ClawHub
Back to skill

Security audit

Milvus Skill

Security checks for vulnerabilities and agentic risk

Overview

This Milvus skill is coherent, but it includes high-impact database deletion and RBAC examples with weak guardrails that users should review before installing.

Install only if you intend the agent to help administer a Milvus database. Before using it on any shared, staging, or production environment, require explicit confirmation for drops, truncates, deletes, and RBAC changes; replace all example passwords with unique secret-managed values; and avoid wildcard privileges unless you deliberately want cluster-wide access.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
references/user-role.md:7
Finding

Predictable Hard-Coded Database Passwords in RBAC Examples

Content
View full analysis

Vulnerability Details

File Location: references/user-role.md, lines 7 and 16
Vulnerability Type: Hard-coded predictable credentials
Risk Level: Medium

Vulnerable Code

python
# Create a user
client.create_user(user_name="analyst", password="SecureP@ss123")
python
# Update password
client.update_password(
    user_name="analyst",
    old_password="SecureP@ss123",
    new_password="NewP@ss456"
)

Technical Analysis

The RBAC examples provide literal passwords that resemble usable credentials rather than unmistakable placeholders. Because this skill is intended to generate or guide executable Milvus administration code, an agent or operator may copy these examples without replacing the values.

Both passwords are publicly visible, predictable, and shared by every unchanged deployment. Password complexity formatting does not provide security when the complete value is published. If authentication is enabled and the example is used as written, anyone familiar with the skill can attempt to authenticate as analyst.

Attack Path

  1. An operator asks an agent using this skill to create or update a Milvus user.
  2. The agent reproduces the documented RBAC example without replacing its password literals.
  3. The Milvus account is created with SecureP@ss123, or its password is changed to NewP@ss456.
  4. An attacker identifies a reachable Milvus endpoint and attempts authentication using the published username and passwords.
  5. If authentication succeeds, the attacker receives all permissions assigned to the analyst account through direct role assignments or later privilege changes.

Exploitation requires the example to have been used unchanged and the attacker to have network access to the affected Milvus service.

Impact Assessment

Successful exploitation permits authentication as the affected Milvus user. The precise scope depends on roles granted to analyst. Possible access includes searching and querying stored ...[truncated 333 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace all literal passwords with unmistakable placeholders, such as <USER_PROVIDED_PASSWORD> and <CURRENT_PASSWORD>.
  • Instruct operators to generate a unique, cryptographically random password for every account.
  • Obtain sensitive values at runtime through protected input, a secret manager, or secured environment variables rather than embedding them in generated source code.
  • Do not print, log, commit, or persist plaintext passwords in agent transcripts or project files.
  • Grant the account only the minimum required Milvus privileges and avoid wildcard database or collection scope unless explicitly required.
  • Add an explicit warning that documentation credentials must never be used in development, staging, or production.
  • Rotate credentials immediately in any deployment where these examples were executed unchanged.

A safer example would be:

python
import getpass

password = getpass.getpass("Enter a unique password for the analyst user: ")
client.create_user(user_name="analyst", password=password)

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file advertises operations such as deleting vectors and managing partitions, databases, and RBAC, which can affect user data or system access. The description provides capabilities only and does not include any warning or caution about data loss, permission changes, or the need to verify targets before running such actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation includes a direct drop_database(db_name="my_database") example without any nearby warning, confirmation step, or emphasis that this operation is destructive and irreversible. In an agent skill context, examples are often reused verbatim by automated assistants or users, which increases the chance of accidental data loss if the snippet is suggested or executed in the wrong environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file includes direct deletion examples for records in a collection, but the surrounding documentation does not warn that these operations remove data and may be irreversible depending on backup or retention setup. Under the markdown-specific warning criteria, destructive behavior that can affect user data should be disclosed explicitly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.