fabric-aiops

• Outcome: Review
• Latest audit: Oct 15, 2026 · 9:49 AM UTC
• Version: 0.14.0

Overview

The skill is openly built for network-fabric operations, but it can change live network controllers without an internal read-only mode or approval gate.

Install only if you intend to let an agent inspect or potentially change network-controller state. Prefer read-only controller credentials first, set the least privilege account possible, avoid storing the master password in broadly visible environments, relocate or protect ~/.fabric-aiops on shared machines, and do not enable write-capable credentials until you are comfortable with agent-driven operations and audit/undo limits.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (21)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-reference.md (reported line 11)May include surrounding context.

bash

fabric-aiops init                      # interactive onboarding wizard (platform: meraki/catalyst/cvp/unifi)
fabric-aiops doctor [--skip-auth]      # config + secret store + connectivity (canonical org/site/container probe)
fabric-aiops mcp                       # start the MCP server (stdio transport)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/setup-guide.md (reported line 153)May include surrounding context.

bash

fabric-aiops init                      # interactive onboarding wizard (platform: meraki/catalyst/cvp/unifi)
fabric-aiops doctor [--skip-auth]      # config + secret store + connectivity (canonical org/site/container probe)
fabric-aiops mcp                       # start the MCP server (stdio transport)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-reference.md (reported line 21)May include surrounding context.

fabric-aiops secret set [--value ] # store API key (hidden prompt if no --value) fabric-aiops secret list # names only — values never shown fabric-aiops secret rm fabric-aiops secret migrate # import legacy plaintext .env (FABRIC__APIKEY) fabric-aiops secret rotate-password # re-encrypt under a new master password

text

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes the skill as operating against Meraki, Catalyst Center/DNA Center, Arista CVP, and UniFi, with no mention of Cisco ACI. This guide adds a full ACI setup/authentication section and named ACI commands, indicating the skill claims or exposes an additional platform capability outside the declared manifest behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill explicitly describes persistent local storage for sensitive operational state, including encrypted secrets in ~/.fabric-aiops/secrets.enc and audited write history in ~/.fabric-aiops/. Even if secrets are encrypted, persistent credential material and session-adjacent state on disk increase the blast radius of local compromise, especially on shared hosts or CI runners, and the legacy plaintext environment-variable fallback further weakens the model.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

- Bash
metadata: {"openclaw":{"requires":{"anyBins":["fabric-aiops","uvx"]},"optional":{"env":["FABRIC_AIOPS_CONFIG","FABRIC_AIOPS_MASTER_PASSWORD"]},"homepage":"https://github.com/AIops-tools/Fabric-AIops","emoji":"🛰️","os":["macos","linux"]}}
compatibility: >
  Standalone, self-governed network-fabric controller operations. The governance harness (audit, policy, token/runaway budget, undo, risk-tiers) is bundled in the package — no external skill-family dependency. Multi-platform by construction (a platform registry): meraki (Cisco Meraki Dashboard, reference platform, full read+write), catalyst (Cisco Catalyst Center, read subset — sites stand in for organizations/networks), cvp (Arista CloudVision Portal, read subset — containers stand in for organizations/networks), and unifi (UniFi Network controller / UniFi OS console, read subset — sites stand in for organizations/networks — plus the device-restart write via a cmd/devmgr command envelope). Unmapped ops raise a teaching "not supported on <platform> yet" error; all writes are Meraki-only except UniFi device restart.
  All write operations are audited to a local SQLite DB under ~/.fabric-aiops/ (relocatable via FABRIC_AIOPS_HOME).
  Credentials: the controller secret (Meraki API key / Catalyst Center username:password / CVP service-account token / UniFi API key) is stored ENCRYPTED in ~/.fabric-aiops/secrets.enc (Fernet/AES-128 + scrypt-derived key) — never plaintext on disk. Run 'fabric-aiops init' to onboard, or 'fabric-aiops secret set <target>' to add one. The store is unlocked by a master password from FABRIC_AIOPS_MASTER_PASSWORD (non-interactive/MCP/CI) or an interactive prompt (CLI on a TTY). A legacy plaintext env var FABRIC_<TARGET_NAME_UPPER>_APIKEY is still honoured as a fallback with a deprecation warning (migrate with 'fabric-aiops secret migrate'). Meraki/CVP/UniFi secrets ride the platform auth header (Authorization: Bearer, X-Cisco-Meraki-API-Key, or UniFi's X-API-KEY) at request time; the Cat
...[truncated 25 chars]

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest description at L009-L013 scopes the skill to Meraki, Catalyst Center, CloudVision, and UniFi, and says to use it for those controller-managed fabrics. However, the body of SKILL.md expands actual functionality to a fifth platform, Cisco ACI/APIC, with dedicated read operations such as endpoint trace, EPG segment inspection, and fabric faults. This is a semantic mismatch between the declared scope and the documented behavior of the skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The documentation states there is no read-only switch, policy file, or approval gate, and that permission decisions are left to the agent's judgment or the connected account. In a skill with built-in write operations against network controllers, lack of an internal authorization/approval control materially increases the risk of accidental or prompt-induced destructive changes, because audit and double-confirmation are not equivalent to policy enforcement.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

