ClawHub
Back to skill

Security audit

CICD工作流程技能

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent CI/CD template generator, but it includes unsafe production deployment guidance that can grant root-equivalent access if followed.

Review before installing. Use this only as a starting point, not as production-ready CI/CD security guidance. Remove Docker TCP exposure, avoid host docker.sock and privileged runners for general jobs, remove deploy-user sudo-group membership, validate and quote generated project names, pin images, use least-privilege Kubernetes credentials, protect production deployments with approvals, and handle kubeconfig material through secure CI secret mechanisms.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (7)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/generate-setup-guide.py:271
Finding

Unauthenticated Docker Remote API Exposure

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/generate-setup-guide.py:134
Finding

Deployment User Receives Unnecessary Full Sudo Membership

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/generate-setup-guide.py:430
Finding

CI Runner Configuration Grants Host-Equivalent Privileges

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/generate-setup-guide.py:146
Finding

Command Injection Through Unvalidated Project Name

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/notify.sh:58
Finding

Unescaped Build Metadata Is Embedded in Webhook JSON

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
assets/gitlab-ci.yml:204
Finding

Kubernetes Credential Is Written Without Explicit Secure Permissions

Content
View full analysis
~/.kube/config - kubectl config use-context $K8S_CLUSTER ``` ### Technical Analysis The pipeline decodes a kubeconfig credential directly to `~/.kube/config` without setting a restrictive umask, explicitly creating the directory with mode `700`, setting the file to mode `600`, or removing it after use. Actual exposure depends on runner isolation and the runner user's default umask. Shared or misconfigured runner environments increase the risk that another process can read the file. Using `echo` also provides weaker binary and formatting handling than a controlled file-variable mechanism or `printf`. ### Attack Path 1. The deployment job receives a base64-encoded kubeconfig. 2. The job writes the decoded credential using default filesystem permissions. 3. A co-resident process, another job on an inadequately isolated runner, or a later process accesses the runner filesystem. 4. The process reads `~/.kube/config`. 5. The stolen credential is used against the Kubernetes API. ### Impact Assessment The attacker's privileges are those granted to the identity contained in the kubeconfig. Based on the pipeline's deployment operations, the credential can at least update and inspect deployments in the configured namespace. If the kubeconfig is overprivileged, the scope may extend to broader namespace or cluster administration. ]]>
Remediation
View remediation
"$HOME/.kube/config" - chmod 600 "$HOME/.kube/config" ``` - Delete the credential in `after_script`. - Use an ephemeral, isolated deployment runner. - Use a namespace-scoped Kubernetes service account with only the verbs and resources required for rollout operations. - Rotate the credential if runner filesystem exposure is suspected. ]]>

T08 · Insecure Dependencies

Warning
Location
assets/gitlab-ci.yml:204
Finding

CI and Production Images Use Mutable Unpinned Tags

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (72)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md
// K8s 配置
        K8S_NAMESPACE = 'production'
        KUBE_CONFIG_ID = 'kubeconfig'
        
        // 版本标签
        IMAGE_TAG = "${BUILD_NUMBER}-${GIT_COMMIT?.take(7) ?: 'unknown'}"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md
// K8s 配置
        K8S_NAMESPACE = 'production'
        KUBE_CONFIG_ID = 'kubeconfig'
        
        // 版本标签
        IMAGE_TAG = "${BUILD_NUMBER}-${GIT_COMMIT?.take(7) ?: 'unknown'}"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 432)May include surrounding context.

md
// K8s 配置
        K8S_NAMESPACE = 'production'
        KUBE_CONFIG_ID = 'kubeconfig'
        
        // 版本标签
        IMAGE_TAG = "${BUILD_NUMBER}-${GIT_COMMIT?.take(7) ?: 'unknown'}"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/Jenkinsfile.txt (reported line 20)May include surrounding context.

text
// K8s 配置
        K8S_NAMESPACE = 'production'
        KUBE_CONFIG_ID = 'kubeconfig'
        
        // 版本标签
        IMAGE_TAG = "${BUILD_NUMBER}-${GIT_COMMIT?.take(7) ?: 'unknown'}"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate-setup-guide.py (reported line 84)May include surrounding context.

