ClawHub
Back to skill

Security audit

asset-cleanup-daily

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate maintenance cleanup skill, but it automatically performs irreversible local, database, and remote asset deletion with limited containment details.

Install only in an environment where JUEJIN_HOME is controlled and the tenant_assets expiry data, AList credentials, and delegated scripts/asset_cleanup.py are trusted. Prefer running with --dry-run first and verify the audit report and deletion scope before enabling the daily cron job.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tainted flow: 'cmd' from os.environ.get (line 67, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
return {"cleaned": False, "skipped": "scripts/asset_cleanup.py不存在"}
    try:
        cmd = [sys.executable, str(script)] + (["--dry-run"] if dry_run else [])
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
        if result.returncode == 0:
            d = json.loads(result.stdout.strip()).get("data", {})
            return {"cleaned": True, "expired_count": d.get("expired_count", 0),
Confidence
84% confidence
Finding
The script path is derived from JUEJIN_HOME, which comes from the environment, and that path is then used to select and execute another Python file. If an attacker can influence the service environment or startup context, they can redirect execution to an attacker-controlled asset_cleanup.py and achieve arbitrary code execution under the job's privileges.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares powerful tools (`read`, `exec`) and explicitly depends on environment variables, filesystem access, and shell execution, but it does not declare corresponding permissions or constraints. This weakens policy enforcement and reviewability, making it easier for a maintenance skill to perform broader file or command actions than operators expect.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill’s documented behavior includes deletion of remote AList files as part of asset cleanup, which introduces a network-capable destructive action beyond simple local disk maintenance. Remote deletion materially increases blast radius: a misconfiguration, compromised database record, or unsafe path mapping could remove assets outside the intended local cleanup scope.

Intent-Code Divergence

Low
Confidence
72% confidence
Finding
The documentation presents the skill as narrowly limited to cleanup and reporting, yet elsewhere it includes remote AList file deletion, which expands behavior beyond what reviewers or operators may infer from the summary. This mismatch can cause underestimation of risk and accidental authorization of a more powerful destructive capability than intended.

Static analysis

No suspicious patterns detected.