                ['docker', 'inspect', container_id],
                capture_output=True,
                text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · watchdog.py (reported line 234)May include surrounding context.

python
def check_disk(self, mount_point: str = '/') -> Tuple[str, float, str]:
        """Check disk usage. Returns (status, 0, details)."""
        try:
            result = subprocess.run(
                ['df', '-h', mount_point],
                capture_output=True,
                text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · watchdog.py (reported line 258)May include surrounding context.

python
def check_memory(self) -> Tuple[str, float, str]:
        """Check memory usage. Returns (status, 0, details)."""
        try:
            result = subprocess.run(
                ['free', '-b'],
                capture_output=True,
                text=True,

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The function claims to check SSL certificate expiry, but it disables certificate validation and then returns 'Certificate valid' without actually parsing or comparing the certificate expiration date. This can create a false sense of safety, causing operators to miss expired or invalid certificates and undermining the monitoring system's reliability for security-sensitive infrastructure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · watchdog.py (reported line 459)May include surrounding context.

python
def cmd_cron_install(args):
    """Install cron job for periodic checks."""
    config = load_config()
    interval = config.get('check_interval_minutes', 5)

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code performs network requests to user-supplied targets via urllib without any confirmation prompt or explicit user-facing notice at the point of execution. Although network monitoring is the skill's purpose, the code itself lacks disclosure that running checks will contact configured endpoints and transmit request metadata to them.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.