ClawHub
Back to skill

Security audit

Tonic System Deploy

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent deployment-workflow skill, but it should be reviewed because it describes scheduled automation that can deploy to production from status changes without a fresh approval gate for every live change.

Install only if you intend to use it as deployment process guidance. Before turning it into automation, require an explicit authorized approval immediately before every PROD deploy or rollback, separate status tracking from deploy authority, keep audit logs, enforce freeze checks, validate release artifacts, and localize notification templates for the operators who will receive them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| `submitted` | Both | Grey | Bug reported, awaiting review | Admin confirms/rejects |
| `confirmed` | Both | Blue | Valid bug, enters pipeline | T1 auto-process |
| `analyzing` | Both | Purple | AI analysis running (transient) | Auto → planned |
| `planned` | Both | Indigo | AI fix plan recorded | T1 auto-deploy |
| `deployed_uat` | Flow 1 | Cyan | UAT deployed, awaiting human validation | Admin approves PROD |
| `pending_prod` | Both | Yellow | Queued for PROD at next T2 | T2 auto-deploy |
| `deployed_prod` | Both | Green | PROD deployed | Flow1: done; Flow2: admin approves UAT merge |
Confidence
86% confidence
Finding
The workflow authorizes scheduled automatic deployment actions after earlier state transitions, including moving from planned/confirmed states into UAT or PROD deploy steps. In a deployment skill, autonomous execution is security-relevant because mistakes, poisoned inputs, or compromised state changes can push unreviewed code into live environments, increasing the risk of outages or unauthorized changes.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| `analyzing` | Both | Purple | AI analysis running (transient) | Auto → planned |
| `planned` | Both | Indigo | AI fix plan recorded | T1 auto-deploy |
| `deployed_uat` | Flow 1 | Cyan | UAT deployed, awaiting human validation | Admin approves PROD |
| `pending_prod` | Both | Yellow | Queued for PROD at next T2 | T2 auto-deploy |
| `deployed_prod` | Both | Green | PROD deployed | Flow1: done; Flow2: admin approves UAT merge |
| `pending_uat_merge` | Flow 2 | Purple | Queued for UAT merge at next T2 | T2 auto-merge |
| `uat_merged` | Flow 2 | Teal | UAT updated with PROD fix | Flow 2 complete ✅ |
Confidence
85% confidence
Finding
This status model includes automatic deploy or merge behavior at scheduled times for production-affecting changes. In this context, autonomous deployment is dangerous because it turns status fields into execution triggers; if approvals are mis-set, spoofed, or raced, the system can perform unintended PROD or UAT changes without a contemporaneous human check.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The Telegram notification templates are written entirely in Traditional Chinese, while the rest of the skill is in English, and the document does not state that the workflow is limited to Chinese-speaking operators or provide an opt-in language choice. This can violate language/locale policy because it imposes a specific output language on users and operators by default.

Static analysis

No suspicious patterns detected.