ClawHub
Back to skill

Security audit

swap-setup

Security checks for vulnerabilities and agentic risk

Overview

This skill gives an agent temporary privileged SSH access to configure VPS swap, but the artifacts disclose that clearly, limit the scope, require consent, and include revocation steps.

Install only if you are comfortable granting the agent temporary SSH access with sudo/root capability to the VPS. Confirm the VPS owner authorizes the work, verify backups and validation are completed before rebooting, and remove the public SSH key from the VPS panel after the task finishes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (21)

Chaining Abuse

High
Category
Tool Misuse
Confidence
83% confidence
Finding

The pipeline echo ... | sudo tee -a /etc/fstab is a form of shell chaining that performs a privileged write to a boot-critical file. Even though the inserted string is constant here, this pattern is fragile, easy to reuse unsafely later, and can create duplicate or invalid entries that risk boot failure or broken mounts.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md
2. Kiểm tra đã có dòng `/swapfile` chưa (tránh trùng):
     `grep -nE '^[^#]*swap' /etc/fstab`
  3. Chỉ append nếu CHƯA có:
     `echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab`
  4. **VALIDATE trước khi reboot — BẮT BUỘC:**
     `sudo findmnt --verify --verbose` (hoặc `sudo mount -a` — lỗi thì DỪNG và khôi phục backup)
     `sudo swapon -a` để chắc chắn nạp lại không lỗi.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

  1. Kiểm tra swap đã bật ổn: swapon --show + free -m.
  2. Xóa cặp key dùng riêng khỏi máy agent:
    bash
    rm -f ~/.ssh/swap_setup_ed25519 ~/.ssh/swap_setup_ed25519.pub
  3. Hướng dẫn người dùng xóa key khỏi panel VPS (mục SSH Keys → Remove/Xóa key vừa thêm).
  4. Xác nhận lại swap vẫn chạy sau khi thu hồi (swap không phụ thuộc key).

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md
## Rolling back (nếu cần)

- Tắt swap: `sudo swapoff /swapfile` → xóa dòng trong fstab → `sudo rm /swapfile`.

## Bảo mật — BẮT BUỘC

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

text
- Kiểm tra quyền nâng cấp, **một lệnh riêng** (không ghép chuỗi):
  ```bash
  sudo -n true

(trả về 0 = có sudo; khác 0 = cần xử lý quyền.)

  • Distro: Ubuntu / Debian (chính). Với CentOS/RHEL/Alma/Rocky → cùng lệnh fallocate/dd + mkswap.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

text
- Kiểm tra quyền nâng cấp, **một lệnh riêng** (không ghép chuỗi):
  ```bash
  sudo -n true

(trả về 0 = có sudo; khác 0 = cần xử lý quyền.)

  • Distro: Ubuntu / Debian (chính). Với CentOS/RHEL/Alma/Rocky → cùng lệnh fallocate/dd + mkswap.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

text
- Kiểm tra quyền nâng cấp, **một lệnh riêng** (không ghép chuỗi):
  ```bash
  sudo -n true

(trả về 0 = có sudo; khác 0 = cần xử lý quyền.)

  • Distro: Ubuntu / Debian (chính). Với CentOS/RHEL/Alma/Rocky → cùng lệnh fallocate/dd + mkswap.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

text
- Kiểm tra quyền nâng cấp, **một lệnh riêng** (không ghép chuỗi):
  ```bash
  sudo -n true

(trả về 0 = có sudo; khác 0 = cần xử lý quyền.)

  • Distro: Ubuntu / Debian (chính). Với CentOS/RHEL/Alma/Rocky → cùng lệnh fallocate/dd + mkswap.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
# size tính bằng MB, ví dụ SWAP_MB=2048
sudo fallocate -l ${SWAP_MB}M /swapfile
# nếu fallocate lỗi mới dùng: sudo dd if=/dev/zero of=/swapfile bs=1M count=${SWAP_MB} status=progress
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
swapon --show

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md
# size tính bằng MB, ví dụ SWAP_MB=2048
sudo fallocate -l ${SWAP_MB}M /swapfile
# nếu fallocate lỗi mới dùng: sudo dd if=/dev/zero of=/swapfile bs=1M count=${SWAP_MB} status=progress
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
swapon --show

