ClawHub
Back to skill

Security audit

Slv Rpc

Security checks for vulnerabilities and agentic risk

Overview

This skill is for legitimate Solana RPC node operations, but it directs agents to run high-impact Ansible playbooks from a mutable local template directory outside the reviewed package.

Install only if you understand that this skill can guide an agent to make real infrastructure changes. Before running any playbook, verify the exact ~/.slv/template version, source, ownership, and contents; prefer pinned or checksummed playbooks, run Ansible check mode first, and manually review any disk formatting, ledger cleanup, sudo package installation, or curl-to-shell installer steps.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Warning
Location
scripts/setup.sh:87
Finding

Unverified Remote Installer Piped Directly to a Shell

Content
View full analysis
/dev/null; then info "solana-cli found ($(solana-keygen --version 2>/dev/null | head -1))" else warn "solana-cli not found (optional — only needed for local key generation)" echo " → Install: sh -c \"\$(curl -sSfL https://release.anza.xyz/stable/install)\"" fi ``` ### Technical Analysis The setup script recommends downloading the response from a mutable `stable` URL and passing it directly to `sh`. The retrieved content is not pinned to a reviewed release and is not authenticated with a publisher signature or expected checksum. The command is printed rather than executed automatically, so exploitation requires the user to follow the displayed installation instruction. Nevertheless, it forms part of the Skill's intended setup flow and creates a remote code-execution channel whose effective payload can change after the Skill has been audited. TLS protects transport under normal circumstances but does not protect against compromise of the distribution service, its deployment pipeline, DNS or certificate trust infrastructure, or the upstream publisher account. ### Attack Path 1. The user runs `scripts/setup.sh` on a system without `solana-keygen`. 2. The script displays the `curl | sh` installation command as its recommended remediation. 3. The remote `stable/install` endpoint or its delivery infrastructure is compromised, or begins serving an unsafe installer. 4. The user copies and executes the displayed command. 5. The remote response is interpreted immediately by the local shell without review or integrity validation. 6. The payload executes with all permissions held by that user. ### Impact Assessment Successful exploitation permits arbitrary command execution under the invoking user's account. The payload could access user ...[truncated 396 chars]
Remediation
View remediation
" echo " installer.sh" | sha256sum --check - less installer.sh sh installer.sh ``` The checksum must be updated through a controlled review process rather than retrieved from the same mutable endpoint as the installer. ]]>

