ClawHub
Back to skill

Security audit

Zabbix Connector

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its Zabbix monitoring purpose, but it handles an API token without enforcing HTTPS before sending requests.

Review before installing in production. Use a dedicated least-privilege Zabbix token, configure only an HTTPS Zabbix endpoint you control, avoid putting unrelated secrets in the skill .env file, and reserve acknowledgement permissions for users who need them.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/zabbix_api.py:24
Finding

Zabbix API Token May Be Transmitted Without HTTPS

Content
View full analysis

Vulnerability Details

File Location: scripts/zabbix_api.py, lines 24-25, 28-48
Vulnerability Type: Sensitive credential transmission without enforced HTTPS
Risk Level: High

Vulnerable Code

python
class ZabbixDirect:
    def __init__(self, url, token):
        self.api_url = f"{url.rstrip('/')}/api_jsonrpc.php"
        self.token = token

    def _call(self, method, params):
        payload = {
            "jsonrpc": "2.0",
            "method": method,
            "params": params,
            "auth": self.token,
            "id": 1
        }
        data = json.dumps(payload).encode('utf-8')

        # Use a clean, honest User-Agent instead of browser spoofing
        headers = {
            'Content-Type': 'application/json',
            'User-Agent': 'OpenClaw-ZabbixSkill/1.0'
        }
        req = urllib.request.Request(self.api_url, data=data, headers=headers)

        # Use the system's default SSL context, which verifies certificates.
        # This protects against Man-in-the-Middle attacks.
        context = ssl.create_default_context()

        with urllib.request.urlopen(req, context=context) as response:
            return json.loads(response.read().decode()).get("result")

Technical Analysis

The constructor accepts the user-configured URL without parsing or validating its scheme. The _call method places the Zabbix API token in the JSON-RPC request body and submits it through urllib.request.urlopen.

Creating a certificate-verifying SSL context protects HTTPS requests against untrusted certificates, but it does not require HTTPS. If ZABBIX_URL uses http://, urllib can send the request without TLS, exposing the token and API data in plaintext. Documentation recommends HTTPS, but this recommendation is not enforced by the implementation.

Redirect behavior should also be constrained. An initially secure URL must not be permitted to redirec ...[truncated 1767 chars]

Remediation
View remediation

Remediation Suggestions

  1. Parse ZABBIX_URL before retaining or using it and reject every scheme other than https.
  2. Require a nonempty hostname and reject embedded credentials, malformed URLs, and unexpected URL components.
  3. If local plaintext HTTP support is operationally necessary, limit it to explicit loopback addresses and require a clearly named opt-in setting. Do not enable it by default.
  4. Disable automatic redirects for credential-bearing requests or validate every redirect target. Reject HTTPS-to-HTTP downgrades and cross-origin redirects.
  5. Preserve system certificate and hostname verification; do not add an option that silently disables TLS validation.
  6. Use a dedicated least-privilege Zabbix token restricted to the hosts, groups, data, and actions required by this Skill.
  7. Separate read-only operations from event acknowledgement where possible, using distinct tokens so routine monitoring cannot exercise mutation privileges.
  8. Fail closed with a clear error before constructing a request when URL security requirements are not satisfied.
  9. Add automated tests confirming rejection of http://, malformed URLs, downgrade redirects, and cross-origin redirects.
  10. Rotate the Zabbix token after any suspected plaintext transmission or unauthorized configuration change.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/zabbix_api.py (reported line 7)May include surrounding context.

python
import sys
import ssl

# Resolve .env relative to this script's directory, so it works regardless
# of where the skill is cloned/installed.
SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
ENV_PATH = os.path.join(SCRIPT_DIR, '..', '.env')

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/zabbix_api.py (reported line 10)May include surrounding context.

python
# Resolve .env relative to this script's directory, so it works regardless
# of where the skill is cloned/installed.
SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
ENV_PATH = os.path.join(SCRIPT_DIR, '..', '.env')

def load_my_env():
    if os.path.exists(ENV_PATH):

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares capabilities that imply environment access, file reading, and network communication, but it does not define any explicit tool scope such as permissions or allowed-tools. In a skill that uses API credentials from a local .env file and communicates with a monitoring platform, this omission weakens least-privilege controls and can allow broader-than-necessary access if the runtime permits those capabilities by default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.