ClawHub
Back to skill

Security audit

Teamgram Server Architecture

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only Teamgram architecture skill, but its deployment guide includes copyable production examples with weak credentials and exposed internal services.

Install only if you will treat the deployment snippets as architecture notes, not production-ready manifests. Before using them, replace all example credentials, use Kubernetes Secrets or an external secrets manager, remove public mappings for internal services, pin container images by version or digest, use least-privileged database accounts, and configure backups to a bucket you own with encryption and access controls.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
references/deployment.md:15
Finding

Default and Plaintext Credentials in Deployment Examples

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
references/deployment.md:37
Finding

Internal Infrastructure Services Exposed Without Authentication or Transport Encryption

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
references/deployment.md:49
Finding

Mutable Container Image Tags Permit Unreviewed Dependency Replacement

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/deployment.md:418
Finding

MySQL Root Password Expanded into Backup Process Arguments

Content
View full analysis
/backup/teamgram-$(date +%Y%m%d).sql.gz aws s3 cp /backup/teamgram-*.sql.gz s3://teamgram-backups/ ``` ### Technical Analysis The shell expands `$MYSQL_ROOT_PASSWORD` into the `mysqldump` command line. Command-line arguments may be observable through process listings, container runtime inspection, debugging tools, monitoring agents, crash diagnostics, or audit telemetry. The exposed credential is the MySQL root password rather than a narrowly scoped backup credential. Consequently, disclosure grants significantly more access than the backup task requires. Although the Kubernetes Secret supplies the value to the environment, that protection is weakened when the value is expanded into a process argument. ### Attack Path 1. The scheduled backup job starts and the shell expands `MYSQL_ROOT_PASSWORD`. 2. The expanded password becomes part of the `mysqldump` process command line. 3. A user, process, monitoring component, or compromised sidecar with process-inspection access records or reads the command line. 4. The observer extracts the root password. 5. The attacker connects to MySQL from an accessible workload or network path. 6. The attacker uses root-level database privileges to read, modify, delete, or export Teamgram data. ### Impact Assessment A disclosed MySQL root credential may provide: - Full control of the Teamgram database server. - Access to all schemas and records available to the root account. - Modification or deletion of messages, user records, authentication data, and application state. - Creation of additional database users or persistence through database configuration. - Service-wide availability impact through d ...[truncated 46 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.

md
mysql:
    image: mysql:8.0
    environment:
      # ⚠️ 生产环境：使用强密码，通过 .env 文件或 secrets 注入
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-changeme}
      MYSQL_DATABASE: teamgram
    volumes:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/deployment.md (reported line 17)May include surrounding context.

md
mysql:
    image: mysql:8.0
    environment:
      # ⚠️ 生产环境：使用强密码，通过 .env 文件或 secrets 注入
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-changeme}
      MYSQL_DATABASE: teamgram
    volumes:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description says 'Use when designing service topology, implementing MTProto services, or self-hosting Teamgram,' which describes broad situations rather than specific invocation triggers. It does not define narrower trigger phrases, scope limits, or negative examples, so the skill could match loosely related architecture or backend discussions unintentionally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The safety notice and several explanatory phrases are presented in Chinese, but the file does not state that the skill is Chinese-language only or give users a language choice. This can violate language/locale policy when users are not explicitly opting into that language.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The Docker Compose example exposes internal infrastructure services and includes insecure defaults despite later hardening advice, creating a realistic risk that operators will deploy the sample as-is. Exposed etcd, Kafka, MinIO, and related services can leak data, enable unauthorized access, or allow hostile reconfiguration of core backend components.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The example includes default MinIO credentials and publicly exposed service ports without an immediate, prominent warning that using the manifest unchanged in production is unsafe. This can lead to trivial unauthorized access to object storage and administrative consoles, especially in self-hosted environments where examples are often copied directly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The Kubernetes ConfigMap stores a database credential in plaintext configuration, which is broadly readable within many cluster workflows and often ends up in logs, Git, or deployment tooling. Even if this is illustrative, placing secrets in ConfigMaps normalizes an unsafe pattern for operators deploying MTProto backend infrastructure.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/deployment.md (reported line 398)May include surrounding context.

mysqldump -h mysql -u root -p teamgram > backup-$(date +%Y%m%d).sql

Upload to S3

aws s3 cp backup-*.sql s3://teamgram-backups/mysql/

text

### Kubernetes CronJob

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/deployment.md (reported line 424)May include surrounding context.

mysqldump -h mysql -u root -p teamgram > backup-$(date +%Y%m%d).sql

Upload to S3

aws s3 cp backup-*.sql s3://teamgram-backups/mysql/

text

### Kubernetes CronJob

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation embeds a concrete MySQL credential string (user:password@...) in a configuration example without any warning that secrets must not be hardcoded or committed. In an architecture/development guide, this pattern can normalize insecure secret handling and lead users to copy the example into real deployments, exposing credentials in source control, configs, logs, or build artifacts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

Several critical safety comments are written only in Chinese while the surrounding deployment guide is in English. This can prevent some users from understanding important security guidance, creating a language-policy issue because the file effectively forces a specific language for essential instructions without offering a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The guide is primarily written in English, but embedded code comments switch to Chinese (加载配置，失败则退出, 创建服务上下文, 创建gRPC服务器) with no indication that the skill or documentation is intentionally locale-specific. This can violate language policy when a specific language is imposed without user opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.