ClawHub
Back to skill

Security audit

vCluster (vind) Management

Security checks for vulnerabilities and agentic risk

Overview

This cluster-management skill needs review because its troubleshooting and production workflows include destructive actions without clear target checks or user approval.

Use credentials restricted to dedicated development namespaces and keep returned kubeconfigs private. Require approval before deletion or production changes, verify the host context and namespace contents, and preserve needed data. Validate replacement services and traffic cutover before removing old clusters. Pin and verify the CLI download.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

  • vCluster CLI: Required for all vind tools
    bash
    curl -L -o vcluster "https://github.com/loft-sh/vcluster/releases/latest/download/vcluster-$(uname -s | tr '[:upper:]' '[:lower:]')-$(uname -m)"
chmod +x vcluster && sudo mv vcluster /usr/local/bin/

Check Installation

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

vind_status(name="my-vcluster", namespace="vcluster")

text

## Get Kubeconfig

```python
vind_get_kubeconfig(name="my-vcluster", namespace="vcluster")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

Get Kubeconfig

python
vind_get_kubeconfig(name="my-vcluster", namespace="vcluster")

Status

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.

text
1. vind_disconnect()
2. vind_connect(name="my-cluster")
3. vind_get_kubeconfig(name="my-cluster")

Resource Issues

The resource-troubleshooting workflow instructs namespace deletion without warning about data loss.

High
Category
Output Handling
Confidence
99% confidence
Finding

The resource-troubleshooting workflow recommends deleting a cluster with delete_namespace=True without verifying the target, checking namespace contents, or obtaining explicit approval. If followed against a shared or incorrectly selected namespace, this can delete unrelated workloads and potentially persistent data, depending on storage reclaim policies.

Content

No source excerpt is available for this finding.

Destructive cleanup workflows delete clusters and namespaces without warning about workload or data loss.

High
Category
Output Handling
Confidence
98% confidence
Finding

The workflow invokes cluster deletion with delete_namespace=True without warning that deleting the namespace also removes its resources and may cause data loss. The same undisclosed destructive cleanup appears at L106 and L120–L124, while L153 deletes the old production cluster without a warning about service interruption or loss.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/WORKFLOWS.md (reported line 118)May include surrounding context.

md
namespace=f"pr-{pr_number}",
        connect=True
    )
    return vind_get_kubeconfig(name=f"pr-{pr_number}")

def cleanup_preview(pr_number):
    vind_delete_cluster(

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/WORKFLOWS.md (reported line 177)May include surrounding context.

vind_connect(name="my-cluster")

kubeconfig = vind_get_kubeconfig(name="my-cluster")

text

### Describe for Details

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/WORKFLOWS.md (reported line 177)May include surrounding context.

vind_connect(name="my-cluster")

kubeconfig = vind_get_kubeconfig(name="my-cluster")

text

### Describe for Details

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

  • vCluster CLI: Required for all vind tools
    bash
    curl -L -o vcluster "https://github.com/loft-sh/vcluster/releases/latest/download/vcluster-$(uname -s | tr '[:upper:]' '[:lower:]')-$(uname -m)"
chmod +x vcluster && sudo mv vcluster /usr/local/bin/

Check Installation

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

bash
curl -L -o vcluster "https://github.com/loft-sh/vcluster/releases/latest/download/vcluster-$(uname -s | tr '[:upper:]' '[:lower:]')-$(uname -m)"
chmod +x vcluster
sudo mv vcluster /usr/local/bin/

vcluster version

The production upgrade workflow omits a warning about availability and compatibility risks.

Medium
Category
Output Handling
Confidence
92% confidence
Finding

The rolling-upgrade workflow instructs an upgrade of prod-vcluster to a specified Kubernetes version without disclosing potential service disruption or workload compatibility impacts. The surrounding status checks do not provide a user warning about those production changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.