ClawHub
Back to skill

Security audit

Ospf Analysis

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a read-only OSPF diagnostic guide, but it includes a disruptive OSPF reset recommendation despite being labeled read-only.

Review before installing in an agent that may execute commands. The skill is suitable as a diagnostic reference, but do not let it automatically run or recommend `clear ospf process` under a read-only workflow; require explicit operator approval and a maintenance or emergency-change context for any OSPF reset.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:281
Finding

Disruptive OSPF Reset Contradicts the Declared Read-Only Safety Boundary

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:281
Vulnerability Type: Read-only safety-boundary violation through a state-changing network command
Risk Level: Medium

Complete Code Snippet:

text
├── State: 2-Way (expected on broadcast for DROther↔DROther)
│   ├── Both routers DROther? → Normal — Full only with DR/BDR
│   ├── DR/BDR election stuck? → Check priority values, verify DR is up
│   └── Unexpected? → Force DR election: clear ospf process (disruptive)

The conflicting read-only declaration appears in SKILL.md:13:

yaml
openclaw: '{"emoji":"🔍","safetyTier":"read-only","requires":{"bins":["ssh"],"env":[]},"tags":["ospf","routing","protocol"],"mcpDependencies":[],"egressEndpoints":[]}'

Technical Analysis

The Skill is declared as read-only and states that read-only router privileges are sufficient. However, its troubleshooting decision tree recommends clear ospf process, explicitly acknowledging that the operation is disruptive.

Clearing an OSPF process is an administrative, state-changing operation rather than a diagnostic query. It can tear down neighbor adjacencies, discard or rebuild protocol state, and trigger LSDB synchronization and SPF recalculation. Consequently, this instruction crosses the Skill's declared safety boundary.

This is not evidence of malicious behavior, privilege escalation, or command injection. It is an insecure operational instruction because an agent or operator may trust the read-only classification and execute the recommendation without applying controls appropriate to a network-changing command.

Attack Path

  1. An agent loads the Skill under the assumption that all recommended operations are read-only.
  2. During adjacency diagnosis, the agent observes an unexpected OSPF neighbor in the 2-Way state.
  3. The agent follows the decision tree at SKILL.md:281.
  4. It executes the vendor-equivalent clear ospf process command throu ...[truncated 1270 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove clear ospf process from the read-only diagnostic workflow and replace it with passive checks, including:
    • Neighbor and interface detail inspection.
    • DR/BDR role and priority verification.
    • OSPF event-log review.
    • Timer, area, authentication, subnet, and network-type comparison.
  2. If process reset guidance is operationally necessary, move it into a separate write-enabled remediation Skill that is not labeled read-only.
  3. Require explicit operator confirmation immediately before any state-changing command.
  4. Clearly state the target device, OSPF instance, expected adjacency impact, routing-domain role, and estimated blast radius.
  5. Require a maintenance window or emergency change authorization, along with out-of-band access and a rollback or recovery plan.
  6. Add a prominent warning that resetting the process can interrupt production traffic and should not be used merely to force a DR election without first validating the underlying configuration.
  7. Add automated policy validation that rejects configuration-changing or operational-clear commands in Skills carrying the read-only safety tier.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill recommends "Force DR election: clear ospf process" in a troubleshooting path, but the only explicit warning about disruption appears later in the document rather than at the point of action. An operator or agent following the decision tree mechanically could execute a control-plane reset that tears down adjacencies and temporarily withdraws routes, causing avoidable outage or instability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown reference states that all commands are read-only at L004-L005, but L098 includes show configuration protocols ospf area [id] and show running-config \| section ospf \| include stub, which expose device configuration details. While not destructive, configuration disclosure can affect privacy or system integrity expectations, and the document provides no warning that some commands reveal potentially sensitive configuration data.

Content

No source excerpt is available for this finding.