ClawHub
Back to skill

Security audit

HPC Agent Kit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a powerful but coherent HPC workflow kit that discloses its SSH, Slurm, tmux, install, and backup behavior.

Install only if you want an agent to manage an authorized HPC workflow. Review the private profile, transport exec_argv, SSH holder/control-socket setup, archive paths, and GPU/account/QoS settings before applying a bundle. Do not place credentials in profiles, and treat the persistent SSH master and autosave processes as privileged session state.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (43)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description focuses on operating or recovering a Slurm-based GPU workspace in an HPC environment. However, the supplied code does not interact with Slurm, GPUs, tmux, storage, backups, or workspace orchestration. Its sole purpose is local package verification against a manifest. That is a materially different primary purpose rather than a minor supporting detail for the declared behavior, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/common/allocation.py (reported line 176)May include surrounding context.

python
# Keep the sole allocation window reusable after Slurm releases it.
        for key in ('HPC_ALLOCATION_REQUEST_ID', 'HPC_ALLOCATION_COMMENT', 'HPC_CORE_JOB_NAME'):
            os.environ.pop(key, None)
        os.execv('/bin/bash', ['/bin/bash', '--noprofile', '--norc'])
    return rc

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common/install-release.py (reported line 135)May include surrounding context.

python
target_for(home, site, name)
        if hashlib.sha256(data).hexdigest() != payload['hashes'][name]: raise RuntimeError('Hash mismatch: ' + name)
        temporary = stage / name; temporary.parent.mkdir(parents=True, exist_ok=True); temporary.write_bytes(data)
        if data.startswith(b'#!/usr/bin/env bash') or name.endswith(('.env', '.sh')):
            subprocess.check_call(['bash', '-n', str(temporary)])
        elif data.startswith(b'#!/usr/bin/env python3'): ast.parse(data.decode())
    files[manifest_name] = manifest_bytes

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/common/snapshot-generation.sh (reported line 120)May include surrounding context.

sh
# Large packs share inodes, but the tar baseline must be independently mutable.
    cp -al "$source/full.tar.zst" "$destination/full.tar.zst"
    cp -al "$source/full.tar.zst.inc" "$destination/full.tar.zst.inc"
    rm -f "$destination/full.tar.zst.inc/snapshot.snar"
    cp "$source/full.tar.zst.inc/snapshot.snar" "$destination/full.tar.zst.inc/snapshot.snar"
}

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/common/tests/benchmark_snapshot.py (reported line 35)May include surrounding context.

python
helper = root / 'msi-local-snapshot'
        helper.write_text(renderer.render(profile('msi'))['bin/msi-local-snapshot']); helper.chmod(0o700)
        archive = root / 'persistent/work.tar.zst'
        env = dict(os.environ, fixture=str(root), SLURM_JOB_ID='900001', MSI_LOCAL_SNAPSHOT_MAX_INCREMENTAL_RATIO='0')
        code = 'source <(sed \'$d\' "$1"); shift; local_base() { echo "$fixture/base"; }; main "$@"'
        timings = {}
        def run(operation):

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill clearly instructs the agent to use shell, network, file read/write, and environment access, but it does not declare any explicit tool scope or allowed-tools boundary. In an agentic setting, missing scope controls increases the chance of overbroad execution, misuse of privileged tools, or unintended operations against HPC systems and local/private data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

The document intentionally establishes a long-lived authenticated SSH control connection on an always-on host and notes that access to the control socket grants use of the authenticated connection. Even with mode 700 directories, this creates session persistence that can be abused by any compromise of the holder account/host, extending the lifetime and reach of a prior MFA-authenticated session.

Content

Scanner excerpt · references/msi-persistent-ssh.md (reported line 55)May include surrounding context.

desktop commands. Substitute the uppercase placeholders in private files. Merge with an existing supported installation; do not replace a healthy holder.

Create owner-only directories:

bash
install -d -m 700 "$HOME/.config/hpc-agent-kit" "$HOME/.ssh/msi-control"

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/msi-persistent-ssh.md (reported line 151)May include surrounding context.

fi printf -v command '%q ' "$@" exec ssh -F "$conf" -o BatchMode=yes -o ControlMaster=no
-o PubkeyAuthentication=no -o HostbasedAuthentication=no
-o KbdInteractiveAuthentication=no -o PasswordAuthentication=no
-o GSSAPIAuthentication=no msi-held "$command"

text

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/msi-persistent-ssh.md (reported line 152)May include surrounding context.

fi printf -v command '%q ' "$@" exec ssh -F "$conf" -o BatchMode=yes -o ControlMaster=no
-o PubkeyAuthentication=no -o HostbasedAuthentication=no
-o KbdInteractiveAuthentication=no -o PasswordAuthentication=no
-o GSSAPIAuthentication=no msi-held "$command"

text

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/msi-persistent-ssh.md (reported line 153)May include surrounding context.

fi printf -v command '%q ' "$@" exec ssh -F "$conf" -o BatchMode=yes -o ControlMaster=no
-o PubkeyAuthentication=no -o HostbasedAuthentication=no
-o KbdInteractiveAuthentication=no -o PasswordAuthentication=no
-o GSSAPIAuthentication=no msi-held "$command"

text

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/msi-persistent-ssh.md (reported line 190)May include surrounding context.

