ClawHub
Back to skill

Security audit

Locron

Security checks for vulnerabilities and agentic risk

Overview

This skill is a scoped Locron scheduler helper that emphasizes dry-runs, explicit user authorization, and careful handling of dashboard tokens and persisted jobs.

Install this only if you want an agent to manage Locron jobs and dashboard state. Review proposed job targets carefully because scheduled commands and HTTP requests can have real side effects, and require explicit confirmation before service changes, token rotation, plaintext value import/export, or real job execution.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Content
- Inspect `dashboard status --format json` before changing its service registration. Report registration, loaded state, URL, and token-file posture without retrieving or exposing the token.
- Run foreground `dashboard` or `dashboard serve` only when the user asks to start an interactive local session. Return its exact printed loopback URL and keep the process lifecycle explicit.
- Treat `dashboard enable`, `dashboard disable`, and `dashboard enable --reset` as service mutations without dry-run. Require current authorization, inspect status first, and read status back afterward. `--reset` rotates the access token and invalidates existing dashboard sessions; never add it merely to repair or restart the service.
- Run `dashboard token` only when the user explicitly needs the secret for local authentication. Do not place the token in URLs, command logs, durable notes, or messages to third parties, and do not claim that `dashboard status` reveals it.

## Diagnose and explain
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.