ClawHub
Back to skill

Security audit

Cloudforge Automation Free

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Terraform cloud automation guide, but it includes unsafe infrastructure destruction and weak environment scoping that could delete the wrong cloud resources.

Review this skill carefully before installing. Use least-privilege cloud credentials, keep dev/test/prod in separate Terraform workspaces or backends, manually review every plan, remove `-auto-approve` from destroy workflows, and do not use the included database template for important data unless backups, deletion protection, encryption, and final snapshots are configured.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:252
Finding

Unconfirmed Terraform Destruction Can Target the Wrong Environment

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:146
Finding

Terraform Templates Use Unsafe Public Exposure and Data-Retention Defaults

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs users to run deployment and destroy operations without a prominent warning about irreversible deletion, cloud charges, or production impact. In an agent-execution context, this increases the risk of users or agents triggering costly or destructive actions without informed confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill walks through cloud credential setup but does not warn users not to paste secrets into chat, logs, generated files, or Terraform variables. In an LLM-agent setting, credential-handling guidance is security-sensitive because users may disclose privileged cloud access tokens to the agent or store them insecurely.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

Using terraform destroy -auto-approve removes the human confirmation barrier for destructive operations, enabling immediate infrastructure deletion if the command is triggered accidentally or by prompt-driven automation. In a skill with exec capability, this is particularly dangerous because the agent can execute irreversible cloud actions that cause downtime, data loss, and financial impact.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

md
;;
  destroy)
    cd infra
    terraform destroy -auto-approve
    echo "已销毁$ENV环境资源"
    ;;
  *)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

L444-L457将“多云统一管理”列为免费版不支持的高级功能，但该技能正文已在L47、L80-L112、L368中明确宣称免费版支持AWS/GCP/Azure三大云平台，并提供对应初始化命令。虽然正文强调“单云”而非同时多云，但该限制说明容易与前述已实现/已宣称的平台支持形成直接意图冲突。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

版权声明中的改造清单在L430声称新增了“四类Terraform模板（Web应用/数据库/基础网络/安全组）”，但前文“功能二：Terraform模板”实际仅分为Web应用、数据库、基础网络三类章节。安全组只作为Web应用模板中的一个资源片段出现，而非独立第四类模板。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
71% confidence
Finding

The text says the skill was 'completely Chinese-localized' for Chinese user scenarios, and the document is entirely written in Chinese without offering a language choice. That can be interpreted as forcing a specific language/locale rather than giving the user an explicit opt-in or alternative.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.