ClawHub
Back to skill

Security audit

Komodo

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Komodo infrastructure helper, but it can send powerful credentials and perform destructive infrastructure actions without built-in safeguards.

Install only if you trust the Komodo endpoint and will use least-privilege API credentials. Treat all execute/write commands as production-impacting, especially stop, restart, deploy, run-procedure, create-stack, and delete-stack. Avoid using plaintext HTTP, do not point KOMODO_ADDRESS at untrusted hosts, and review any compose or env file before create-stack because its contents may be uploaded.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/komodo.py:54
Finding

Komodo credentials and deployment secrets can be transmitted to an insecure or untrusted endpoint

Content
View full analysis

Vulnerability Details

File Location: scripts/komodo.py:54-70; additional sensitive-file transmission at scripts/komodo.py:379-410
Vulnerability Type: Unrestricted transmission of authentication credentials and environment secrets
Risk Level: High

Vulnerable Code

python
KOMODO_ADDRESS = os.environ.get("KOMODO_ADDRESS", "").rstrip("/")
KOMODO_API_KEY = os.environ.get("KOMODO_API_KEY", "")
KOMODO_API_SECRET = os.environ.get("KOMODO_API_SECRET", "")


def api_call(endpoint: str, payload: dict | None = None, method: str = "POST") -> Any:
    """Make an API call to Komodo Core."""
    if not KOMODO_ADDRESS:
        print("Error: KOMODO_ADDRESS not set", file=sys.stderr)
        sys.exit(1)
    if not KOMODO_API_KEY or not KOMODO_API_SECRET:
        print("Error: KOMODO_API_KEY or KOMODO_API_SECRET not set", file=sys.stderr)
        sys.exit(1)

    url = f"{KOMODO_ADDRESS}/{endpoint}"
    headers = {
        "Content-Type": "application/json",
        "X-Api-Key": KOMODO_API_KEY,
        "X-Api-Secret": KOMODO_API_SECRET,
    }
    
    data = json.dumps(payload or {}).encode("utf-8")
    req = urllib.request.Request(url, data=data, headers=headers, method=method)
    
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            return json.loads(response.read().decode("utf-8"))

The create-stack operation also reads a caller-selected environment file and incorporates every parsed value into the network request:

python
def cmd_create_stack(name: str, server: str, compose_file: str, env_file: str | None = None):
    """Create a new stack from compose file."""
    # Read compose file
    try:
        with open(compose_file, "r") as f:
            compose_contents = f.read()
    except FileNotFoundError:
        print(f"Error: Compose file '{compose_file}' not found.")
        sys.exit(1)
    
    # Read env file if provide
...[truncated 4088 chars]
Remediation
View remediation

Remediation Suggestions

  1. Parse KOMODO_ADDRESS with urllib.parse.urlparse and reject every scheme except https.
  2. Require the hostname to match an explicit operator-configured allowlist or a securely stored expected Komodo Core origin.
  3. Reject URLs containing unexpected user information, fragments, or malformed host components.
  4. Disable automatic redirects for authenticated requests, or only follow redirects after verifying that the scheme, hostname, and port exactly match the original trusted origin.
  5. Never forward X-Api-Key or X-Api-Secret across an origin change.
  6. Validate TLS certificates using the system trust store and do not introduce certificate-verification bypasses.
  7. Before create-stack uploads an environment file, clearly display the destination host and request explicit confirmation.
  8. Support an allowlist of environment-variable names so only values required by the stack are transmitted.
  9. Prefer secret references managed by Komodo or an external secret manager instead of embedding plaintext secret values in the stack payload.
  10. Use a dedicated, least-privileged Komodo API identity and separate read-only credentials from credentials authorized for deployment or deletion.
  11. Replace credentials immediately if they may previously have been sent over HTTP or to an untrusted endpoint.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Tainted flow: 'req' from os.environ.get (line 83, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/komodo.py (reported line 86)May include surrounding context.

python
req = urllib.request.Request(url, data=data, headers=headers, method=method)
    
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            return json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        error_body = e.read().decode("utf-8")

Unvalidated Output Injection

High
Category
Output Handling
Confidence
100% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · scripts/komodo.py (reported line 443)May include surrounding context.

python
def cmd_delete_stack(name: str):
    """Delete a stack."""
    result = execute("DeleteStack", {"stack": name})
    print(f"Delete stack '{name}': {result}")


def cmd_stack_logs(name: str, service: str | None = None):

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill documents use of environment variables, file-sourced credentials, and direct network/API access, but declares no explicit tool scope or permission boundaries. In an agent setting, this increases the risk that the skill can access secrets and perform infrastructure actions without clear least-privilege constraints or operator visibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The credential setup instructions tell users to export API keys and secrets and optionally source them from a credentials file, but provide no warnings about redaction, shell history, log exposure, or secure storage. This can lead to inadvertent disclosure of high-privilege Komodo credentials, enabling unauthorized infrastructure access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill exposes destructive and state-changing infrastructure commands such as deploy, stop, restart, delete-stack, and run-procedure without any guidance for confirmation, authorization checks, or safe preconditions. In infrastructure contexts, accidental or coerced execution can cause downtime, service disruption, or destructive changes across production systems.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The skill includes direct external API calls that transmit authentication headers containing the Komodo API key and secret to a remote endpoint. While this is functionally required for the product, it is still a security-sensitive external transmission because misuse, endpoint tampering, or unsafe execution context could expose privileged credentials or trigger unauthorized actions.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash
# Read operation
curl -X POST "$KOMODO_ADDRESS/read/ListServers" \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: $KOMODO_API_KEY" \
  -H "X-Api-Secret: $KOMODO_API_SECRET" \

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The help text documents many commands but omits the destructive delete-stack capability that is actually implemented. In an agent skill context, incomplete operator-facing documentation can cause unsafe use, bypass review expectations, and make a destructive action less visible to users or wrappers that rely on the declared interface.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The delete-stack command performs an irreversible infrastructure action immediately with no confirmation prompt, dry-run, or force flag. In this skill's infrastructure-management context, accidental invocation or prompt/agent confusion could delete production resources, making the lack of safety interlocks materially dangerous.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.