ClawHub
Back to skill

Security audit

Interface Health

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a network diagnostic skill, but its read-only label is contradicted by included commands and recommendations that can change or disrupt network devices.

Review before installing. Use it for observation and reporting, but do not let an agent execute the counter-clearing, shutdown/no shutdown, or other remediation advice unless a human has approved the exact device, interface, timing, and rollback plan.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:405
Finding

Disruptive Interface Reset Guidance Conflicts with the Declared Read-Only Safety Tier

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:405-406
Related Safety Declarations: SKILL.md:12, SKILL.md:40
Vulnerability Type: Safety-boundary violation through state-changing network commands
Risk Level: Medium

Vulnerable Code Snippet

markdown
metadata:
  safety: read-only
markdown
- SSH or console access to the device (read-only privilege sufficient)
markdown
UDLD, link-flap detection). Recover with `shutdown` / `no shutdown` after
fixing the root cause.

Technical Analysis

The Skill declares itself read-only and states that read-only device privileges are sufficient. However, it instructs an operator or Agent to execute shutdown and no shutdown, which are configuration commands that administratively disable and re-enable a network interface.

These commands exceed the declared diagnostic scope and require configuration privileges. Administratively resetting an interface is operationally disruptive: it tears down the physical or logical link and can interrupt traffic, routing adjacencies, link aggregation, or downstream connectivity. Presenting this action inside a read-only Skill creates a misleading trust boundary in which an Agent may treat a disruptive remediation step as safe diagnostic behavior.

The commands do not independently obtain elevated privileges; exploitation requires an existing authenticated session with sufficient network-device authorization. The security issue is that the Skill encourages use of privileges beyond its advertised least-privilege requirements.

Attack Path

  1. An operator loads the Skill based on its read-only safety classification.
  2. The Agent connects to a network device through SSH or console access.
  3. An interface is diagnosed as error-disabled or down after a cable or transceiver replacement.
  4. The Agent follows the remediation guidance and enters interface configuration mode.
  5. The Agent execu ...[truncated 917 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove shutdown and no shutdown from the read-only diagnostic workflow.
  2. If remediation guidance must remain, place it in a clearly separated section labeled as privileged and disruptive.
  3. Require explicit, informed user confirmation immediately before any interface state change.
  4. Display the target device, interface name, interface description, current state, and expected blast radius before execution.
  5. Require configuration-mode authorization separately from read-only diagnostic access.
  6. Add safeguards that reject ambiguous, wildcard, uplink, trunk, management, port-channel, or out-of-band interfaces unless specifically approved.
  7. Provide a rollback and connectivity-validation procedure.
  8. Update the safety metadata and prerequisites if the Skill is intended to perform active remediation rather than remain read-only.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
references/cli-reference.md:28
Finding

Counter-Clearing Commands Can Destroy Diagnostic Evidence Despite the Read-Only Contract

Content
View full analysis

Vulnerability Details

File Location: references/cli-reference.md:28
Related Safety Declaration: SKILL.md:12
Vulnerability Type: Unauthorized mutation of network-device diagnostic state
Risk Level: Medium

Vulnerable Code Snippet

markdown
| Clear counters | `clear counters [intf]` | `clear counters interface [intf]` | `clear interfaces statistics [intf]` | `clear counters [intf]` |

Technical Analysis

The CLI reference supplies counter-clearing commands for Cisco IOS-XE, Cisco NX-OS, JunOS, and EOS even though the Skill is classified as read-only. Clearing interface counters changes device diagnostic state and destroys cumulative CLI evidence used for baseline comparisons, troubleshooting, monitoring validation, and incident investigation.

The main procedure already recommends taking two counter snapshots and calculating a delta. Therefore, clearing counters is unnecessary for the stated diagnostic purpose. Including these commands increases the chance that an Agent or operator will mutate production state while believing the Skill is operating read-only.

The commands do not grant additional privileges by themselves. They require an authenticated session authorized to clear statistics. The least-privilege failure arises because the Skill advertises read-only operation while documenting commands that require and exercise greater authority.

Attack Path

  1. An operator trusts the Skill's read-only safety declaration.
  2. The Agent opens the CLI reference while diagnosing interface errors.
  3. The Agent executes the vendor-specific clear counters or clear interfaces statistics command.
  4. Existing cumulative interface statistics are reset.
  5. Monitoring, troubleshooting, or incident-response personnel lose the prior counter baseline.
  6. Active or historical link degradation may become harder to identify, correlate, or attribute until counters accumulate again.

Impact Asses

...[truncated 749 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove all counter-clearing commands from the read-only reference.
  2. Use two timestamped counter snapshots and calculate deltas without resetting device state.
  3. If counter clearing is retained for exceptional workflows, label it explicitly as state-changing and privileged.
  4. Require explicit user confirmation and record the device, interface, operator, timestamp, and pre-clear values.
  5. Prevent use of commands that clear counters globally or against unresolved interface placeholders.
  6. Export or preserve relevant counter values before any approved reset.
  7. Separate active remediation commands into a different Skill with an appropriate safety tier and authorization model.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill is labeled read-only, but the troubleshooting section includes operational recovery guidance that moves beyond passive assessment into making changes on the device. In context, recommending state-changing remediation inside an assessment skill can cause an agent or operator to perform disruptive actions under the assumption the skill is non-invasive, increasing the chance of unintended outages.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guidance suggests recovering an interface with 'shutdown' / 'no shutdown', which is a service-impacting reset, without any warning, approval gate, or prerequisite validation. In a network automation or agent-assisted setting, this can trigger avoidable traffic interruption or flap a production link, especially because the skill otherwise presents itself as read-only diagnostic content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file documents clear counters / clear interfaces statistics commands, which modify device state by resetting diagnostic counters. While line L34 notes a technical limitation about SNMP and telemetry, the section does not clearly warn users that running these commands erases current troubleshooting evidence and can affect ongoing diagnostics.

Content

No source excerpt is available for this finding.