md
| --- | --- |
| Desktop disconnected; holder master healthy | Reconnect to the holder and reuse the master; inspect queue and routes. |
| Master absent or broken | Ordinary calls return failure. Inspect the transport pane; explicit login may create one new attempt. |
| Authentication pending or timed out | Complete the pending attempt or report its timeout; do not automatically send another Push. |
| Holder restarted or MSI closed the connection | Reauthenticate explicitly, then inspect the existing jobs and tmux hierarchy. |
| Multiplexed channel refused or commands saturate the connection | Bound Agent concurrency and close completed client channels. Record the site's actual channel limits; never fall back to a fresh authenticated connection. |
| SSH recovered, but an allocation holder or compute route is missing | Reconcile the durable request ID with Slurm and the existing tmux state before any replacement allocation. |

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring states the script is read-only, but doctor mode performs active local and remote operations including ssh, tmux probing, and execution of site health-check binaries. This mismatch is dangerous because operators or higher-level agents may grant the script more trust than warranted, leading to unexpected command execution in an HPC environment where remote access and allocation management are sensitive.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/common/agent-state.py (reported line 20)May include surrounding context.

python
def capture(argv, timeout=30):
    try:
        return subprocess.check_output(argv, stderr=subprocess.STDOUT,
                                       universal_newlines=True, timeout=timeout).strip(), None
    except (OSError, subprocess.CalledProcessError, subprocess.TimeoutExpired) as error:
        return None, str(error)

Tainted flow: 'argv' from os.environ.get (line 97, credential/environment) → subprocess.check_output (code execution)

Medium
Category
Data Flow
Confidence
86% confidence
Finding

In doctor mode, the script builds argv using environment-derived paths such as HPC_CORE_BIN and then executes the resulting binary via subprocess.check_output. If an attacker can influence the environment for this script, they can redirect execution to a malicious local program while the tool is performing trusted health checks, causing arbitrary code execution in the script's security context.

Content

Scanner excerpt · scripts/common/agent-state.py (reported line 20)May include surrounding context.

python
def capture(argv, timeout=30):
    try:
        return subprocess.check_output(argv, stderr=subprocess.STDOUT,
                                       universal_newlines=True, timeout=timeout).strip(), None
    except (OSError, subprocess.CalledProcessError, subprocess.TimeoutExpired) as error:
        return None, str(error)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/common/allocation.py (reported line 39)May include surrounding context.

python
def command(argv):
    return subprocess.check_output(argv, stderr=subprocess.STDOUT,
                                   universal_newlines=True, timeout=30).strip()

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/common/allocation.py (reported line 124)May include surrounding context.

python
'#{pane_current_command}|#{pane_pid}']).split('|')
    if pane[0] != 'bash':
        raise RuntimeError('Allocation pane is busy: ' + pane[0])
    children = subprocess.run(['pgrep', '-P', pane[1]], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    if children.returncode == 0:
        raise RuntimeError('Allocation pane has running children')
    if children.returncode != 1:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
88% confidence
Finding

Although subprocess.check_call is used safely with an argument list, the code constructs a shell command string and injects it into a live tmux pane for later execution. This creates an indirect command-execution sink: untrusted args.command, args.socket, or args.target can cause attacker-controlled commands to be typed into an interactive shell, and the safety depends on tmux target integrity rather than process-level exec guarantees. In an HPC workflow skill that intentionally operates remote shells and Slurm allocations, this context makes the issue more dangerous because the code is explicitly designed to dispatch privileged or resource-consuming jobs into persistent sessions.

Content

Scanner excerpt · scripts/common/allocation.py (reported line 138)May include surrounding context.

python
'HPC_CORE_JOB_NAME=' + name, 'HPC_ALLOCATION_COMMENT=' + comment]
    holder = str(Path(__file__).resolve())
    shell = 'exec ' + ' '.join(shlex.quote(x) for x in env + [holder, 'hold', args.request, '--'] + args.command)
    subprocess.check_call(['tmux', '-L', args.socket, 'send-keys', '-t', args.target, '-l', '--', shell])
    subprocess.check_call(['tmux', '-L', args.socket, 'send-keys', '-t', args.target, 'Enter'])
    record.update(phase='dispatched', observed_at=now())
    atomic(path, record)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/common/allocation.py (reported line 139)May include surrounding context.

python
holder = str(Path(__file__).resolve())
    shell = 'exec ' + ' '.join(shlex.quote(x) for x in env + [holder, 'hold', args.request, '--'] + args.command)
    subprocess.check_call(['tmux', '-L', args.socket, 'send-keys', '-t', args.target, '-l', '--', shell])
    subprocess.check_call(['tmux', '-L', args.socket, 'send-keys', '-t', args.target, 'Enter'])
    record.update(phase='dispatched', observed_at=now())
    atomic(path, record)
    return record

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/common/deploy_bundle.py (reported line 46)May include surrounding context.