md

## Governance & Safety

The skill delivers reads and writes and records them; it does **not** decide
whether a write is permitted. That is your agent's judgement, or the permission
of the account you connect it with (a Meraki API key whose admin has read-only
organization access — writes then fail at the controller). There is no read-only
switch, policy file, or approval gate.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document explicitly states the tool does not gate writes, has no read-only switch, and offers no approval prompt, which conflicts with the skill's claimed governance harness. In a network-controller skill with write operations against production infrastructure, this can enable unauthorized or accidental destructive actions if an over-privileged token is configured or the model is manipulated into issuing writes.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The text normalizes autonomous write behavior by stating there is no approval prompt and that authorization is external to the tool. For a skill capable of rebooting devices, changing VLANs, claiming/removing devices, and binding templates on live controller-managed networks, lack of built-in human approval materially increases the risk of unsafe autonomous actions from prompt injection, model error, or operator misunderstanding.

Content

Scanner excerpt · references/agent-guardrails.md (reported line 15)May include surrounding context.

md

## Authorization is not this tool's job — decide it where it belongs

Whether a write should happen is your decision, or the account's. The tool does
not gate it — there is no read-only switch and no approval prompt to configure.
The two right places to control read vs write:

- **The account you connect with.** Give it a Meraki API key whose admin has

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes supported controllers as Meraki, Catalyst Center/DNA Center, CloudVision/CVP, and UniFi, with no mention of Cisco ACI. This document states that tool outputs and ranked reads also apply 'on ACI' and later provides extensive ACI-specific operating guidance, indicating actual skill behavior/documented capabilities beyond the declared manifest scope.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/cli-reference.md (reported line 11)May include surrounding context.

bash

fabric-aiops init                      # interactive onboarding wizard (platform: meraki/catalyst/cvp/unifi)
fabric-aiops doctor [--skip-auth]      # config + secret store + connectivity (canonical org/site/container probe)
fabric-aiops mcp                       # start the MCP server (stdio transport)

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/setup-guide.md (reported line 153)May include surrounding context.

bash

fabric-aiops init                      # interactive onboarding wizard (platform: meraki/catalyst/cvp/unifi)
fabric-aiops doctor [--skip-auth]      # config + secret store + connectivity (canonical org/site/container probe)
fabric-aiops mcp                       # start the MCP server (stdio transport)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The CLI reference exposes Cisco ACI commands even though the declared skill scope does not include ACI support. This creates a dangerous scope mismatch: users or downstream agents may invoke undocumented/ungoverned functionality outside the skill’s stated trust boundary, bypassing expected validation, governance, or testing assumptions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/setup-guide.md (reported line 20)May include surrounding context.

md

**Organization → Settings → API access → Generate API key**. Copy the key.
fabric-aiops sends it as `Authorization: Bearer <key>` (or, with
`auth_style: meraki-key`, `X-Cisco-Meraki-API-Key`) against the Dashboard API
base `https://api.meraki.com/api/v1`.

**Cisco Catalyst Center (`platform: catalyst`)** — use a Catalyst Center
account (a read-only role suffices for the current read subset) and store the

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Lines L070-L072 state the onboarding wizard asks for platform values limited to meraki, catalyst, cvp, and unifi. Earlier, L049-L062 documents platform: aci and ACI-specific commands, so the file’s own documentation gives conflicting statements about supported platforms.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/setup-guide.md (reported line 80)May include surrounding context.

md

platform: meraki
    org_id: "123456"            # default organization id (optional)
    verify_ssl: true
    # base_url: https://api.meraki.eu/api/v1   # override only for a region/proxy
    # auth_style: meraki-key                    # use X-Cisco-Meraki-API-Key instead of Bearer
  - name: campus
    platform: catalyst

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide recommends exporting the master password as a plaintext environment variable for unattended use without warning that environment variables may be exposed through shell history, process inspection, CI logs, crash dumps, or inherited child processes. Because this password unlocks the encrypted secrets store, disclosure can compromise all stored controller credentials.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup-guide.md (reported line 113)May include surrounding context.

md

/ CVP service-account token / UniFi API key) is **never** written to disk in plaintext. It lives only in
  `~/.fabric-aiops/secrets.enc`, encrypted with Fernet (AES-128-CBC + HMAC),
  the key derived from your master password via scrypt. Only a per-store random
  salt and the ciphertext are on disk (chmod 600); the master password itself is
  never stored.
- A legacy plaintext env var `FABRIC_<TARGET_NAME_UPPER>_APIKEY` is still honoured
  as a fallback with a deprecation warning — migrate with `fabric-aiops secret

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup-guide.md (reported line 124)May include surrounding context.

md

## Audit-annotation env vars (optional)

The skill does not decide whether a write is permitted — that is the agent's
judgement or the connecting controller account's role. If you want the audit
trail to record *who* ran a destructive op and *why*, set these; they are
recorded on the row, never required, and gate nothing:

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

L036 claims '37 MCP tools over five platforms', but the detailed 'What This Skill Does' table at L056-L067 sums to 38 tools, and the summary at L005 says '37 tools'. This is an internal documentation contradiction about the actual exposed capability count, which can mislead reviewers about the skill's surface area.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The introduction claims that guardrails moved into the harness are guarantees. However, the table later narrows destructive-operation confirmation to 'at the CLI,' which implies the guarantee does not uniformly apply across all invocation paths despite the earlier broad statement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.