Unifi Inforjota Integration

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:03 AM UTC
• Version: 1.0.3

Overview

This UniFi monitoring skill appears read-only, but it has review-worthy credential and transport-security risks before installation.

Review before installing. Use a dedicated read-only UniFi API key, do not follow the README instruction to create or store a local admin password, restrict the credential file to owner-only permissions, and avoid using this skill unless TLS verification is fixed or a trusted gateway certificate/CA is configured. Treat outputs as sensitive because they can reveal device names, IPs, MAC addresses, network topology, alarms, and traffic metadata.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/unifi-api.sh:22

Finding

TLS Certificate Verification Is Disabled for Authenticated UniFi Requests

Content

View full analysis

Vulnerability Details

File Location: scripts/unifi-api.sh:22-28
Vulnerability Type: Improper certificate validation
Risk Level: High

Vulnerable Code

bash

unifi_request() {
  local path="$1"
  curl -sk \
    -H "X-API-KEY: $UNIFI_TOKEN" \
    -H "Accept: application/json" \
    "$UNIFI_URL$path"
}

The same insecure curl -sk pattern also occurs in:

• scripts/clients.sh:11-19
• scripts/devices.sh:10-18
• scripts/health.sh:11-15
• scripts/sites.sh:10-13

Technical Analysis

The -k option instructs curl to skip TLS certificate verification. These requests include the sensitive UniFi API key in the X-API-KEY header. Encryption alone does not establish server identity when certificate validation is disabled.

An attacker with a network interception position could present an arbitrary certificate, impersonate the configured UniFi gateway, and receive the API key. The attacker could also forge API responses, causing the Skill to report false device, client, alarm, or health information.

Although self-signed certificates are common on local UniFi gateways, globally disabling verification is not the minimum-risk solution. The gateway certificate or a private certificate authority should instead be explicitly trusted.

Attack Path

1. A user configures a legitimate HTTPS UniFi gateway URL and invokes one of the monitoring scripts.
2. An attacker obtains a traffic-interception position, such as through a compromised router, malicious wireless network, ARP spoofing, or DNS manipulation.
3. The attacker redirects the gateway connection to an attacker-controlled HTTPS service.
4. The attacker presents an untrusted certificate.
5. Because curl -k suppresses certificate verification, the script accepts the certificate.
6. The script sends X-API-KEY: $UNIFI_TOKEN to the attacker-controlled service.
7. The attacker captures and reuses the key or returns forged monitoring data.

Impact Assessment

The attacker can obt ...[truncated 487 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove -k from all curl invocations and enable normal certificate verification by default.
2. Support a configured CA or pinned gateway certificate, for example:

bash

curl --fail-with-body --silent --show-error \
  --cacert "$UNIFI_CA_FILE" \
  -H "X-API-KEY: $UNIFI_TOKEN" \
  -H "Accept: application/json" \
  "$UNIFI_URL$path"

3. For self-signed gateways, document how to export the gateway certificate and configure UNIFI_CA_FILE.
4. If insecure TLS must be supported for compatibility, require an explicit option such as UNIFI_INSECURE_TLS=1, keep secure verification as the default, and print a prominent warning.
5. Centralize all requests through unifi_request so that clients.sh, devices.sh, health.sh, and sites.sh cannot independently reintroduce unsafe TLS options.
6. Add --fail-with-body, connection and total timeouts, and an HTTPS scheme check.
7. Rotate any API key that may previously have traversed an untrusted network while certificate validation was disabled.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: README.md:17

Finding

Setup Documentation Requests Unnecessary Administrator Credentials and Omits Restrictive File Permissions

Content

View full analysis

Vulnerability Details

File Location: README.md:17-39
Vulnerability Type: Excessive privilege guidance and insecure plaintext credential storage
Risk Level: Medium

Vulnerable Documentation

markdown

### 1. Create a Local Admin Account

1. Open your UniFi OS console (e.g., `https://10.1.0.1`)
2. Go to **OS Settings → Admins & Users**
3. Create a new **local admin** (not cloud/Ubiquiti account)
4. Note the username and password

### 2. Create Credentials File

```bash
mkdir -p ~/.clawdbot/credentials/unifi
cp config.json.example ~/.clawdbot/credentials/unifi/config.json
# Edit with your actual values

Or create manually:

json

{
  "url": "https://10.1.0.1",
  "username": "api",
  "password": "your-password-here",
  "site": "default"
}

text

The implemented authentication logic does not use these administrator credentials. It instead requires an API token:

```bash
UNIFI_URL=$(jq -r '.url // empty' "$CONFIG_FILE")
UNIFI_TOKEN=$(jq -r '.token // empty' "$CONFIG_FILE")
UNIFI_SITE=$(jq -r '.site // "default"' "$CONFIG_FILE")

if [ -z "$UNIFI_URL" ] || [ -z "$UNIFI_TOKEN" ]; then
  echo "Error: UniFi config must include url and token" >&2
  exit 1
fi

Technical Analysis

The README instructs users to create a local administrator and store its username and plaintext password, even though scripts/unifi-api.sh only reads url, token, and site. Administrator credentials therefore exceed the minimum privileges required by the implemented API-key monitoring workflow.

The setup commands also do not explicitly apply restrictive permissions to either the credentials directory or the file. Their effective permissions depend on the user's umask. Under a permissive configuration, another local account or process could read the administrator password.

