ClawHub
Back to skill

Security audit

volcengine-deploy

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Volcengine deployment helper that creates cloud resources and handles secrets only as part of the expected deployment workflow.

Install only if you want an agent to deploy to Volcengine and are comfortable granting it cloud-resource mutation authority. Review the generated resource plan carefully before approval, especially any managed dependencies, VKE StatefulSets, public endpoints, TOS artifact transfer, and where secrets will be stored.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The documentation explicitly authorizes the deploy skill to provision additional stateful services for unspecified dependencies by deploying arbitrary official Docker images as StatefulSets in VKE. That expands the skill from deploying the user's app into creating new infrastructure and persistent services, which can materially change cost, attack surface, and data-handling behavior without a narrowly bounded allowlist or separate user approval.

Context-Inappropriate Capability

Low
Confidence
80% confidence
Finding
The TOS section allows the deploy skill to create object-storage buckets and publish artifacts, which is adjacent to deployment but exceeds a narrowly scoped app-deploy function. Even as an optional path, it introduces extra cloud resources, artifact distribution, and possible data exposure risks if used without explicit consent and tight constraints.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs writing sensitive values such as DATABASE_URL and REDIS_URL into a plaintext .env file on the remote host. Even though the file is chmod 0600 and owned by appuser, this still creates a persistent secret-at-rest copy on the instance without an explicit warning, rotation guidance, or preference for a secret manager; compromise of the host, backups, logs, or later operational mistakes could expose credentials.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/ecs-deploy-steps.md:205