python
// K8s 配置
        K8S_NAMESPACE = 'production'
        KUBE_CONFIG_ID = 'kubeconfig'
        
        // 版本标签
        IMAGE_TAG = "${BUILD_NUMBER}-${GIT_COMMIT?.take(7) ?: 'unknown'}"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate-setup-guide.py (reported line 455)May include surrounding context.

python
// K8s 配置
        K8S_NAMESPACE = 'production'
        KUBE_CONFIG_ID = 'kubeconfig'
        
        // 版本标签
        IMAGE_TAG = "${BUILD_NUMBER}-${GIT_COMMIT?.take(7) ?: 'unknown'}"

Chaining Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Piping file paths from find output through xargs rm -f is unsafe because whitespace, special characters, or crafted filenames can cause incorrect parsing and deletion of unintended files. In a build pipeline processing repository-controlled content, an attacker could create maliciously named files that alter removal behavior or damage artifacts/workspace contents.

Content

Scanner excerpt · assets/Jenkinsfile.txt (reported line 287)May include surrounding context.

text
echo "❌ Security violation found:"
                                    echo "$VIOLATIONS"
                                    echo "Removing violation files..."
                                    echo "$VIOLATIONS" | xargs rm -f
                                fi
                                
                                echo "✅ Vue build check passed"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/Jenkinsfile.txt (reported line 420)May include surrounding context.

text
}
            steps {
                script {
                    withCredentials([file(credentialsId: "${KUBE_CONFIG_ID}", variable: 'KUBECONFIG')]) {
                        sh """
                            # 验证 kubectl 连接
                            kubectl cluster-info

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/gitlab-ci.yml (reported line 207)May include surrounding context.

yaml
image: bitnami/kubectl:latest
  script:
    # 配置 K8s 访问
    - echo "$KUBE_CONFIG" | base64 -d > ~/.kube/config
    - kubectl config use-context $K8S_CLUSTER
    
    # 更新镜像版本

Credential Access

High
Category
Privilege Escalation
Confidence
82% confidence
Finding

The section header introducing kubeconfig upload is not dangerous by itself, but in context it normalizes moving powerful cluster credentials into Jenkins without discussing minimization or handling safeguards. In CI/CD guidance, omission of those warnings increases the risk of overprivileged, widely accessible secrets.

Content

Scanner excerpt · scripts/generate-setup-guide.py (reported line 231)May include surrounding context.

python
--namespace=production
```

#### 4. 上传 Kubeconfig 到 Jenkins
```bash
# 复制 kubeconfig 内容
cat ~/.kube/config | base64

Credential Access

High
Category
Privilege Escalation
Confidence
82% confidence
Finding

This line labels the action as copying kubeconfig content, which contributes to insecure secret-handling practices. The danger is contextual: users may expose raw credential material while following the documented workflow.

Content

Scanner excerpt · scripts/generate-setup-guide.py (reported line 233)May include surrounding context.

python
#### 4. 上传 Kubeconfig 到 Jenkins
```bash
# 复制 kubeconfig 内容
cat ~/.kube/config | base64

# 在 Jenkins 中创建 credentials：

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

cat ~/.kube/config | base64 encourages direct handling and transformation of a sensitive kubeconfig in a terminal workflow. Kubeconfig files often contain bearer tokens, client certificates, or cluster-admin credentials; exposing them in shell history, scrollback, copy/paste buffers, or support artifacts can enable unauthorized cluster access.

Content

Scanner excerpt · scripts/generate-setup-guide.py (reported line 234)May include surrounding context.

python
#### 4. 上传 Kubeconfig 到 Jenkins
```bash
# 复制 kubeconfig 内容
cat ~/.kube/config | base64

# 在 Jenkins 中创建 credentials：
# Kind: Secret file

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

Telling users to paste base64 content as a Jenkins secret file risks mishandling, accidental logging, and broad credential distribution, especially if the kubeconfig is overprivileged. The skill context makes this more dangerous because it is prescriptive operational guidance likely to be copied verbatim by users.

