ClawHub
Back to skill

Security audit

opensearch-vector-search

Security checks across malware telemetry and agentic risk

Overview

This OpenSearch skill is mostly a disclosed knowledge and diagnostic tool, with clear limits around credentials, read-only analysis, and benchmark commands.

Before installing, be aware that the cluster analyzer uses OpenSearch credentials and prints cluster/index metadata, so use least-privilege read-only credentials where possible. Run benchmarks only against disposable or dedicated benchmark clusters. Do not copy the 0.0.0.0 OpenSearch network examples into production unless the service is restricted to trusted private networks with strong authentication, TLS, and firewall or security-group controls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"--on-disk",
            )
        )
        result = subprocess.run(
            ["bash", "-n", "-c", plan.command],
            check=False,
            capture_output=True,
Confidence
82% confidence
Finding
The test invokes 'bash -c' on plan.command, which causes the generated command string to be parsed by a shell. If any portion of plan.command can be influenced by untrusted input such as CLI-derived fields embedded without robust shell escaping, this creates a command-injection path even though the test currently uses hardcoded values and only performs 'bash -n' syntax checking.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The guidance explicitly sets `network.host: 0.0.0.0`, which binds OpenSearch to all interfaces and can unintentionally expose the service beyond an intended private boundary if copied verbatim. In a cluster-tuning knowledge base, users may apply snippets directly to production systems, and the lack of a warning about restricting access via VPCs, firewalls, or private interfaces increases the chance of accidental exposure.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The production example labels an all-interface bind as suitable for production, which may normalize unsafe deployment patterns and lead operators to expose OpenSearch HTTP and transport ports to untrusted networks. Even with SSL enabled later in the example, broad network exposure materially enlarges the attack surface and can enable unauthorized access, reconnaissance, or abuse if other controls are misconfigured.

Unvalidated Output Injection

High
Category
Output Handling
Content
"--on-disk",
            )
        )
        result = subprocess.run(
            ["bash", "-n", "-c", plan.command],
            check=False,
            capture_output=True,
Confidence
86% confidence
Finding
Passing plan.command into 'bash -c' is an output-injection sink because a generated string is handed to a shell for interpretation. In this repository's skill context, the generator may eventually incorporate hostnames, labels, regions, or other user-supplied benchmark parameters, so unsafe interpolation would let crafted values alter the shell command during test execution or normalize a dangerous pattern in production code.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/test_generate_benchmark_plan.py:24