ClawHub
Back to skill

Security audit

auto-healing-manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is an infrastructure auto-healing tool that is purpose-aligned but should be reviewed because it can automatically run high-impact repair actions without clear confirmation or tight target scoping.

Install only in an environment where this skill is allowed to operate on the named infrastructure. Review the playbook and MCP implementation first, prefer dry-run or diagnosis-only use initially, and require explicit target allowlists and confirmation before enabling unattended repair actions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
79% confidence
Finding
The skill declares no permissions/dependencies yet explicitly references reading local configuration files such as `config/fault_playbook.yaml` and state files. This mismatch weakens reviewability and can cause the agent to access filesystem resources without clear operator awareness, which is risky in an infrastructure automation skill that also performs repairs.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger list contains very broad operational phrases like '自动修复', '自愈管理', and '混沌工程', which can cause the skill to activate in loosely related conversations. Because this skill can initiate diagnosis, repair, restart, cleanup, and provider switching, accidental invocation could lead to unintended infrastructure changes.

Missing User Warnings

High
Confidence
95% confidence
Finding
The skill describes automated repair actions such as restarting containers, cleaning disks, switching providers, and refreshing cookies, but it does not present a prominent warning or require explicit user confirmation before executing them. In an unattended 'auto-healing' context, this increases the chance of destructive or unsafe remediation being run on the wrong target or under attacker-influenced fault context.

Static analysis

No suspicious patterns detected.