ClawHub
Back to skill

Security audit

运维看板(专业版)

Security checks for vulnerabilities and agentic risk

Overview

This skill is an operations dashboard guide with legitimate admin use, but it asks users to enable broad filesystem, secret-scanning, service-restart, and configuration-changing powers without enough scoping or safeguards.

Review this skill carefully before installing. Use it only in a controlled ops environment, keep the high-risk environment flags disabled unless needed, avoid enabling home-directory or arbitrary attachment copying, require redacted secret-scan results, restrict scan paths and restartable services, and add explicit approvals or dry-run previews before restore, terminate, config update, or restart operations.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:323
Finding

Sensitive Credential File Reconnaissance Through the Security Scan API

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:221
Finding

Overbroad Attachment Copy Permissions Include Arbitrary and Home-Directory Files

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:132
Finding

Unpinned Express Installation Creates a Non-Reproducible Dependency Chain

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

Backup restore and config/model update operations can overwrite current state, change runtime behavior, or cause outages, yet the examples present them as routine actions without prominent risk disclosure. This is particularly dangerous for an exec-capable agent because configuration drift or rollback mistakes can immediately affect production systems.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documented systemctl restart capability gives the skill host-control power that can disrupt or alter running services. For an agent skill, this is a privileged action beyond passive monitoring and can be abused to cause denial of service, hide activity by restarting components, or impact production workloads.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

Restarting services is inherently disruptive and may interrupt production traffic, jobs, or monitoring coverage, but the documented example lacks a strong safety warning. In a skill that can be invoked through natural language, normalizing restart commands without safeguards materially raises accidental outage risk.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

Explicitly scanning ./.env for patterns such as auth=, API_CRED, PASSPHRASE, and COOKIE is strong evidence of credential discovery behavior. In the context of an agent skill with command and file capabilities, this can directly expose secrets used by the host, applications, or connected services.

Content

Scanner excerpt · SKILL.md (reported line 327)May include surrounding context.

md
-H "Content-Type: application/json" \
     -d '{
       "patterns": ["auth=", "API_CRED", "SENSITIVE", "PASSPHRASE", "COOKIE"],
       "paths": ["./config", "./.env"]
     }' \
     http://localhost:3000/api/security/scan
curl -H "Authorization: Bearer $DASHBOARD_AUTH" \

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file claims commands execute in a 'safe sandbox' while elsewhere documenting real file-sensitive and system-control operations. This mismatch can mislead users and downstream agents into underestimating the privileges and consequences of the skill, increasing the chance of unsafe execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The display name, summary, description, and the substantive user-facing instructions throughout the file are presented in Chinese, with no alternative language option or opt-in. This creates a language policy concern because the skill effectively requires a specific language for use without documenting that constraint or offering a choice.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

运维场景：成本监控与预算告警

追踪AI Agent的用量消耗和API费用，设置预算阈值，超支时自动告警：

bash
curl -H "Authorization: Bearer $DASHBOARD_AUTH" \
     http://localhost:3000/api/cost/summary
curl -H "Authorization: Bearer $DASHBOARD_AUTH" \
     http://localhost:3000/api/cost/by-session

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill documents batch session archive/terminate operations without prominent warnings about impact on active work, data retention, or service continuity. In an agent-driven environment, terse examples can be executed literally, making accidental destructive actions more likely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Documenting the loading of third-party provider API keys from a local keys.env file expands the skill's access to secret material unrelated to basic dashboard functionality. Even if intended for provider auditing, encouraging local secret-file ingestion increases the chance that an agent with file access will read, expose, or misuse those credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.

text
### 成本分析与预算管理
```bash
curl -H "Authorization: Bearer $DASHBOARD_AUTH" \
     http://localhost:3000/api/cost/summary
curl -H "Authorization: Bearer $DASHBOARD_AUTH" \
     "http://localhost:3000/api/cost/by-session?limit=50"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill exposes a 'sensitive data deep scan' workflow that explicitly targets local paths including ./.env and searches for credential-like patterns. In an agent context with read, write, and exec tools, this goes beyond ordinary dashboard monitoring and creates a clear mechanism to enumerate secrets from local files, which could then be disclosed, copied, or acted upon.

Content

No source excerpt is available for this finding.