T07 · Tool Hijacking and Spoofing

Error
Location
AGENT.md:175
Finding

Agent Executes Mutable Playbooks Outside the Audited Skill Package

Content
View full analysis
``` Do NOT use the skill's own `ansible/` directory for execution. Those files are reference copies. The runtime playbooks live in `~/.slv/template/`. ``` ### Technical Analysis The Agent is instructed to execute playbooks from whichever directory under `~/.slv/template/` sorts as the latest version. The selected directory is not pinned to a reviewed version, and the workflow does not validate its ownership, permissions, checksum, signed manifest, or provenance. The executable playbooks are not included in the audited project. As a result, the security-sensitive behavior ultimately performed by Ansible cannot be established from this package. Selecting executable content solely by its directory name also creates a tool-spoofing opportunity: a malicious or compromised process able to write to that location can create a higher-version directory containing attacker-controlled playbooks. The instruction explicitly prohibits using the package's reference playbooks and redirects execution to this mutable external location, widening the trust boundary beyond the reviewed Skill. ### Attack Path 1. An attacker, compromised updater, or malicious local process obtains write access to `~/.slv/template/`, or compromises the mechanism that populates it. 2. The attacker creates a directory with a version name that sorts after legitimate versions, such as `~/.slv/template ...[truncated 1326 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/setup.sh:33
Finding

Unpinned Installation of Ansible from the Active Python Package Index

Content
View full analysis
/dev/null; then pip3 install --user ansible-core elif command -v pip &>/dev/null; then pip install --user ansible-core ``` ### Technical Analysis The setup script installs `ansible-core` without an exact version constraint, lock file, expected package hashes, isolated environment, or explicit trusted index. The actual version and dependency graph therefore depend on the package index and resolver state at installation time. The project documentation states a requirement of Ansible 2.15 or later, but the setup path neither pins a reviewed compatible release nor verifies the installed version after installation. It also inherits any user-level pip configuration, including alternate indexes and extra indexes. A compromised or incorrectly configured index could therefore supply unexpected package content. Although `ansible-core` is named correctly and there is no evidence of deliberate typosquatting, installing mutable dependency versions without integrity constraints exposes the setup process to upstream and package-index supply-chain compromise. ### Attack Path 1. The user runs `scripts/setup.sh` without `ansible-playbook` already installed. 2. The script discovers `pip3` or `pip`. 3. The active pip configuration points to a compromised, malicious, or otherwise untrusted package source, or the legitimate upstream release chain is compromised. 4. Pip resolves an unreviewed `ansible-core` release and its transitive dependencies. 5. Malicious installation/build behavior executes where applicable, or compromised Ansible code is installed into the user's environment. 6. The installed tooling is later trusted to process inventories and execute privileged deployment playbooks. ### Impact Assessment A compromised package or dependency could execute cod ...[truncated 519 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · AGENT.md (reported line 93)May include surrounding context.

md
rpc-1:
      ansible_host: "<server-ip>"
      ansible_user: "solv"
      ansible_ssh_private_key_file: "~/.ssh/id_rsa"

  vars:
    # --- RPC Type ---

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · examples/inventory.yml (reported line 15)May include surrounding context.

yaml
rpc-1:
      ansible_host: "<server-ip>"
      ansible_user: "solv"
      ansible_ssh_private_key_file: "~/.ssh/id_rsa"

  vars:
    # --- RPC Type ---

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 66)May include surrounding context.

sh
rpc-1:
      ansible_host: "<server-ip>"
      ansible_user: "solv"
      ansible_ssh_private_key_file: "~/.ssh/id_rsa"

  vars:
    # --- RPC Type ---

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/setup.sh (reported line 43)May include surrounding context.

sh
brew install ansible
  elif [[ "$OS" == "linux" ]]; then
    if command -v apt-get &>/dev/null; then
      sudo apt-get update && sudo apt-get install -y ansible-core
    elif command -v dnf &>/dev/null; then
      sudo dnf install -y ansible-core
    else

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 68)May include surrounding context.

sh
warn "SSH agent running but no keys loaded"
    echo "  → Run: ssh-add ~/.ssh/id_rsa (or your key path)"
  fi
elif [[ -f "$HOME/.ssh/id_rsa" ]] || [[ -f "$HOME/.ssh/id_ed25519" ]]; then
  info "SSH keys found (agent not running — Ansible will use key files directly)"
else
  warn "No SSH keys found"

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 68)May include surrounding context.

sh
warn "SSH agent running but no keys loaded"
    echo "  → Run: ssh-add ~/.ssh/id_rsa (or your key path)"
  fi
elif [[ -f "$HOME/.ssh/id_rsa" ]] || [[ -f "$HOME/.ssh/id_ed25519" ]]; then
  info "SSH keys found (agent not running — Ansible will use key files directly)"
else
  warn "No SSH keys found"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · AGENT.md (reported line 187)May include surrounding context.

  1. Local RPC Response Check (every 30 seconds):
    bash
    curl -s http://localhost:8899 -X POST -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"getSlot"}'
    • No response → still loading ledger, retry

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · AGENT.md (reported line 200)May include surrounding context.

md
-d '{"jsonrpc":"2.0","id":1,"method":"getSlot"}' | jq -r '.result')

   # Local slot
   LOCAL_SLOT=$(curl -s http://localhost:8899 -X POST -H 'Content-Type: application/json' \
     -d '{"jsonrpc":"2.0","id":1,"method":"getSlot"}' | jq -r '.result')

   DIFF=$((NETWORK_SLOT - LOCAL_SLOT))

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documents a cleanup command that removes ledger/snapshot files but does not warn that this is destructive and can permanently delete large amounts of node state. In an infrastructure automation context, operators may run mapped commands directly from the documentation, so omission of a data-loss warning increases the chance of accidental service disruption or forced resync.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises playbooks for mounting and formatting disks without any safety warning, which is risky because formatting can irreversibly erase attached storage if the wrong device is targeted. Given this is server-deployment automation for RPC nodes, operators are likely to run these playbooks on real infrastructure, making accidental destructive execution more plausible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The setup script automatically installs software and may invoke system package managers and privileged commands, but it does not clearly warn the user up front that it will modify the local system. In an agent-skill context, users may run setup helpers with elevated trust, so implicit package installation increases the risk of unintended local changes and supply-chain exposure.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
92% confidence
Finding

The script invokes sudo to run apt-get update and install ansible-core, which causes privileged system modification. While common in installers, using sudo in a skill setup script is risky because it expands the blast radius if the script or package source is compromised and may surprise users expecting a non-privileged prerequisite check.

Content

Scanner excerpt · scripts/setup.sh (reported line 43)May include surrounding context.

sh
brew install ansible
  elif [[ "$OS" == "linux" ]]; then
    if command -v apt-get &>/dev/null; then
      sudo apt-get update && sudo apt-get install -y ansible-core
    elif command -v dnf &>/dev/null; then
      sudo dnf install -y ansible-core
    else

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
91% confidence
Finding

The script invokes sudo to install ansible-core via dnf, performing privileged package installation. In a setup script distributed as part of an agent skill, automatic root-level package management should be treated as sensitive because it modifies the host and relies on external package repositories.

Content

Scanner excerpt · scripts/setup.sh (reported line 45)May include surrounding context.

sh
if command -v apt-get &>/dev/null; then
      sudo apt-get update && sudo apt-get install -y ansible-core
    elif command -v dnf &>/dev/null; then
      sudo dnf install -y ansible-core
    else
      error "Cannot auto-install ansible-core. Please install manually: pip3 install ansible-core"
      exit 1