ClawHub
Back to skill

Security audit

Fortigate Firewall Audit

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only FortiGate audit skill whose access is purpose-aligned, though some listed operational commands are not as strictly passive as the read-only wording suggests.

Install only for authorized FortiGate reviews. Use a least-privilege read-only or diagnose-level account, confirm before running operational commands such as log filters, pings, diagnostic filters, or REST API exports, and avoid sharing collected configs or logs outside the audit scope.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/cli-reference.md (reported line 127)May include surrounding context.

md
- `diagnose sys sdwan health-check` shows real-time SLA measurements (latency, jitter, packet loss) for each health check on each member link. Compare against SLA targets to identify links in violation.
- `diagnose sys sdwan service` shows how SD-WAN rules are mapping traffic to members. Check whether rule priorities and tie-break settings match design intent.
- `diagnose firewall proute list` shows the policy routing table including SD-WAN-derived routes. Verify that SD-WAN steering does not bypass security inspection paths.

## High Availability

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file describes the commands as non-modifying audit commands safe for production use. Yet lines L155-L156 and L157 describe diagnose sys session filter ... and diagnose sys session filter clear, which alter the active diagnostic filter state even if they do not change persistent configuration.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

Lines L012-L014 state that all commands are read-only and that no execute commands are included. However, lines L178-L180 explicitly list execute log filter ... and execute log display, directly contradicting that documentation claim.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The introduction explicitly says no execute commands that alter state are included, but later the logging section recommends execute log filter ... and execute log display. Even if these are operationally low risk, the markdown does not warn that they are exceptions to the earlier read-only framing and may affect CLI session state or user expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document states that all commands are read-only and that no state-altering commands are included, but it lists config vdom, edit <vdom-name>, and config global, which are configuration-mode commands rather than purely read-only inspection commands. In a markdown skill/reference, this creates a missing-warning issue because users are told the command set is universally safe without disclosure that some entries change CLI context and could lead toward configuration actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest and prerequisites consistently describe a read-only FortiOS CLI audit using SSH and CLI/diagnose commands. The troubleshooting guidance expands the capability to REST API access, which is not part of the stated required tooling (bins: ["ssh"]) or the primary documented operating model for the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.