ClawHub
Back to skill

Security audit

rocketmq-kubectl

Security checks for vulnerabilities and agentic risk

Overview

This RocketMQ admin skill is mostly transparent, but it includes powerful production-style commands that can delete topics, skip queued messages, write test messages, and read pod files without enough safeguards.

Install only if you expect the agent to perform RocketMQ administration through Kubernetes. Treat delete-topic, reset-offset, send-message, and direct file-read commands as sensitive operations requiring explicit human approval, verified non-production or approved targets, and strict validation of message IDs before use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:185
Finding

Path Traversal Through an Unvalidated Message ID

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 185
Vulnerability Type: Path traversal caused by unsafe path construction
Risk Level: High

Vulnerable Code

bash
kubectl -n kube-system exec -it rocketmq-master1.teambition.local -- cat /tmp/rocketmq/msgbodys/<message-id>

Technical Analysis

The Skill instructs the agent to append a user-supplied message-id directly to a filesystem path inside the RocketMQ pod. It does not define validation, canonicalization, or containment checks for that value.

The -- separator prevents kubectl from interpreting subsequent arguments as its own options, but it does not prevent filesystem traversal. If the supplied value includes ../ components, cat resolves them inside the target container and may access a file outside /tmp/rocketmq/msgbodys/.

For example, substituting ../../../etc/passwd produces a path that escapes the intended message-body directory. Exploitability depends on whether the agent executes the documented command with an attacker-controlled value and whether the pod user can read the targeted file.

Attack Path

  1. An attacker asks the agent to read a message body and supplies a crafted message ID containing traversal components, such as ../../../etc/passwd.
  2. The agent substitutes the value into the documented command without validation.
  3. kubectl exec invokes cat in the RocketMQ master pod.
  4. The container filesystem resolves the traversal components outside /tmp/rocketmq/msgbodys/.
  5. The contents of the targeted file are returned through the command output.

Impact Assessment

A successful exploit can disclose arbitrary files readable by the RocketMQ pod's effective user. Potentially exposed data may include application configuration, environment-related files, credentials, tokens, or Kubernetes service-account material if such files exist and are readable.

The issue provides file-read access within the target pod's existing permi ...[truncated 162 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not construct filesystem paths directly from untrusted message identifiers.
  • Validate message IDs with a strict allowlist matching the exact RocketMQ identifier format. If hexadecimal IDs are expected, permit only the required number of hexadecimal characters.
  • Explicitly reject path separators, traversal sequences, whitespace, control characters, leading hyphens, and unexpected punctuation.
  • Use a trusted helper that canonicalizes the requested path and verifies that the result remains beneath /tmp/rocketmq/msgbodys/.
  • Pass the validated value as a distinct argument and use cat -- "$validated_path" to prevent option interpretation.
  • Run the operation under a minimally privileged pod user that cannot read secrets or unrelated system files.
  • Require the agent to reject invalid identifiers rather than attempting to sanitize malformed input.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documented resetOffsetByTime ... -s -1 command discards consumer backlog by advancing offsets to the latest position, which can permanently skip unprocessed messages. Because the skill frames this as a way to 'clear all accumulated messages' without a strong safety warning, an agent or operator could cause irreversible message loss in production systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill includes a topic deletion command with no warning, confirmation step, or guidance about production impact. In an agent context, presenting destructive commands as routine examples increases the chance of accidental deletion of live messaging topics, causing data loss and service disruption.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents using kubectl exec to run cat against a filesystem path inside the RocketMQ pod, which expands the capability from RocketMQ administration to direct pod file access. Even if the example targets a RocketMQ message-body cache path, it normalizes arbitrary in-container file reading and can expose sensitive data or operational secrets if an agent generalizes this pattern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill documents sending test messages directly into RocketMQ without warning that this writes data into potentially production topics and may trigger downstream consumers. In operational environments, even 'test' payloads can activate business workflows, pollute analytics, or cause side effects across integrated systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.