ClawHub
Back to skill

Security audit

Uptime Kuma

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Uptime Kuma administration helper, but it can immediately delete monitors or pause all monitoring without built-in confirmation or safety guidance.

Install only if you intend to let the agent administer Uptime Kuma, not just answer general uptime questions. Use a dedicated least-privileged Uptime Kuma account, install dependencies in an isolated environment, and require explicit human confirmation before delete operations or any pause-all maintenance workflow.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–15
Vulnerability Type: Unpinned third-party dependency and unsafe supply-chain resolution
Risk Level: Medium

Vulnerable Code:

markdown
Requires `uptime-kuma-api` Python package:
```bash
pip install uptime-kuma-api
text

The installed dependency is subsequently imported by `scripts/kuma.py` at lines 18–21:

```python
try:
    from uptime_kuma_api import UptimeKumaApi, MonitorType
except ImportError:
    print("Error: uptime-kuma-api not installed. Run: pip install uptime-kuma-api", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The documented installation command asks pip to resolve and install the latest available version of uptime-kuma-api and its transitive dependencies. The project supplies no exact version constraint, lockfile, package hashes, or other integrity verification.

Python packages can run code during installation and whenever imported. Consequently, a compromised package release or transitive dependency could execute arbitrary code in the installing or running user's context. When the CLI runs, its process has access to UPTIME_KUMA_URL, UPTIME_KUMA_USERNAME, and UPTIME_KUMA_PASSWORD, making dependency compromise particularly sensitive.

This is a supply-chain exposure rather than evidence that the currently published dependency is malicious.

Attack Path

  1. An attacker compromises the uptime-kuma-api package, one of its transitive dependencies, or the package publication account.
  2. The attacker publishes a malicious version that remains compatible with the unpinned package name.
  3. A user follows the setup instructions and runs pip install uptime-kuma-api.
  4. pip resolves and installs the attacker-controlled release because no approved version or hash is enforced.
  5. Malicious code executes during installation or when scripts/kuma.py imports the package.
  6. The payloa ...[truncated 960 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin uptime-kuma-api and every transitive dependency to versions that have been reviewed and tested.
  2. Store dependencies in a committed requirements or lock file containing cryptographic hashes.
  3. Install with hash enforcement, for example:
    bash
    python -m pip install --require-hashes -r requirements.txt
  4. Generate and review the locked dependency set with a tool such as pip-tools, and update it through a controlled review process.
  5. Configure installation to use an explicitly trusted package index rather than arbitrary or user-controlled indexes.
  6. Run vulnerability and provenance checks against dependency updates before approval.
  7. Install and run the CLI in an isolated virtual environment or container under a least-privileged account.
  8. Use a dedicated, least-privileged Uptime Kuma account and avoid exposing its credentials to unrelated processes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill relies on environment-provided credentials and networked API access, but the manifest declares no explicit tool scope or permissions boundary. In an agent setting, this can lead to overbroad execution context and unclear authorization for accessing secrets or invoking external systems, increasing the chance of unintended or unauthorized monitor changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The trigger description is broad enough to activate on generic monitoring or uptime-related conversation, which raises the risk that the agent invokes a skill capable of changing monitor state when the user only intended to ask a general question. Because the skill supports add, pause, resume, and delete operations, accidental invocation could lead to real operational changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation presents monitor deletion as a simple command without warning, safety checks, or confirmation guidance. In an agent-assisted workflow, this lowers the barrier to destructive actions and increases the likelihood of accidental deletion of monitoring coverage, which can blind operators to outages or incidents.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

Add HTTP monitor with 30s interval:

bash
python scripts/kuma.py add --name "API Health" --type http --url https://api.example.com/health --interval 30

Maintenance mode (pause all):

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The bulk pause example loops through every monitor and disables checks without any warning about service-wide monitoring loss. If copied into an agent or shell workflow, this can suppress alerting across the entire estate and materially reduce incident detection during outages or attacks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The delete command performs irreversible monitor deletion immediately with no confirmation prompt, dry-run mode, or safety interlock. In an agent setting, this increases the chance of accidental or prompt-induced destructive actions, especially because valid credentials are pulled automatically from the environment and the operation executes with full API authority.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The manifest describes operations around monitor status, monitor lifecycle, pausing/resuming checks, and heartbeat history. The code also implements a notifications command that lists notification channels, which is a separate administrative capability not mentioned in the skill description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.