ClawHub
Back to skill

Security audit

Homelab Runbook

Security checks for vulnerabilities and agentic risk

Overview

This skill performs the host service inventory it advertises, with no hidden network transfer, credential access, or destructive behavior found.

Install only if you want an agent to inventory this host. Treat generated runbooks as sensitive because they can reveal services, ports, container names, images, mount names, and process details; keep reports out of public repos and shared folders, and use sudo only when you intentionally want broader port visibility.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
scripts/generate_runbook.py:206
Finding

Host-Wide Service and Network Reconnaissance Produces a Sensitive Inventory

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents a broad host-service inventory tool spanning Docker, init/system services, and network listening ports, with Markdown documentation output. The supplied code chunk is much narrower: it only interacts with the Docker CLI (docker info, docker ps) to enumerate running containers and returns structured JSON. There is no code for launchd/systemd inspection, port scanning, cron behavior, cross-platform service enumeration, or Markdown generation. This is a material description-versus-behavior mismatch because the implemented primary purpose is a Docker-only scanner, not a comprehensive machine-wide service/runbook generator.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents a broad host-service inventory and documentation tool, but the supplied code chunk implements only a network port scanner for listening TCP sockets. While port scanning is one subset of the declared behavior, the primary claimed functionality—documenting Docker containers and system services and producing a Markdown runbook with richer metadata—is absent. The actual code's purpose is materially narrower than the declared purpose, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The implemented code is substantially narrower than the declared description. It uses launchctl list on macOS and systemctl list-units --type=service --state=running on Linux to enumerate running system services only. Its output is JSON, not a human-readable Markdown runbook. It does not query Docker, network sockets, container images, volume mounts, or health checks, and there is no code for scheduled execution. While the description mentions macOS and Linux service scanning, the broader declared purpose materially overstates the actual behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs the agent to use shell execution and write a runbook file, but it does not declare any explicit tool scope or permissions. That omission weakens policy enforcement and user transparency, increasing the chance the skill runs with broader host access than intended while collecting sensitive host inventory data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are broad enough to match common requests like 'what's running' or 'scan ports', which can cause the skill to activate in situations where the user did not clearly intend host enumeration. Because the skill gathers sensitive local infrastructure details, overbroad activation increases the risk of unnecessary reconnaissance and unintended disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill enumerates Docker containers, system services, open ports, images, mounts, PIDs, and health data, then writes them into a Markdown file, but the instructions omit a warning that this is sensitive host reconnaissance data. In context, this is especially dangerous because the output can expose internal topology, management ports, filesystem paths, and service metadata that could aid lateral movement or unauthorized access if shared or stored insecurely.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_runbook.py (reported line 32)May include surrounding context.

python
"""Run a scanner script and return its parsed JSON output."""
    script = os.path.join(SCRIPTS_DIR, script_name)
    try:
        result = subprocess.run(
            [sys.executable, script],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/scan_docker.py (reported line 13)May include surrounding context.

python
def docker_available():
    try:
        result = subprocess.run(
            ["docker", "info"],
            capture_output=True,
            timeout=5,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/scan_docker.py (reported line 36)May include surrounding context.

python
# Try --format json (Docker 20.10+)
    try:
        result = subprocess.run(
            ["docker", "ps", "--format", "{{json .}}"],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/scan_docker.py (reported line 67)May include surrounding context.

python
# Fallback: plain docker ps
    try:
        result = subprocess.run(
            ["docker", "ps", "--no-trunc"],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/scan_ports.py (reported line 26)May include surrounding context.

python
"""Use lsof to find listening TCP ports."""
    lsof = _find_lsof()
    try:
        result = subprocess.run(
            [lsof, "-iTCP", "-sTCP:LISTEN", "-n", "-P"],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/scan_ports.py (reported line 90)May include surrounding context.

python
def scan_linux():
    """Use ss to find listening TCP ports."""
    try:
        result = subprocess.run(
            ["ss", "-tlnp"],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/scan_ports.py (reported line 155)May include surrounding context.

python
def scan_linux_netstat():
    """Fallback using netstat if ss is not available."""
    try:
        result = subprocess.run(
            ["netstat", "-tlnp"],
            capture_output=True,
            text=True,

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The implementation materially underdelivers relative to the skill metadata, claiming broad host scanning and runbook generation while only enumerating launchd/systemd services and emitting JSON. This can create a false sense of coverage, causing users to rely on incomplete inventory data and overlook exposed ports, containers, mounts, or unhealthy services during security or operations workflows.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/scan_services.py (reported line 19)May include surrounding context.

python
def scan_macos():
    """Use launchctl list to get running services."""
    try:
        result = subprocess.run(
            ["launchctl", "list"],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/scan_services.py (reported line 65)May include surrounding context.

python
def scan_linux():
    """Use systemctl to list running services."""
    try:
        result = subprocess.run(
            [
                "systemctl",
                "list-units",