ClawHub
Back to skill

Security audit

It Ops Toolkit

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent IT operations toolkit, but its remote/network features use unsafe credential and command-handling patterns that need manual review before installation.

Install only if you trust the publisher and will use it on authorized systems. Before enabling automatic use, require confirmation for remote SSH, batch checks, port scans, log reads, and RTSP stream tests; use least-privilege SSH accounts with normal host-key verification; avoid putting passwords in chat, command arguments, or RTSP URLs; and treat generated outputs as potentially containing sensitive infrastructure details.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/service_check.py:100
Finding

PowerShell Command Injection Through Windows Service Names

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/sys_monitor.py:323
Finding

SSH Server Authentication Disabled for Remote Monitoring

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/troubleshoot.py:1622
Finding

RTSP Password Exposure Through Command Arguments, Output, URLs, and Cleartext Basic Authentication

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (46)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 97)May include surrounding context.

md
| `netif` | 网络接口信息（IP/掩码） | `netif` |
| `full` | 全面系统扫描 | `full` |
| `remote` | **远程服务器全面监控**（SSH） | `remote root@192.168.1.100` |
| `rinfo` | **远程系统信息** | `rinfo deploy@10.0.0.1 -k ~/.ssh/id_rsa` |
| `rcpu` | **远程CPU监控** | `rcpu root@192.168.1.100` |
| `rmem` | **远程内存监控**（含 Swap） | `rmem deploy@10.0.0.1` |
| `rdisk` | **远程磁盘监控** | `rdisk root@192.168.1.100` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
| `troubleshoot.py` | 问题排查（日志/oom/崩溃/网络/性能/**视频监控**/**取流测试**/**RTSP快捷取流**/根因） |

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/network_diag.py (reported line 416)May include surrounding context.

python
def main():
    if sys.platform == "win32":
        os.system("")

    parser = argparse.ArgumentParser(description="IT运维工具箱 - 服务检查")
    sub = parser.add_subparsers(dest="cmd", required=True)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/service_check.py (reported line 291)May include surrounding context.

python
def main():
    if sys.platform == "win32":
        os.system("")

    parser = argparse.ArgumentParser(description="IT运维工具箱 - 服务检查")
    sub = parser.add_subparsers(dest="cmd", required=True)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/sys_monitor.py (reported line 749)May include surrounding context.

python
def main():
    if sys.platform == "win32":
        os.system("")

    parser = argparse.ArgumentParser(description="IT运维工具箱 - 服务检查")
    sub = parser.add_subparsers(dest="cmd", required=True)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/troubleshoot.py (reported line 1859)May include surrounding context.

python
def main():
    if sys.platform == "win32":
        os.system("")

    parser = argparse.ArgumentParser(description="IT运维工具箱 - 服务检查")
    sub = parser.add_subparsers(dest="cmd", required=True)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/utils.py (reported line 373)May include surrounding context.

python
def main():
    if sys.platform == "win32":
        os.system("")

    parser = argparse.ArgumentParser(description="IT运维工具箱 - 服务检查")
    sub = parser.add_subparsers(dest="cmd", required=True)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/sys_monitor.py (reported line 416)May include surrounding context.

python
import json
except:
    pass
out = subprocess.check_output('grep -c ^processor /proc/cpuinfo 2>/dev/null || echo 0', shell=True).decode()
logical = out.strip()
out2 = subprocess.check_output('top -bn1 | grep \"Cpu(s)\" 2>/dev/null', shell=True).decode()
pct = 0.0

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/sys_monitor.py (reported line 422)May include surrounding context.

python
pct = 0.0
m = re.search(r'(\d+\.?\d*)\s+id', out2)
if m: pct = round(100.0 - float(m.group(1)), 1)
out3 = subprocess.check_output('cat /proc/cpuinfo 2>/dev/null | grep \"model name\" | head -1', shell=True).decode()
name = out3.split(':')[1].strip() if ':' in out3 else 'N/A'
out4 = subprocess.check_output('cat /proc/loadavg 2>/dev/null', shell=True).decode().strip()
load = out4.split()[:3] if out4 else []

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/sys_monitor.py (reported line 424)May include surrounding context.

python
if m: pct = round(100.0 - float(m.group(1)), 1)
out3 = subprocess.check_output('cat /proc/cpuinfo 2>/dev/null | grep \"model name\" | head -1', shell=True).decode()
name = out3.split(':')[1].strip() if ':' in out3 else 'N/A'
out4 = subprocess.check_output('cat /proc/loadavg 2>/dev/null', shell=True).decode().strip()
load = out4.split()[:3] if out4 else []
print(json.dumps({'pct': pct, 'name': name, 'logical': logical, 'load': load}))
" 2>/dev/null

