ClawHub
Back to skill

Security audit

系统监控专业版

Security checks for vulnerabilities and agentic risk

Overview

This monitoring skill is broadly aligned with its purpose, but it asks for high-impact system, network, and credential access without enough scoping or user-control safeguards.

Review this skill carefully before installing. Use it only in a controlled environment, provide read-only or least-privilege monitoring credentials, avoid storing secrets in local config files unless protected, and require explicit confirmation before remote host access, log export, callbacks, webhooks, Docker socket access, or kubeconfig use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Intent-Code Divergence

Medium
Confidence
85% confidence
Finding
The document gives conflicting secret-handling guidance: it says API keys are configured via environment variables, then states all credentials are stored in local configuration files. That ambiguity can lead operators or downstream agents to persist sensitive tokens in plaintext files, increasing the chance of credential disclosure through logs, backups, or repository leakage.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The description includes broad 'Use when' language around monitoring, log analysis, alerting, and deployment management, which creates very loose invocation boundaries. In an agent environment with exec capability, generic user requests may trigger this skill unexpectedly and lead to network access, system inspection, or command execution beyond the user's intended scope.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The README says natural-language instructions can directly trigger the tool without defining strict invocation boundaries or approval gates. Because the skill advertises read and exec tools plus multi-node monitoring features, this raises the risk of unintended execution, collection, or remote access from vague prompts.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill advertises export functionality but does not clearly warn that data may be written to disk. In a monitoring/log-analysis context, exported files can contain operationally sensitive information, causing unintended persistence of logs, host details, or alerts on the local filesystem.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The examples include callback URLs, Grafana URLs, webhooks, and remote monitoring actions but do not clearly disclose that data may leave the local environment or traverse the network. For infrastructure monitoring, this can expose topology, metrics, logs, and alert content to external systems without informed operator consent.

Credential Access

High
Category
Privilege Escalation
Content
python3 （请参考skill目录中的脚本文件） add \
  --name "web-01" --host 192.168.1.10 --ssh-key $HOME/.ssh/id_rsa
python3 （请参考skill目录中的脚本文件） add \
  --name "db-01" --host 192.168.1.20 --ssh-key $HOME/.ssh/id_rsa
# ...
# 批量添加
python3 （请参考skill目录中的脚本文件） batch-add --file servers.csv
Confidence
95% confidence
Finding
The documentation instructs use of a private SSH key path for adding monitored nodes, in a skill that exposes exec capability and broad natural-language triggering. This encourages handling raw private-key material during routine operations and increases the risk that an agent, script, or operator may expose, misuse, or improperly forward highly privileged credentials.

Credential Access

High
Category
Privilege Escalation
Content
socket: "/var/run/docker.sock"
    kubernetes:
      enabled: true
      kubeconfig: "$HOME/.kube/config"
# ...
  logs:
    aggregation: true
Confidence
90% confidence
Finding
The explicit kubeconfig parameter reinforces that the skill may access Kubernetes authentication material as part of normal use. Because kubeconfig often grants broad cluster access, any accidental reading, logging, export, or reuse of that file can lead to unauthorized control over workloads and sensitive cluster data.

Credential Access

High
Category
Privilege Escalation
Content
socket: "/var/run/docker.sock"
    kubernetes:
      enabled: true
      kubeconfig: "$HOME/.kube/config"
# ...
  logs:
    aggregation: true
Confidence
90% confidence
Finding
The explicit kubeconfig parameter reinforces that the skill may access Kubernetes authentication material as part of normal use. Because kubeconfig often grants broad cluster access, any accidental reading, logging, export, or reuse of that file can lead to unauthorized control over workloads and sensitive cluster data.

Static analysis

No suspicious patterns detected.