ClawHub
Back to skill

Security audit

ceph-aiops

Security checks across malware telemetry and agentic risk

Overview

The skill is openly designed for Ceph administration, but it exposes destructive storage operations without an enforceable built-in approval or read-only control.

Install only with a Ceph Dashboard account whose role matches what you want the agent to do. For observation or triage, use a read-only Dashboard account first. Do not connect this skill to a production-admin account unless you are comfortable with the agent being able to call destructive storage operations through the MCP tools.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Authorization is not this tool's job — decide it where it belongs

Whether a write should happen is your decision, or the account's. The tool does
not gate it — there is no read-only switch and no approval prompt to configure.
The two right places to control read vs write:

- **The account you connect with.** Give it a ceph-mgr Dashboard account with a
Confidence
92% confidence
Finding
The guardrail document explicitly states that the tool does not enforce read-only mode or require approval for writes, leaving destructive Ceph operations entirely to account permissions or the outer agent prompt. In an agentic setting, prompt-only restrictions are unreliable and can be bypassed by model error, prompt injection, or misconfiguration, which makes autonomous execution of destructive storage actions a real safety risk.

Session Persistence

Medium
Category
Rogue Agent
Content
## Governance & Safety

The skill delivers reads and writes and records them; it does **not** decide
whether a write is permitted. That is your agent's judgement, or the permission
of the account you connect it with (a ceph-mgr Dashboard account with a
read-only role — writes then fail at the mgr). There is no read-only switch,
policy file, or approval gate.
Confidence
96% confidence
Finding
The skill explicitly exposes state-changing operations and says it does not enforce whether a write is permitted, with no read-only switch, policy file, or approval gate. In an agent context, that means any prompt-routing mistake, tool misuse, or compromised orchestration layer could trigger destructive Ceph actions such as OSD purge, pool deletion, or replica-count changes against production infrastructure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/agent-guardrails.md:41