ClawHub
Back to skill

Security audit

Helm Chart Management

Security checks for vulnerabilities and agentic risk

Overview

This Helm management skill needs review because its troubleshooting steps can remove running applications without clearly requiring your approval.

Use limited cluster permissions and confirm the cluster, namespace, and release before changes. Require your approval before uninstalling, deleting, or force-replacing resources, especially during troubleshooting, and review backups and storage retention first. Install Helm from a verified release or inspect its installer before execution.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (6)

Failed-installation troubleshooting instructs release removal without warning about its destructive effects.

High
Category
Output Handling
Confidence
97% confidence
Finding

The failed-installation workflow proceeds from diagnostic queries directly to uninstalling the release without a decision gate or warning. An agent following it could delete release-managed resources, disrupt services, and potentially lose data depending on resource retention settings; a failed installation does not establish that removal is safe.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Piping the network response directly into bash immediately turns downloaded content into executable instructions without an inspection or verification step. This is the same underlying remote-code-execution exposure as SC2, not evidence of a separate malicious chaining attack.

Content

Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.

  • Helm CLI: Required for all Helm operations
    bash
    curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

Related Skills

Destructive troubleshooting steps lack warnings about service disruption and possible data loss.

High
Category
Output Handling
Confidence
98% confidence
Finding

The guide presents uninstalling and reinstalling an existing release as the default resolution for a name collision, even though the existing release may be healthy. In an operational Helm skill, an agent following this advice could remove live workloads, cause service disruption, and potentially lose data depending on chart resources, hooks, and storage retention policies, without first obtaining approval or checking recovery options.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/CHART-STRUCTURE.md (reported line 23)May include surrounding context.

md
│   ├── service.yaml
│   ├── ingress.yaml
│   ├── configmap.yaml
│   ├── secret.yaml
│   ├── serviceaccount.yaml
│   ├── hpa.yaml
│   └── tests/          # Helm test hooks

Activation keywords include common terms without requiring Helm or Kubernetes context.

Medium
Category
Trigger Abuse
Confidence
98% confidence
Finding

The activation conditions include standalone words such as "chart", "release", "values", "package", and "template", which frequently occur outside Helm workflows. Although the description identifies Helm as the domain, these explicit triggers do not require that context or provide exclusions.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The prerequisite command executes a remotely fetched installer from a mutable main-branch URL without pinning or independent integrity verification. Although the URL belongs to the official Helm repository, compromised upstream content could execute with the invoking user's privileges and potentially access local Kubernetes credentials.

Content

Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.

  • Helm CLI: Required for all Helm operations
    bash
    curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

Related Skills

Static analysis

No suspicious patterns detected.