ClawHub
Back to skill

Security audit

Gateway Manager Free

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly an API gateway configuration helper, but its activation text also targets unrelated project-management work while requesting write and command-execution authority.

Install only if you want a gateway configuration assistant and can ensure it is invoked for explicit API gateway, reverse proxy, routing, authentication, rate-limit, or monitoring tasks. Review generated configs before deployment, avoid giving it real secrets, and be aware that its metadata may cause it to appear for unrelated project-management requests.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The manifest says the skill should be used for project management, task planning, progress tracking, and team collaboration, but the actual content is an API gateway configuration generator with read/write/exec capabilities. This mismatch can cause the skill to be invoked in unrelated contexts, unexpectedly exposing infrastructure-oriented behaviors and command execution pathways when the user intended a non-infrastructure workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The activation text is contradictory and overly broad, combining API gateway administration with generic project-management/team-collaboration language. In an agent ecosystem, this increases the chance of accidental invocation on unrelated prompts, causing an infrastructure-capable skill with exec support to run in contexts where it is unnecessary and potentially unsafe.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The capability coverage section includes excessively broad keywords such as generic efficiency, automation, planning-adjacent phrases, and fragmented text that can collide with many ordinary user requests. Overbroad routing metadata increases unintended activation frequency, which is especially risky because the skill advertises write and exec tools and can influence infrastructure configuration output.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.

md
### Q4：认证失败怎么处理？

认证失败统一返回401，响应体 `{"code":401,"message":"Unauthorized"}`。不建议在响应中区分"用户不存在"和"密码错误"，避免被用于枚举攻击。JWT过期的处理建议客户端用refresh token换新access token，网关不负责刷新。

### Q5：支持多租户限流吗？

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The copyright/licensing section states that the adaptation removed external service URLs and vendor CLI references. Elsewhere, the document still contains explicit external/internal service URLs such as 'http://user-service:8001' and 'http://auth-service:8080/oauth/introspect', plus CLI command examples for 'gateway-manager render'. This is an active contradiction between documentation claims and the document's actual contents.

Content

No source excerpt is available for this finding.