The credential path itself—~/.clawdbot/credentials/unifi/config.json—is functionally justified because authenticated monitoring requires a credential. The security issue is the u ...[truncated 1517 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all instructions to create a local administrator or store a username and password.
2. Document only the implemented API-key schema:

json

{
  "url": "https://gateway.local",
  "token": "READ_ONLY_API_KEY",
  "site": "default"
}

3. Require a dedicated, revocable, read-only API key scoped to the minimum sites and resources needed for monitoring.
4. Create the directory and file with explicit owner-only permissions:

bash

install -d -m 700 "$HOME/.clawdbot/credentials/unifi"
install -m 600 /path/to/config.json \
  "$HOME/.clawdbot/credentials/unifi/config.json"

5. Add runtime permission checks that reject or prominently warn about group-readable or world-readable credential files.
6. Update the README environment-variable section and troubleshooting guidance, which currently refer to unused username/password and cookie-based authentication.
7. Ensure the README and SKILL.md describe one consistent authentication model.
8. Advise users who followed the old instructions to remove the unnecessary administrator account and rotate its password.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README describes listing clients, hostnames, IPs, AP associations, alerts, and application usage without warning that this data is sensitive operational and potentially personal information. In a monitoring skill, this omission is dangerous because users may expose or share outputs without realizing they contain internal network topology and client-identifying details.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Claiming the skill is read-only and safe while requiring creation of a local admin account is contradictory and undermines least-privilege security. If the admin credential is compromised or reused elsewhere, an attacker could gain broad control over the UniFi console, not merely read monitoring data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

md

## Setup

### 1. Create a Local Admin Account

1. Open your UniFi OS console (e.g., `https://10.1.0.1`)
2. Go to **OS Settings → Admins & Users**

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README instructs users to configure a local admin username/password even though the skill metadata says it should use an API-key-based integration model. This creates unnecessary privileged credential use, increases blast radius if the credential is exposed, and misleads users about the actual trust and access model of the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README instructs users to store credentials and later states that TLS verification is disabled via curl -k, but it does not warn about the interception risk. Skipping certificate verification can enable man-in-the-middle attacks that capture admin credentials or alter returned monitoring data.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 111)May include surrounding context.

md

→ Wrong username/password. Must be a **local** admin, not Ubiquiti cloud account.

**SSL certificate error**  
→ UniFi uses self-signed certs. The scripts use `-k` to skip verification.

**Empty data or "Invalid site"**  
→ Most setups use `default`. Check your site name in the UniFi Network URL.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes shell scripts but does not declare any explicit tool scope or allowed-tools constraints. That creates unnecessary execution latitude and weakens least-privilege guarantees, increasing the chance of unintended shell use if the skill is invoked in broader contexts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill instructs users to persist the UniFi API key in a local plaintext credentials file under the home directory. Persistent local secrets increase exposure to theft by other processes, users, backups, logs, or accidental file disclosure, especially because the token provides authenticated access to network monitoring data.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

## Setup

Create the credentials file:

`~/.clawdbot/credentials/unifi/config.json`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The document describes read-only access to endpoints that expose active clients, known users, device inventories, events, alarms, DPI traffic data, firewall rules, port forwards, WLANs, and RADIUS-related configuration. While it emphasizes using GET-only and avoiding mutation, it does not warn readers that these calls can reveal sensitive user, network, and security information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script makes authenticated HTTP requests using the sensitive environment variable UNIFI_TOKEN and fetches client inventory data including IP and MAC addresses. Although the file header says it lists active clients, there is no confirmation prompt, user-facing notice, or inline warning about the privacy-sensitive network access and data retrieval performed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script fetches and displays sensitive network inventory and client data, including device names, hostnames, IP addresses, MAC addresses, WLANs, networks, and alarms, with no masking, minimization, or user-facing warning. In a skill that may be invoked interactively, this can expose internal infrastructure details and client identifiers to users who asked a broad status question, increasing the risk of unnecessary data disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code makes multiple HTTPS requests to a UniFi API using an API token and retrieves site, device, and client data, which are privacy- and system-sensitive operations. Within this file there is no confirmation prompt, warning comment, or user-facing disclosure indicating that network inventory data will be transmitted and processed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code performs an HTTP request and transmits a credential via the X-API-KEY header, but the script contains no confirmation prompt, user-facing log message, or comment warning about the network access and credential use. For a code file, this matches the missing user warning criteria for network calls and sensitive credential handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script uses curl with the -k flag, which disables TLS certificate verification for all UniFi API requests. This allows a man-in-the-middle attacker on the network path to impersonate the UniFi endpoint, intercept the X-API-KEY, and tamper with returned JSON data without detection. In this skill context, the risk is heightened because the script handles a reusable API credential and may be used for monitoring or decision-making based on untrusted responses.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The trigger phrase "dashboard" is generic and can match unrelated user requests, causing the UniFi skill to activate outside its intended context. Unintended invocation can expose network metadata or cause unnecessary access to stored credentials even though the skill is nominally read-only.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The trigger phrase "clients" is overly broad and likely to collide with many unrelated conversations. This can lead to accidental execution of network-query scripts and disclosure of connected-client information in situations where the user did not intend to query UniFi.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The trigger phrase "alerts" is too generic and may invoke the skill for unrelated alerting discussions. Even read-only alarm retrieval can reveal operational details about the network and create confusing or unauthorized data access through accidental activation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.