ClawHub
Back to skill

Security audit

Core Kubernetes Resources

Security checks for vulnerabilities and agentic risk

Overview

The skill provides purpose-aligned Kubernetes management guidance, with disclosed access to secrets and potentially disruptive operations.

Use credentials limited to the intended cluster and tasks. Verify the cluster context, namespace, and resource before deletion or node draining, and keep secret values out of displayed output. The separately supplied MCP server implementation is outside this artifact review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Activation criteria include generic verbs and resource words without requiring a Kubernetes-specific context.

Medium
Category
Trigger Abuse
Confidence
98% confidence
Finding

The activation rules include generic words such as "get", "create", "delete", and "secrets" without explicitly requiring Kubernetes context, allowing unrelated requests to trigger this operational skill. Its Kubernetes-specific name and description reduce ambiguity, but its deletion and node-draining examples make incorrect routing potentially consequential if the agent also fails to verify user intent before acting. Activation alone does not authorize or establish that any cluster modification will occur.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.