ClawHub
Back to skill

Security audit

Atlas Admin Console

Security checks for vulnerabilities and agentic risk

Overview

This skill is a high-impact MongoDB Atlas operations helper, but it relies on a missing privileged executable and has overly broad, inconsistent documentation that users should review carefully before installing.

Do not install this unless you can verify the real atlas-pro implementation, its source, version, and checksum. Use narrowly scoped Atlas API keys, avoid --profile all unless explicitly needed, require approval for destructive or infrastructure-changing workflows, and keep alert automation disabled until rules are reviewed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:134
Finding

Unverifiable Privileged Executable Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 134-145, 246-254, and 317
Vulnerability Type: Unverified external executable resolved from the host environment
Risk Level: High

Vulnerable Code

bash
# Batch-query all cluster statuses and export them as CSV
atlas-pro batch \
  --operation listClusters \
  --groups "group1,group2,group3" \
  --output cluster-health-$(date +%Y%m%d).csv \
  --format csv \
  --parallel 5
# ...
# Batch-check backup status
atlas-pro batch \
  --operation listSnapshots \
  --groups "group1,group2,group3" \
  --output backup-status.csv \
  --filter "createdAt > now-24h"
bash
atlas-pro batch \
  --operation listClusters \
  --profile all \
  --output daily-report.csv \
  --format csv
bash
atlas-pro alert start --config alert-rules.yml

The dependency table declares:

text
| atlas-pro.mjs | Script | Required | Distributed with this Skill |

Technical Analysis

The Skill delegates all substantive MongoDB Atlas operations to an atlas-pro executable. However, the audited package contains only SKILL.md; the declared atlas-pro.mjs script is not present. Its implementation, provenance, integrity, and security properties therefore cannot be reviewed.

Because the examples invoke atlas-pro by a bare command name rather than a verified package-relative path, the shell resolves the executable through the host's PATH. This creates a supply-chain and command-resolution trust boundary: an unintended, compromised, or attacker-supplied executable named atlas-pro could be selected.

The executable is expected to process Atlas credentials and perform multi-project administrative operations, workflow orchestration, infrastructure changes, and automated alert responses. Consequently, executing an unverified implementation is materially more dangerous than invoking an ordinary local utility.

No evidence sho ...[truncated 1711 chars]

Remediation
View remediation

Remediation Suggestions

  1. Include the declared atlas-pro.mjs implementation in the Skill package so its behavior can be audited.
  2. Invoke the implementation through a package-relative absolute path rather than relying on PATH resolution.
  3. If distribution as a separate dependency is intentional, identify an authenticated official source and pin an exact version and cryptographic checksum.
  4. Verify the dependency's signature or checksum before first use and after updates. Fail closed if verification fails.
  5. Do not automatically install or execute an arbitrary binary merely because it is named atlas-pro.
  6. Use separate Atlas credentials for production and staging, granting only the API roles required for each operation.
  7. Avoid --profile all by default. Require explicit user confirmation before cross-project, destructive, or infrastructure-changing operations.
  8. Run the executable in a restricted environment with only the necessary environment variables, filesystem access, and network destinations.
  9. Protect ~/.atlas-pro with directory mode 0700 and credential configuration files with mode 0600.
  10. Add provenance, version, and integrity-verification instructions to SKILL.md, and document the exact administrative permissions required for every operation.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
### Q4：告警自愈动作误触发怎么办？
A：(1) 设置合理的`cooldown`冷却期；(2) 增加`duration`持续时间要求，避免瞬时波动触发；(3) 关键动作（如销毁集群）配置`require_approval: true`人工确认；(4) 监控告警动作日志，发现异常立即停用规则.
### Q5：如何跨组织批量管理？
A：在`credentials.yml`中配置多个profile，使用`--profile all`遍历所有配置的组织与项目。专业版支持跨组织统一视图，便于集团级管理.
### 错误恢复步骤
| 错误场景(续)| 原因 | 处理方式 |
|----:|:----|----:|

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

md
### Q4：告警自愈动作误触发怎么办？
A：(1) 设置合理的`cooldown`冷却期；(2) 增加`duration`持续时间要求，避免瞬时波动触发；(3) 关键动作（如销毁集群）配置`require_approval: true`人工确认；(4) 监控告警动作日志，发现异常立即停用规则.
### Q5：如何跨组织批量管理？
A：在`credentials.yml`中配置多个profile，使用`--profile all`遍历所有配置的组织与项目。专业版支持跨组织统一视图，便于集团级管理.
### 错误恢复步骤
| 错误场景(续)| 原因 | 处理方式 |
|----:|:----|----:|

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation language is so broad that it could cause the skill to match many unrelated 'efficiency' or 'automation' requests and become active outside its intended Atlas administration scope. In a skill that advertises exec, write, and API orchestration capabilities, over-broad triggering increases the chance that a powerful operational tool is invoked in inappropriate contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description explicitly states '支持中文交互' in a way that presents Chinese as the interaction mode, and the file contains no opt-in or alternative language option. Under the policy, forcing a specific language without user choice is a natural-language locale violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documentation describes an operations console for MongoDB Atlas, with credentials, batch operations, alerting, and Terraform workflows. But the input spec says content is generic 'atlas-admin-console processed content' and strict_level is an audit strictness control, which aligns with a reviewer/analyzer skill rather than an Atlas management console.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The surrounding documentation consistently presents this skill as a MongoDB Atlas administration console for batch API operations, workflows, alerts, and Terraform management. However, the output schema here describes fields like code style, security compliance scoring, and improvement suggestions, which is a different function entirely and actively conflicts with the claimed admin-console behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.