Content

Scanner excerpt · scripts/generate-setup-guide.py (reported line 238)May include surrounding context.

python
# 在 Jenkins 中创建 credentials：
# Kind: Secret file
# ID: kubeconfig
# File: 粘贴 base64 内容或上传文件
```
"""

Docker Socket Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The guide suggests configuring Docker to listen on tcp://0.0.0.0:2376 alongside the local socket, with no mention of TLS, firewalling, or authentication. Exposing the Docker API on all interfaces can allow remote attackers to start privileged containers, mount the host filesystem, steal secrets, and effectively gain root-level control of the machine.

Content

Scanner excerpt · scripts/generate-setup-guide.py (reported line 277)May include surrounding context.

python
添加：
```json
{{
  "hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2376"]
}}
```

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate-setup-guide.py (reported line 314)May include surrounding context.

python
```bash
# 1. 检查 Jenkins 服务器上的 SSH 密钥
sudo su - jenkins
cat ~/.ssh/id_rsa.pub

# 2. 确保公钥已添加到目标服务器的 authorized_keys
cat ~/.ssh/authorized_keys  # 在目标服务器上

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate-setup-guide.py (reported line 317)May include surrounding context.

python
cat ~/.ssh/id_rsa.pub

# 2. 确保公钥已添加到目标服务器的 authorized_keys
cat ~/.ssh/authorized_keys  # 在目标服务器上

# 3. 检查权限
chmod 700 ~/.ssh

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate-setup-guide.py (reported line 321)May include surrounding context.

python
cat ~/.ssh/id_rsa.pub

# 2. 确保公钥已添加到目标服务器的 authorized_keys
cat ~/.ssh/authorized_keys  # 在目标服务器上

# 3. 检查权限
chmod 700 ~/.ssh

Docker Socket Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

Mounting /var/run/docker.sock into the GitLab Runner container gives the container effective control over the host Docker daemon. If jobs or the runner are compromised, an attacker can launch privileged containers and escape into full host compromise.

Content

Scanner excerpt · scripts/generate-setup-guide.py (reported line 430)May include surrounding context.

python
```bash
docker run -d --name gitlab-runner --restart always \\
  -v /srv/gitlab-runner/config:/etc/gitlab-runner \\
  -v /var/run/docker.sock:/var/run/docker.sock \\
  gitlab/gitlab-runner:latest
```

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The pipeline can deploy directly to the production Kubernetes namespace on main/master or via FORCE_DEPLOY without any explicit approval gate at execution time. In CI/CD contexts, an automatic path to production increases the risk of accidental or unauthorized rollout of unreviewed code, especially if branch protections, webhook triggers, or parameter controls are weak.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The natural-language content in the file is presented in Chinese only, including key pipeline descriptions and section headers. This can violate a language/locale policy when a skill or artifact imposes a specific language without user opt-in or a documented regional justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/gitlab-ci.yml (reported line 240)May include surrounding context.

yaml
image: alpine/curl:latest
  script:
    - |
      curl -X POST "${WEBHOOK_URL}" \
        -H "Content-Type: application/json" \
        -d "{
          \"msg_type\": \"text\",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/gitlab-ci.yml (reported line 261)May include surrounding context.

yaml
image: alpine/curl:latest
  script:
    - |
      curl -X POST "${WEBHOOK_URL}" \
        -H "Content-Type: application/json" \
        -d "{
          \"msg_type\": \"text\",

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The Jenkins guide title and surrounding generated content are written in Chinese, and the GitLab guide follows the same pattern later in the file. This imposes a specific language on all users with no opt-in or documented locale constraint, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/generate-setup-guide.py (reported line 134)May include surrounding context.

python
#### 1. 创建部署用户
```bash
# 创建 deploy 用户
sudo useradd -m -s /bin/bash deploy

# 设置密码（可选，如果使用密钥认证）
sudo passwd deploy

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/generate-setup-guide.py (reported line 137)May include surrounding context.

python
#### 1. 创建部署用户
```bash
# 创建 deploy 用户
sudo useradd -m -s /bin/bash deploy

# 设置密码（可选，如果使用密钥认证）
sudo passwd deploy

Static analysis

No suspicious patterns detected.