ClawHub
Back to skill

Security audit

Nex Healthcheck

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real health-monitoring skill, but it needs review because configured check values can flow into shell commands and it can reveal Telegram credential material.

Install only after reviewing and containing it. Use a low-privilege local account and low-privilege SSH keys, do not add service names, paths, container names, or ssh_cmd targets from untrusted input, avoid running the config command with real Telegram secrets until token masking is fixed, and treat Telegram notifications as sending infrastructure status data to a third party.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"""Helper: Run command via SSH. Returns (output, exit_code)."""
    ssh_cmd = f"ssh {user}@{host} '{command}'"
    try:
        output = subprocess.check_output(ssh_cmd, shell=True, timeout=timeout, text=True, stderr=subprocess.STDOUT)
        return output.strip(), 0
    except subprocess.CalledProcessError as e:
        return e.output or "", e.returncode
Confidence
99% confidence
Finding
`_run_ssh_command` builds a shell string with untrusted `user`, `host`, and especially `command`, then executes it with `shell=True`. This creates both local shell-injection risk on the machine running the skill and remote command-injection risk through unsafe quoting, allowing an attacker controlling service configuration to execute arbitrary commands.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if host and ssh_user:
            output, code = _run_ssh_command(host, ssh_user, cmd)
        else:
            output = subprocess.check_output(cmd, shell=True, timeout=10, text=True).strip()
            code = 0

        if code == 0 and output in ["running", "paused"]:
Confidence
99% confidence
Finding
`check_docker_container` interpolates `container_name` into a shell command and executes it with `shell=True`. A malicious container name such as one containing shell metacharacters could break out of the intended command and run arbitrary commands on the local host, which is severe in an infrastructure-monitoring skill.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
output, code = _run_ssh_command(host, ssh_user, cmd)
            is_active = code == 0
        else:
            output = subprocess.check_output(cmd, shell=True, timeout=5, text=True).strip()
            is_active = True

        if is_active:
Confidence
99% confidence
Finding
`check_systemd_service` constructs `systemctl is-active {service_name}` and runs it with `shell=True`, so an attacker controlling `service_name` can inject additional shell commands. Because this skill is designed to run on servers and production infrastructure, exploitation could lead to arbitrary local command execution with the privileges of the monitoring process.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if host and ssh_user:
            output, code = _run_ssh_command(host, ssh_user, cmd)
        else:
            output = subprocess.check_output(cmd, shell=True, timeout=10, text=True).strip()
            code = 0

        if code != 0 or not output:
Confidence
99% confidence
Finding
`check_disk` embeds the configured `path` into `df {path} | tail -1` and runs it with `shell=True`, enabling command injection through the path value. In a monitoring system that may accept service definitions from users or automation, this can be abused to execute arbitrary commands on the monitoring host.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill documentation exposes capabilities to access environment variables, make network connections, and execute shell commands, but it does not declare permissions correspondingly. That creates a transparency and governance gap: an agent or user may invoke a skill with materially broader power than expected, increasing the chance of unintended command execution, data access, or outbound connections.

Tp4

High
Category
MCP Tool Poisoning
Confidence
87% confidence
Finding
The documented purpose centers on health monitoring, but the skill also includes setup automation and periodic execution installation behavior, which are operationally more invasive than simple checks. Behavior that installs executables or systemd timers can persist on the host and materially changes system state, so under-disclosure can mislead users about the real risk surface.

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The documentation states that no data is sent externally while also advertising Telegram notifications, which necessarily transmit monitoring data to a third-party service. This is a misleading data-handling claim that can cause users to expose infrastructure names, status, and incident details without informed consent.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill exposes arbitrary SSH command execution as a first-class feature of a health-check tool. That exceeds the minimally necessary scope for health monitoring and materially increases the blast radius: anyone who can define or influence checks can run arbitrary remote commands on monitored hosts.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README encourages configuring Telegram notifications but does not clearly disclose that operational status, alerts, and dashboard content will be transmitted to a third-party messaging platform. This can lead users to unknowingly expose internal infrastructure metadata, hostnames, incident details, or service health information outside their environment, which is a meaningful information disclosure risk in a monitoring tool.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill description highlights SSH-based remote checks and Telegram alerts without prominently warning that it will connect to external systems and may transmit service metadata. In a monitoring skill, these actions are contextually expected, but insufficient disclosure still increases the risk of users authorizing sensitive network activity without understanding scope or data flow.

Missing User Warnings

High
Confidence
98% confidence
Finding
The config command prints the Telegram bot token value from the process environment, even if truncated. Exposing secret material to terminal output, logs, shell history captures, or session recordings can leak credentials that enable unauthorized sending or abuse of the Telegram bot.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
os.environ["HEALTHCHECK_TELEGRAM_CHAT"] = args.set_chat
        print("Telegram chat ID set")

    print(f"Token: {os.environ.get('HEALTHCHECK_TELEGRAM_TOKEN', '(not set)')[:20]}...")
    print(f"Chat: {os.environ.get('HEALTHCHECK_TELEGRAM_CHAT', '(not set)')}")
    print(FOOTER)
    return 0
Confidence
99% confidence
Finding
Reading HEALTHCHECK_TELEGRAM_TOKEN from the environment and printing even a partial token discloses credential material. In the context of a monitoring tool that integrates with Telegram, this can expose a bot token to anyone with terminal, log, CI, or support-bundle access, enabling unauthorized bot use.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
- `ssl_cert`: SSL certificate expiry check
- `docker`: Docker container status (requires docker CLI or SSH)
- `systemd`: Systemd service status (requires systemctl or SSH)
- `ssh_cmd`: Run arbitrary command via SSH
- `ping`: ICMP ping check
- `disk`: Disk usage check
Confidence
97% confidence
Finding
The `ssh_cmd` feature explicitly supports running arbitrary commands over SSH, which is effectively unrestricted remote code execution on configured hosts. In a monitoring context this is especially dangerous because a health-check skill appears low-risk, yet a crafted or mistaken command could read secrets, alter services, delete data, or establish persistence on remote infrastructure.

Static analysis

No suspicious patterns detected.