ClawHub
Back to skill

Security audit

Config Management

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent network configuration guidance, but it recommends exporting sensitive device configurations over plaintext TFTP/FTP without adequate warning or egress disclosure.

Install only if operators understand it is read-write network device guidance. Prefer SCP or local encrypted storage for archives, avoid TFTP/FTP except on isolated management networks with explicit risk acceptance, and require human review before any rollback, config replace, or save operation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:110
Finding

Plaintext Export of Sensitive Network Device Configurations via TFTP

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:51, 110-115; corroborated by references/cli-reference.md:33-36
Vulnerability Type: Plaintext transmission of sensitive configuration data
Risk Level: High

Vulnerable Code Snippet

From SKILL.md:

text
- For archival: reachable SCP/TFTP/FTP server or local flash storage
text
### Step 3: Config Archival

⚠️ **WRITE** — Back up the current configuration with timestamped naming.

**[Cisco]**

copy running-config tftp://[server]/[hostname]-YYYYMMDD-HHMM.cfg

text

Corroborating command from references/cli-reference.md:

text
| ⚠️ Copy to TFTP | `copy running-config tftp://[server]/[file]` | `request system configuration save [path]` | `copy running-config tftp://[server]/[file]` |

Technical Analysis

The primary archival procedure instructs operators or agents to export the complete running configuration through TFTP. TFTP does not provide transport encryption, endpoint authentication, or meaningful integrity protection. The prerequisites also list FTP, another plaintext protocol, without requiring a protected management network or warning about interception.

Device configurations can contain password hashes, SNMP community strings, authentication-server settings, management addresses, ACL definitions, routing relationships, and detailed network topology. Transmitting these files through an unauthenticated plaintext protocol allows an attacker with access to the transfer path to observe the data. Because TFTP does not authenticate the destination server, network redirection or server spoofing may also cause an archive to be delivered to an attacker-controlled endpoint.

The documentation mentions hash verification after archival, but a post-transfer hash comparison only detects corruption. It does not preserve confidentiality and does not prevent an attacker from retaining a captured copy.

Attack Path

  1. An ...[truncated 1562 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove TFTP and FTP from the recommended archival procedures and make SCP or another encrypted, authenticated transfer mechanism the default.
  2. Require destination host-key verification or equivalent server authentication to prevent endpoint spoofing.
  3. Restrict archival destinations through an explicit allowlist and management-plane ACLs.
  4. Store archives encrypted at rest with strict role-based access controls, audit logging, and defined retention policies.
  5. Where possible, redact reusable secrets or use configuration formats that do not expose reversible credentials.
  6. Continue performing integrity verification, but use a cryptographically secure hash and recognize that this supplements rather than replaces encryption and authentication.
  7. If a legacy device makes TFTP unavoidable, require an isolated management network, a dedicated tightly restricted server, a short transfer window, immediate encrypted relocation, and documented risk acceptance.
  8. Update the Skill metadata to represent approved operator-supplied archival endpoints rather than declaring an empty egress endpoint set while documenting remote exports.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.