ClawHub
Back to skill

Security audit

Azure巡检员专业版

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad Azure inspection helper that mainly uses read-only Azure CLI checks, but users should be careful with optional reporting, scheduling, and callback features because they can expose sensitive cloud posture data.

Install only if you are comfortable letting an agent run Azure CLI read queries against the selected Azure scope. Use least-privilege Azure roles, explicitly choose the subscription or resource group, avoid callback_url or webhook delivery unless the destination is trusted, and treat generated reports/logs as sensitive files that may need restricted permissions and cleanup.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The skill repeatedly represents itself as 'read-only' and non-mutating, but it also documents local write operations such as creating directories, saving templates, snapshots, weights, logs, and reports. This mismatch can mislead users and downstream agents into authorizing the skill under a lower-risk assumption, causing sensitive Azure inventory, RBAC, and cost data to be persisted unexpectedly.

Intent-Code Divergence

Medium
Confidence
86% confidence
Finding
The FAQ says inspections use only read-only Azure commands and 'make no changes,' but the documented workflows include subscription context changes and local report/state writes. Misstating operational side effects is dangerous because users may not realize the skill alters local environment state and stores potentially sensitive audit artifacts.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill advertises an arbitrary callback_url despite being framed as an inspection tool, creating a channel to send collected cloud inventory or audit results to an external endpoint. Without strict allowlisting, validation, or clear consent, this enables exfiltration of subscription, RBAC, cost, and exposure data to attacker-controlled infrastructure.

Vague Triggers

Medium
Confidence
71% confidence
Finding
The skill uses broad capability claims and open-ended execution language without tight trigger constraints or exclusion conditions. In an agent setting, this increases the chance of over-broad invocation and execution of risky subfeatures such as cross-subscription scans, local persistence, or scheduling when the user's intent was narrower.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation mentions configuring a callback URL but does not warn that inspection output may be sent externally. Because the generated output can contain detailed cloud inventory and security posture data, omission of this warning undermines informed consent and can facilitate covert data disclosure.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The scheduled inspection section stores reports and logs persistently on disk without clearly warning that account context, inventory, RBAC counts, and other audit data will accumulate over time. Persistent storage enlarges the attack surface by making sensitive operational data available to other local users, processes, backups, or later compromise.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The report-generation workflow writes detailed Markdown reports containing subscription names, resource inventory, RBAC counts, cost data, and exposure findings, but it does not clearly warn users about that persistence. These reports can become a high-value reconnaissance artifact if accessed by unauthorized parties.

Session Persistence

Medium
Category
Rogue Agent
Content
| Cost Management返回空 | 未配置或订阅类型不支持 | 确认Cost Management已在Portal配置;EA账户需EA Reader权限 |
| NSG扫描慢 | NSG数量多 | 缩小扫描范围;使用并行模式;缓存结果 |
| 跨订阅巡检中断 | 某订阅权限不足 | 脚本已设计为跳过失败订阅;检查日志确认跳过的订阅 |
| 定时巡检未执行 | cron配置错误 | 检查crontab -l;确认脚本有执行权限;查看日志 `/var/log/azure-inspector.log` |
| 趋势对比无数据 | 历史报告不足 | 至少积累2次巡检数据;确认报告保存到 `$HOME/.azure-inspector/reports/` |

## 依赖说明
Confidence
76% confidence
Finding
The skill explicitly supports cron-based scheduled execution and persistent logs/reports, which constitutes session/state persistence beyond a one-shot inspection flow. In this context, persistence is more dangerous because the skill handles sensitive cloud posture data and can continue collecting it automatically after the initial interaction.

Static analysis

No suspicious patterns detected.