ClawHub
Back to skill

Security audit

Azure Gateway Cli

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an Azure OpenAI gateway guide, but it has inconsistent purpose text and under-scoped instructions for caching, credentials, command execution, and optional startup persistence.

Review this skill before installing. Use it only for Azure OpenAI gateway work, avoid the SEO and grading-schema parts, keep API keys in environment variables, disable or tightly scope caching for sensitive prompts, and do not enable the systemd service unless you explicitly want a persistent local gateway and know how to remove it.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Intent-Code Divergence

High
Confidence
96% confidence
Finding
The skill metadata/description is internally inconsistent: it presents itself as an Azure gateway tool but also says it should be used for SEO optimization. This kind of scope confusion is dangerous because an agent may invoke the skill in unintended contexts, route unrelated data into proxy/execution workflows, or trust outputs that do not match the advertised function.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The documented input/output contract describes a grading/audit response schema that does not match the gateway behavior described elsewhere. A mismatched contract can cause agents or orchestrators to mis-handle results, skip safety checks, or feed sensitive operational data into the wrong downstream logic based on false assumptions about the skill's purpose.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The invocation language is overly broad and ambiguous, making it easier for an agent to select this skill outside its intended scope. In a skill with read/exec/write capabilities, vague triggers materially increase the chance of unnecessary command execution, file modification, or proxy setup in response to loosely related user requests.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The instructions tell the user/agent to create config files and register a persistent systemd service, including enablement at startup, without prominent warning about host persistence and system changes. In a skill that exposes exec/write tools, this can lead to unauthorized persistence, background service installation, or modification of the local environment beyond the user's expectations.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill promotes request caching and tenant cost tracking but does not clearly warn that prompts, responses, tenant identifiers, and usage metadata may be stored or exposed. In a multi-tenant gateway context, undocumented retention and observability features increase the risk of privacy violations, sensitive data persistence, and cross-tenant information leakage.

Static analysis

No suspicious patterns detected.