python
return
    encoded = base64.b64encode(json.dumps(payload).encode()).decode()
    script = "python3 - <<'HPC_INSTALL_PY'\nPAYLOAD = " + repr(encoded) + '\n' + REMOTE + '\nHPC_INSTALL_PY\n'
    subprocess.run(profile['transport']['exec_argv'], input=script.encode(), check=True)


if __name__ == '__main__':

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/common/health.py (reported line 85)May include surrounding context.

python
result['healthy'] = result['healthy'] and result['compute_storage']['writable']
        if args.verify:
            helper = str(Path(os.environ.get('HPC_CORE_BIN', str(Path.home() / '.local/bin'))) / (SITE + '-local-snapshot'))
            process = subprocess.Popen([helper, 'verify', archive], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, universal_newlines=True, start_new_session=True)
            try:
                output, _ = process.communicate(timeout=int(os.environ.get('HPC_HEALTH_VERIFY_SECONDS', '300')))
                result['integrity'] = 'verified' if process.returncode == 0 and 'SNAPSHOT_VERIFIED' in output else 'failed'

Tainted flow: 'helper' from os.environ.get (line 84, credential/environment) → subprocess.Popen (code execution)

Medium
Category
Data Flow
Confidence
93% confidence
Finding

The helper executable path is derived from the HPC_CORE_BIN environment variable and then executed without validation. In an agent-operated HPC workflow, an attacker who can influence the environment could redirect verification to a malicious binary, leading to arbitrary code execution in the context of the running job and potentially access to job data, credentials, or shared storage.

Content

Scanner excerpt · scripts/common/health.py (reported line 85)May include surrounding context.

python
result['healthy'] = result['healthy'] and result['compute_storage']['writable']
        if args.verify:
            helper = str(Path(os.environ.get('HPC_CORE_BIN', str(Path.home() / '.local/bin'))) / (SITE + '-local-snapshot'))
            process = subprocess.Popen([helper, 'verify', archive], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, universal_newlines=True, start_new_session=True)
            try:
                output, _ = process.communicate(timeout=int(os.environ.get('HPC_HEALTH_VERIFY_SECONDS', '300')))
                result['integrity'] = 'verified' if process.returncode == 0 and 'SNAPSHOT_VERIFIED' in output else 'failed'

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/common/install-release.py (reported line 46)May include surrounding context.

python
def quiescent(home, site):
    queue = subprocess.check_output(['squeue', '-h', '-u', os.environ['USER'], '-o', '%i|%T'],
                                    universal_newlines=True, timeout=30).strip()
    if queue: raise RuntimeError('Live jobs exist; deployment refused: ' + queue)
    for path in (home / ('.local/state/' + site + '-gpu/allocations')).glob('*.json'):

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/common/install-release.py (reported line 57)May include surrounding context.

python
continue
        if record.get('phase') == 'terminal': continue
        if not record.get('job_id'): raise RuntimeError('Unresolved allocation request: ' + str(path))
        rows = subprocess.check_output(['sacct', '-nXP', '-j', record['job_id'], '-o', 'JobID,State'],
                                       universal_newlines=True, timeout=30)
        terminal = next((r.split('|')[1].split()[0] for r in rows.splitlines()
                         if r.split('|')[0] == record['job_id']), 'UNKNOWN')

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
90% confidence
Finding

This code launches bash -c and sources a user-controlled gpu.env file to extract an archive path. Sourcing a shell file executes arbitrary shell code in the installer's security context, so a malicious or tampered config file can run commands during installation; in an HPC workflow skill, that is especially dangerous because the installer is explicitly meant to operate on live user workspaces and credentials.

Content

Scanner excerpt · scripts/common/install-release.py (reported line 106)May include surrounding context.

python
config = home / ('.config/' + site + '-gpu/gpu.env')
        variable = site.upper().replace('-', '_') + '_LOCAL_SNAPSHOT_ARCHIVE'
        command = 'set -e; [[ ! -f "$1" ]] || source "$1"; printf "%s" "${' + variable + ':-${HPC_ARCHIVE:-}}"'
        archive = subprocess.check_output(['bash', '-c', command, 'probe', str(config)],
                                         universal_newlines=True, timeout=30).strip()
    if not archive:
        archive = str(home / (('project/local-workspaces/local-' + os.environ['USER'] + '.tar.zst')

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/common/install-release.py (reported line 136)May include surrounding context.

python
if hashlib.sha256(data).hexdigest() != payload['hashes'][name]: raise RuntimeError('Hash mismatch: ' + name)
        temporary = stage / name; temporary.parent.mkdir(parents=True, exist_ok=True); temporary.write_bytes(data)
        if data.startswith(b'#!/usr/bin/env bash') or name.endswith(('.env', '.sh')):
            subprocess.check_call(['bash', '-n', str(temporary)])
        elif data.startswith(b'#!/usr/bin/env python3'): ast.parse(data.decode())
    files[manifest_name] = manifest_bytes
    backup = home / ('.local/state/hpc-core-backups/' + datetime.datetime.now(datetime.timezone.utc).strftime('%Y%m%dT%H%M%S%fZ') + '-' + site)

Static analysis

No suspicious patterns detected.