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

README 明确强调“通过自然语言触发”“AI 自动选择合适的工具执行”，但没有给出触发白名单、确认步骤或高风险操作边界。对一个具备网络探测、远程 SSH、端口扫描和取流能力的技能来说，宽泛触发会增加误调用高风险脚本的概率，导致非预期的网络访问或远程操作。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

示例触发语包含“帮我全面巡检一下”“远程服务器全面检查”“批量检查所有服务器”等日常化且范围很大的表述，但未说明排除条件或默认安全限制。在 WorkBuddy 自动选脚本执行的上下文中，这可能把普通对话误解释为真实运维操作，触发对远程主机、多个目标或流媒体端点的实际访问。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

README 展示了远程 SSH 监控、批量主机检查以及包含用户名/密码的 RTSP 取流探测能力，但没有在这些示例附近突出说明会发起真实网络连接、可能使用敏感凭据、以及仅应针对已授权资产使用。该技能场景本身具备横向访问与凭据处理能力，缺少显式警示和授权边界会显著放大误用与越权操作风险。

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 115)May include surrounding context.

md
| `docker` | Docker 容器列表 | `docker -a` |
| `dlogs` | Docker 容器日志 | `dlogs myapp -n 100` |
| `dbconn` | 数据库连通性测试 | `dbconn mysql://127.0.0.1:3306 redis://127.0.0.1` |
| `health` | Web 服务健康检查 | `health https://api.example.com/health` |

### 4️⃣ 监控问题排查 (`troubleshoot.py`)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises and instructs execution of Python scripts that perform shell execution, network access, and file/system inspection, but it declares no explicit tool scope or permissions boundaries. In an agentic environment, this increases the chance the skill is invoked with overly broad ambient privileges, enabling unintended command execution, host inspection, or network probing beyond the user's intended task.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger descriptions are broad and cover common natural-language requests across networking, monitoring, troubleshooting, and utility tasks, which raises the risk of accidental invocation. In a system that auto-selects skills from user phrasing, overbroad matching can cause this skill to run powerful diagnostics or network actions when the user did not explicitly request them.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Using generic phrases like '巡检' or '全面检查' without constraining scope can cause the agent to launch a broad inspection workflow automatically. Because the documented workflow chains multiple diagnostics, this may trigger unnecessary host inspection, log access, network checks, or other sensitive operations on ambiguous user input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file forces a specific language for all instructions and examples, and there is no indication that users can select another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, hard-coded language constraints without opt-in or justification are a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation includes RTSP/HTTP command examples with credentials embedded directly in URLs and CLI flags. In an IT operations context, operators often copy-paste examples, which can leak usernames and passwords into shell history, process listings, shared logs, screenshots, or chat transcripts; the risk is heightened because these examples target cameras and streaming systems that are frequently deployed with weak/default credentials.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module description, help text, and all user-facing strings are written in Chinese, implying a fixed language experience. There is no indication that the tool is region-specific or that users can opt into another language, which conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/network_diag.py (reported line 52)May include surrounding context.

python
else:
        cmd = ["ping", "-c", str(count), host]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        output = result.stdout + result.stderr
        print(output)
        # 简单解析丢包率

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/network_diag.py (reported line 168)May include surrounding context.

python
def run_nslookup(cmd):
    """执行 nslookup 命令"""
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10, errors="replace")
        # 合并 stdout 和 stderr（Windows 上 nslookup 把应答输出到 stderr）
        combined = (result.stdout + "\n" + result.stderr) if result.stderr.strip() else result.stdout
        return combined, result.returncode

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The ipinfo feature transmits the queried IP, or the user's own public IP when no parameter is supplied, to a third-party service (ipapi.co) without explicit consent or warning. In an enterprise IT-ops context, this can leak sensitive infrastructure indicators, operator metadata, or workstation egress identity to an external party, which is more concerning because the skill is intended for routine operational use.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
94% confidence
Finding

The helper enables shell execution whenever a string is passed, and this file does pass shell command strings in multiple places. In a skill intended to be triggered from natural language, this greatly increases the risk of command injection if any user-controlled data is ever interpolated into those strings, especially alongside the Windows service command path that already does so.

Content

Scanner excerpt · scripts/service_check.py (reported line 42)May include surrounding context.

python
def run(cmd, timeout=15):
    try:
        r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout,
                           shell=isinstance(cmd, str))
        return r.stdout.strip(), r.stderr.strip(), r.returncode
    except subprocess.TimeoutExpired:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The Windows service check constructs a PowerShell command string by concatenating user-supplied service names, then executes it through the shell. An attacker can inject additional PowerShell syntax or commands via crafted service names, resulting in arbitrary command execution under the privileges of the skill process.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.