ClawHub
Back to skill

Security audit

superviser ressources

Security checks for vulnerabilities and agentic risk

Overview

This server supervisor skill is coherent, but it needs review because it describes automatic self-healing and service restarts without clear limits or approval controls.

Install only if you intentionally want an infrastructure supervisor that may monitor Docker and named websites and may perform automatic recovery. Before using it on production systems, require clear configuration for monitored resources, restart behavior, opt-in approval or safe reporting mode, logging, and a way to disable recurring self-healing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README explicitly states that the agent scans the server every 5 minutes and attempts 'auto-healing' when a site or container stops, but it does not warn about potentially disruptive actions such as automatic restarts or service changes. In an infrastructure-management skill, undocumented autonomous remediation can cause outages, restart loops, or unexpected state changes, making this a real operational security concern.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly states that the agent scans the server every 5 minutes and performs self-healing when a site or container stops, which implies autonomous state-changing actions on production resources. Even without obviously malicious wording, undocumented or insufficiently warned automatic restarts can cause unintended service disruption, hide underlying incidents, or restart compromised workloads without operator approval.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
No manifest is available, so the skill's purpose is unknown. In that context, invoking the Docker CLI via subprocess is a privileged host-inspection capability that goes beyond simple local computation and is not inherently justified by the visible file alone. This materially expands the skill's operational reach compared with ordinary monitoring logic such as in-process resource checks or HTTP health requests.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def get_docker_status():
    try:
        res = subprocess.run(['docker', 'ps', '--format', '{{.Names}}|{{.Status}}'], capture_output=True, text=True)
        return res.stdout.strip().split('\n')
    except:
        return []
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low
Confidence
88% confidence
Finding
The natural-language instructions and usage are presented only in French, which can amount to forcing a specific language without user opt-in. The file does not explain that the skill is region-specific or offer an alternative language choice.

Natural-Language Policy Violations

Low
Confidence
88% confidence
Finding
The natural-language instructions and usage are presented only in French, which may impose a language choice on users without opt-in. The file does not document that the skill is intended only for French-speaking users or a French-specific environment.

Natural-Language Policy Violations

Low
Confidence
89% confidence
Finding
The manifest description is written only in French ("Superviseur de ressources et de santé des services avec auto-guérison.") and provides no indication that language choice is optional. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Missing User Warnings

Low
Confidence
83% confidence
Finding
This code sends network requests to external endpoints to collect service health, but there is no confirmation prompt, comment, docstring, or user-facing log explaining that outbound HTTP checks will occur. For a code file, network calls that transmit system context or monitoring activity should include some visible disclosure unless clearly documented elsewhere.

Missing User Warnings

Low
Confidence
79% confidence
Finding
The script invokes a subprocess to inspect local Docker container names and statuses, which accesses local system state, but there is no prompt, comment, docstring, or visible notice describing this behavior. Under the code-file criteria, subprocess execution should have some form of disclosure unless already clearly documented as the skill's expected purpose.

Static analysis

No suspicious patterns detected.