T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:13- Finding
Misleading Read-Only Safety Classification for Stateful Evidence Collection
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:13-16, 29-32, 103-116, 137-147;references/cli-reference.md:20-34, 138-149
Vulnerability Type: Safety metadata and operational behavior mismatch
Risk Level: MediumThe Skill declares itself read-only:
yaml metadata: safety: read-only author: network-security-skills-suite version: "1.0.0" openclaw: '{"emoji":"🚨","safetyTier":"read-only","requires":{"bins":["ssh"],"env":[]},"tags":["incident","forensics","network"],"mcpDependencies":[],"egressEndpoints":[]}'It also makes the following behavioral claim:
text All commands are read-only. Containment verification confirms that previously applied controls are effective — it does not execute containment actions.However, the prescribed evidence-collection procedure starts capture processes and writes files to device storage:
text **1b. Active packet captures** (real-time — exists only while traffic flows): If the incident is active and the investigation requires payload-level evidence, initiate packet captures on relevant interfaces immediately. - **[Cisco]** — `monitor capture CAP1 interface <intf> both` then `monitor capture CAP1 start` — export with `monitor capture CAP1 export flash:evidence.pcap` - **[JunOS]** — `monitor traffic interface <intf> write-file /var/tmp/capture.pcap` - **[EOS]** — `bash tcpdump -i <intf> -w /mnt/flash/evidence.pcap -c 10000`The procedure additionally creates technical-support and configuration artifacts:
text **1e. Device configuration and comprehensive state:** Save the running configuration and full technical support output for each device in scope: - **[Cisco]** — `show tech-support | redirect flash:tech-<hostname>-<date>.txt` - **[JunOS]** — `request support information | save /var/tmp/tech-<hostname>-<date>.txt` - **[EOS]** — `show tech-support | redirect flash:tech-<hostname>-<date>.txt`T ...[truncated 3949 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the
read-onlysafety tier with a classification that explicitly permits stateful forensic collection and device-local file creation. - Separate the procedure into two clearly labeled modes:
- Passive inspection using commands that only display existing state.
- Authorized evidence collection that starts captures or writes files.
- Require explicit operator approval before starting packet capture, invoking a device shell, or writing evidence to device storage.
- Default to narrowly scoped capture filters instead of
match any. Require an approved interface, host or subnet filter, protocol filter, packet limit, duration limit, and maximum file size. - Add preflight checks for available storage, CPU utilization, device role, expected traffic rate, and capture-platform limitations.
- Define an emergency stop procedure and objective resource thresholds at which collection must be terminated.
- Require restrictive access controls for evidence files and transfer them through an approved encrypted channel to controlled evidence storage.
- Document retention and secure-cleanup requirements for copies left on device flash or temporary filesystems after hash verification and transfer.
- Warn that packet captures, running configurations, and support bundles may contain credentials, payload data, topology details, and security policy.
- Update the statement “All commands are read-only” to accurately distinguish containment verification from evidence-collection side effects.
- Replace the