ClawHub
Back to skill

Security audit

monitoring-specialist

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only monitoring skill whose telemetry and alerting examples are purpose-aligned but should be sanitized before production use.

Install only if you want monitoring and observability implementation guidance. Before using the examples in production, replace placeholder endpoints, restrict webhook destinations, avoid sending raw log messages or direct user IDs, redact sensitive fields, and control screenshot retention and alert recipients.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
references/examples.md:287
Finding

Unredacted Application Error Data Sent to an External Webhook

Content
View full analysis
"${SLACK_WEBHOOK_URL}" http_method => "post" format => "json" mapping => { "text" => "Error in %{service}: %{msg}" "attachments" => [ { "color" => "danger" "fields" => [ {"title" => "Service", "value" => "%{service}"}, {"title" => "Level", "value" => "%{level}"}, {"title" => "Time", "value" => "%{timestamp}"} ] } ] } } } ``` ### Technical Analysis The example interpolates the complete `%{msg}` log field into an HTTP request sent to the destination configured by `SLACK_WEBHOOK_URL`. There is no filtering, redaction, truncation, or field allowlist before transmission. Application error messages can contain session tokens, authorization headers, request parameters, personal information, database values, internal hostnames, or stack-trace details. Log content may also include attacker-controlled input. Forwarding the complete message to an external collaboration service therefore exposes more information than is necessary to notify operators that an error occurred. Sending alerts is consistent with the Skill's monitoring purpose, but transmitting arbitrary raw application messages exceeds data-minimization and least-disclosure requirements. The destination is configurable rather than demonstrably malicious; nevertheless, a configuration error, leaked webhook, or compromised channel could expose all forwarded content. ### Attack Path 1. An attacker submits a crafted value through an application input that is subsequently included in an ERROR or FATAL log entry. 2. Alternatively, normal application failures cause cr ...[truncated 1213 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
references/examples.md:344
Finding

Direct User Identifier Exported in Distributed Tracing Telemetry

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 55)May include surrounding context.

md
static_configs:
      - targets:
          - https://example.com
          - https://api.example.com/health
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The example sends error information, including service name, message content, and timestamp, to Slack using an HTTP webhook. The markdown does not disclose that log contents may leave the primary environment and be sent to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file contains a Python example that configures Jaeger tracing and sends span data from requests to an external tracing backend, including attributes such as user identifiers and request metadata. The surrounding markdown provides no warning that the example transmits potentially sensitive operational or user data off-process.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 357)May include surrounding context.

md
# External service call
        with tracer.start_as_current_span("external_api_call"):
            response = requests.get("https://api.external.com/data")
            span.set_attribute("http.status_code", response.status_code)
            span.set_attribute("http.url", response.url)

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 374)May include surrounding context.

TraceContextTextMapPropagator().inject(headers)

text
with tracer.start_as_current_span("downstream_request"):
    response = requests.post(url, json=data, headers=headers)
    return response.json()
text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This example saves screenshots under /tmp and then sends an alert containing failure details and a screenshot path, but the markdown does not warn users about file creation or alerting side effects. For a markdown skill description, omitted warnings about data capture and outbound notifications can affect privacy and system integrity expectations.

Content

No source excerpt is available for this finding.