ClawHub
Back to skill

Security audit

cicd-aiops

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent for CI/CD operations, but it gives agents high-impact write access while its governance framing overstates what is actually enforced.

Use a read-only or least-privilege GitLab/Gitea token by default. Treat the audit log as visibility, not prevention, and require your own out-of-band approval before enabling write/admin scopes or deleting artifacts. Avoid storing the master password in synced or broadly readable MCP config files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The skill repeatedly markets a 'governance harness' and 'governed writes', but the safety section later clarifies there is no policy enforcement or approval gate and that write authorization is delegated entirely to the caller's token and judgement. This mismatch can cause operators or upstream agents to overtrust the skill as if it enforces approval controls when it only provides audit logging and UX safety features, increasing the chance of unauthorized or unsafe state-changing actions.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The manifest description implies a built-in governance mechanism for risky CI/CD operations, but later documentation states the skill does not decide whether writes are permitted. In an agent setting, such contradictory claims are dangerous because they can mislead orchestration layers or human operators into assuming destructive actions are constrained by policy when they are not.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The CLI reference contains contradictory governance guidance: artifact deletion is documented as requiring approval annotations, while the environment variable section says those annotations are optional and never required. In a CI/CD operations skill that performs destructive actions, this ambiguity can lead operators or implementers to bypass intended approval controls, weakening auditability and increasing the chance of unauthorized or insufficiently reviewed deletions.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The guide explicitly instructs users to place the master password in MCP client configuration as plaintext environment data, without warning that such configs may be readable by other local users, backups, logs, screenshots, or sync systems. Because this password decrypts the local encrypted secret store, disclosure can cascade into compromise of stored CI/CD access tokens and therefore the managed GitLab/Gitea environment.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Authorization is not this tool's job — decide it where it belongs

Whether a write should happen is your decision, or the account's. The tool does
not gate it — there is no read-only switch and no approval prompt to configure.
The two right places to control read vs write:

- **The token you connect with.** Give it a GitLab/Gitea access token without
Confidence
95% confidence
Finding
The guidance explicitly states there is no read-only switch and no approval prompt, placing all write-safety burden on token scoping and the outer agent prompt. In an agentic environment, prompt-level controls are not a reliable authorization boundary, so this design can enable unintended destructive CI/CD actions if a write-capable token is configured or the model is manipulated.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/agent-guardrails.md:93