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md
# size tính bằng MB, ví dụ SWAP_MB=2048
sudo fallocate -l ${SWAP_MB}M /swapfile
# nếu fallocate lỗi mới dùng: sudo dd if=/dev/zero of=/swapfile bs=1M count=${SWAP_MB} status=progress
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
swapon --show

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md
# size tính bằng MB, ví dụ SWAP_MB=2048
sudo fallocate -l ${SWAP_MB}M /swapfile
# nếu fallocate lỗi mới dùng: sudo dd if=/dev/zero of=/swapfile bs=1M count=${SWAP_MB} status=progress
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
swapon --show

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
# size tính bằng MB, ví dụ SWAP_MB=2048
sudo fallocate -l ${SWAP_MB}M /swapfile
# nếu fallocate lỗi mới dùng: sudo dd if=/dev/zero of=/swapfile bs=1M count=${SWAP_MB} status=progress
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
swapon --show

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
# size tính bằng MB, ví dụ SWAP_MB=2048
sudo fallocate -l ${SWAP_MB}M /swapfile
# nếu fallocate lỗi mới dùng: sudo dd if=/dev/zero of=/swapfile bs=1M count=${SWAP_MB} status=progress
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
swapon --show

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
# size tính bằng MB, ví dụ SWAP_MB=2048
sudo fallocate -l ${SWAP_MB}M /swapfile
# nếu fallocate lỗi mới dùng: sudo dd if=/dev/zero of=/swapfile bs=1M count=${SWAP_MB} status=progress
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
swapon --show

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md
# size tính bằng MB, ví dụ SWAP_MB=2048
sudo fallocate -l ${SWAP_MB}M /swapfile
# nếu fallocate lỗi mới dùng: sudo dd if=/dev/zero of=/swapfile bs=1M count=${SWAP_MB} status=progress
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
swapon --show

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
# size tính bằng MB, ví dụ SWAP_MB=2048
sudo fallocate -l ${SWAP_MB}M /swapfile
# nếu fallocate lỗi mới dùng: sudo dd if=/dev/zero of=/swapfile bs=1M count=${SWAP_MB} status=progress
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
swapon --show

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Appending to /etc/fstab via a shell pipeline is risky because it modifies a boot-critical file and relies on a command pattern that is easy to get wrong or duplicate. Although the text says to check first, the append command itself is not idempotent and could leave the system unbootable or with broken swap configuration if executed in the wrong state.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md
2. Kiểm tra đã có dòng `/swapfile` chưa (tránh trùng):
     `grep -nE '^[^#]*swap' /etc/fstab`
  3. Chỉ append nếu CHƯA có:
     `echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab`
  4. **VALIDATE trước khi reboot — BẮT BUỘC:**
     `sudo findmnt --verify --verbose` (hoặc `sudo mount -a` — lỗi thì DỪNG và khôi phục backup)
     `sudo swapon -a` để chắc chắn nạp lại không lỗi.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill enables the agent to obtain temporary SSH access to a user's VPS with sudo/root privileges, but the user-facing description does not clearly and explicitly warn about the level of access being granted. This creates a consent and transparency problem: users may follow the workflow without fully understanding that they are authorizing privileged remote access capable of modifying the system beyond swap setup if the agent is compromised or behaves unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation instructs the agent to modify swap configuration and persist changes in /etc/fstab, but it does not warn that incorrect entries can cause boot problems, degraded performance, disk exhaustion, or service disruption. In this skill’s context, the agent is performing privileged remote administration on a VPS, so missing safety guidance materially increases the chance of harmful system changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The 'Khi nào dùng' section lists natural-language examples like 'thêm swap giúp' and 'cài swap cho VPS giúp em' without clarifying boundaries or negative examples. Although the task is somewhat domain-specific, the file does not explicitly define what should not trigger the skill or constrain invocation to a particular interface/context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The natural-language content forces a specific language for all users, which can violate language or locale policy when no opt-in or justification is provided. There is no indication that this skill is intended only for Vietnamese-speaking users or that alternate language support is available.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.