ClawHub
Back to skill

Security audit

Acl Rule Analysis

Security checks for vulnerabilities and agentic risk

Overview

This firewall-audit skill is documentation-only, but it labels counter-reset commands as read-only even though they can change network device state and erase audit evidence.

Review before installing. The skill can be useful as a read-only ACL and firewall analysis checklist, but do not run any clear access-list or counter-reset commands unless you intentionally want to reset counters, have change approval, and have preserved the current hit-count evidence.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The document explicitly claims the listed commands are read-only and non-modifying, but it includes counter-clearing commands that alter device state. An operator relying on this reference could unintentionally reset ACL/firewall hit counters, corrupting audit baselines and impairing forensic or change-validation workflows.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The Cisco IOS section presents 'clear access-list counters' as a normal audit function despite it changing device operational state. In a security-analysis skill, that mislabeling increases the chance an agent or user executes a destructive preparatory step during what should be passive inspection.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The Cisco ASA section likewise includes a counter-clearing command under a document-wide claim of non-modifying behavior. This can lead to loss of usage telemetry and undermine the integrity of rule-hit analysis if a user trusts the reference and executes it without understanding the consequences.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The file mixes read-only and non-read-only commands while assuring users that all commands are non-modifying, and it provides no warning about the state-changing entries. In practice, this is unsafe documentation because it can mislead an automation agent or human operator into making unintended changes during a supposedly passive assessment.

Static analysis

No suspicious patterns detected.