ClawHub
Back to skill

Security audit

Unifi

Security checks for vulnerabilities and agentic risk

Overview

This UniFi monitoring skill appears read-only and purpose-aligned, but it stores sensitive network details locally and disables TLS verification for admin login requests.

Review before installing. Use a least-privilege local UniFi account if possible, restrict the credential file permissions, avoid sharing generated outputs, and be aware that dashboard runs save internal network details to disk. The TLS behavior is the main security concern: the scripts disable certificate verification, so credentials could be exposed if the gateway connection is spoofed or intercepted.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill explicitly requires and instructs use of both shell and network capabilities, yet no corresponding permissions are declared. That creates a transparency and governance gap: a user or orchestrator may invoke a skill that can reach internal network services and run local commands without clear consent boundaries. In this context, the capability is expected for UniFi monitoring, but it still expands attack surface because the skill handles local gateway credentials and can access sensitive network telemetry.

Tp4

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding
The documented purpose presents the skill as a monitoring/query tool, but the static findings indicate it also accesses broader configuration data and writes local artifacts containing fetched UniFi data. That mismatch is dangerous because users may consent to operational status checks without realizing the skill can expose firewall rules, VLANs, SSIDs, routes, and client/network data in local files, which are all sensitive reconnaissance targets. The context increases risk because this is a network-management environment, where configuration disclosure materially aids lateral movement or follow-on attacks.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The script retrieves and displays sensitive administrative data such as port forwards, firewall rules, network configurations, WLAN settings, routes, and alarms, which goes beyond simple status monitoring and materially increases the sensitivity of the collected output. In the context of an agent skill, this broad inventory disclosure can expose internal topology and security posture to downstream logs, users, or other components without clear need-to-know boundaries.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The script persistently writes a UniFi inventory/dashboard to $HOME/clawd/memory/bank/unifi-inventory.md even though the skill description frames behavior as query/monitoring rather than storage. Persisting device, client, network, and security data creates a local data-retention surface that can later be accessed by other tools, users, or processes and may outlive the original request context.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The script creates a debug JSON dump of fetched UniFi data to dashboard_debug_dump.json without any access controls, disclosure, or cleanup. Even though the dump excludes some fetched datasets, it still contains sensitive health, device, client, network, and WLAN information that can reveal hosts, addresses, SSIDs, and topology, making accidental exposure or later compromise more damaging.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The README instructs users to place a username and password in a plaintext JSON file and also suggests exporting credentials as environment variables, but it does not clearly warn about the exposure risks. Plaintext files may be readable by other local users, copied into backups, or accidentally committed, and environment-variable usage can leak through shell history, process inspection, or logging depending on the environment.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill advertises read-only monitoring as 'safe' but does not warn that client lists, device inventory, traffic insights, and alerts can reveal sensitive personal and operational information. Read-only access is not harmless here: it can disclose who is on the network, what services are in use, and details about internal infrastructure. Because the target is a local UniFi gateway, the exposed data is especially valuable for internal reconnaissance.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script writes network-derived inventory and security-relevant information to disk with no user-facing warning, consent, or indication in the manifest. In an agent environment, undisclosed persistence is risky because users may reasonably expect an ephemeral status query, while the implementation silently creates a durable local record of internal infrastructure.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The undisclosed debug dump silently writes API-derived data to a local JSON file, creating a second and less obvious persistence channel than the main dashboard output. Because debug artifacts are often overlooked in reviews and cleanup, they can become a durable source of sensitive network information leakage in multi-tool or shared environments.

External Transmission

Medium
Category
Data Exfiltration
Content
payload=$(jq -nc --arg username "$UNIFI_USER" --arg password "$UNIFI_PASS" '{username:$username,password:$password}')
  
  # Try login
  curl -sk -c "$cookie_file" \
    -H "Content-Type: application/json" \
    -X POST \
    "$UNIFI_URL/api/auth/login" \
Confidence
95% confidence
Finding
The login request sends UniFi credentials with curl using the -k flag, which disables TLS certificate validation. If the configured URL is intercepted or points to a host with an untrusted certificate, credentials and session cookies could be exposed to a man-in-the-middle attacker. In this skill context, the script is specifically designed to access a privileged local network management interface, which increases the sensitivity of leaked credentials.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
→ Wrong username/password. Must be a **local** admin, not Ubiquiti cloud account.

**SSL certificate error**  
→ UniFi uses self-signed certs. The scripts use `-k` to skip verification.

**Empty data or "Invalid site"**  
→ Most setups use `default`. Check your site name in the UniFi Network URL.
Confidence
95% confidence
Finding
The README explicitly states that the scripts use curl -k to disable TLS certificate verification when connecting to the UniFi gateway. This makes the local admin credentials and returned network data vulnerable to man-in-the-middle interception or spoofing by any attacker able to influence the local network path, which is especially sensitive given this skill accesses network management APIs.

Static analysis

No suspicious patterns detected.