Security audit

fabric-aiops

Security checks across malware telemetry and agentic risk

Overview

This skill is for legitimate network administration, but it can make live infrastructure changes without an in-tool approval or read-only gate.

Install only in an environment where you are comfortable giving an agent access to network-controller credentials. Prefer read-only controller accounts by default, enable write-capable accounts only for planned maintenance, use dry-run previews, and protect ~/.fabric-aiops plus FABRIC_AIOPS_MASTER_PASSWORD as sensitive material.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill repeatedly markets a 'governance harness' with policy/risk controls, but later clarifies that it does not actually authorize or block writes and has no approval gate or read-only mode. In a skill capable of fabric-wide controller writes such wording can mislead operators or downstream agents into assuming enforcement exists, increasing the chance of unsafe or unauthorized changes.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The compatibility section says the bundled governance includes 'policy', while the Governance & Safety section later states there is no policy file or approval gate. This inconsistency creates a dangerous false sense of control around high-impact network changes, especially because the skill supports write actions such as reboot, claim/remove devices, VLAN updates, and template binding.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The document presents inconsistent safety guarantees: it says the tool does not gate writes and has no approval prompt, yet later claims destructive operations require preview and double confirmation at the CLI. In a high-impact network automation skill with reboot, device removal, and template binding writes, this ambiguity can cause operators or downstream agents to assume stronger write protections than actually exist in all execution paths, increasing the risk of unintended production changes.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The guide states these audit-annotation environment variables 'gate nothing,' but they still cause untrusted execution-environment data to be copied into persistent audit records. In agentic or CI environments, a caller that can influence env vars can inject misleading approver identities or rationales into the audit trail, undermining integrity and non-repudiation.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: ## Authorization is not this tool's job — decide it where it belongs Whether a write should happen is your decision, or the account's. The tool does not gate it — there is no read-only switch and no approval prompt to configure. The two right places to control read vs write: - **The account you connect with.** Give it a Meraki API key whose admin has
Confidence: 95% confidence
Finding: The guardrail text explicitly states there is no read-only switch and no approval prompt, meaning the tool can perform writes whenever the connected account permits them and the model chooses a write action. In this skill context, the available writes affect live network infrastructure, so autonomous or accidental model-initiated actions could reboot devices, alter VLANs, or change template bindings without an in-tool authorization checkpoint.

Session Persistence

Medium

Category: Rogue Agent
Content: - Bash metadata: {"openclaw":{"requires":{"env":["FABRIC_AIOPS_CONFIG"],"bins":["fabric-aiops"],"config":["~/.fabric-aiops/config.yaml","~/.fabric-aiops/secrets.enc"]},"optional":{"env":["FABRIC_AIOPS_MASTER_PASSWORD"]},"primaryEnv":"FABRIC_AIOPS_CONFIG","homepage":"https://github.com/AIops-tools/Fabric-AIops","emoji":"🛰️","os":["macos","linux"]}} compatibility: > Standalone, self-governed network-fabric controller operations. The governance harness (audit, policy, token/runaway budget, undo, risk-tiers) is bundled in the package — no external skill-family dependency. Multi-platform by construction (a platform registry): meraki (Cisco Meraki Dashboard, reference platform, full read+write), catalyst (Cisco Catalyst Center, read subset — sites stand in for organizations/networks), cvp (Arista CloudVision Portal, read subset — containers stand in for organizations/networks), and unifi (UniFi Network controller / UniFi OS console, read subset — sites stand in for organizations/networks — plus the device-restart write via a cmd/devmgr command envelope). Unmapped ops raise a teaching "not supported on <platform> yet" error; all writes are Meraki-only except UniFi device restart. All write operations are audited to a local SQLite DB under ~/.fabric-aiops/ (relocatable via FABRIC_AIOPS_HOME). Credentials: the controller secret (Meraki API key / Catalyst Center username:password / CVP service-account token / UniFi API key) is stored ENCRYPTED in ~/.fabric-aiops/secrets.enc (Fernet/AES-128 + scrypt-derived key) — never plaintext on disk. Run 'fabric-aiops init' to onboard, or 'fabric-aiops secret set <target>' to add one. The store is unlocked by a master password from FABRIC_AIOPS_MASTER_PASSWORD (non-interactive/MCP/CI) or an interactive prompt (CLI on a TTY). A legacy plaintext env var FABRIC_<TARGET_NAME_UPPER>_APIKEY is still honoured as a fallback with a deprecation warning (migrate with 'fabric-aiops secret migrate'). Meraki/CVP/UniFi secrets ride the platform a ...[truncated 25 chars]
Confidence: 86% confidence
Finding: The skill explicitly persists sensitive operational state locally: encrypted controller credentials in ~/.fabric-aiops/secrets.enc and audit/undo records in ~/.fabric-aiops/. Even if encrypted at rest, this is session persistence that can expose long-lived credentials or detailed network administration history to other local users, malware, backups, or misconfigured file permissions; the legacy plaintext environment-variable fallback further increases exposure risk.

Session Persistence

Medium

Category: Rogue Agent
Content: ## Governance & Safety The skill delivers reads and writes and records them; it does **not** decide whether a write is permitted. That is your agent's judgement, or the permission of the account you connect it with (a Meraki API key whose admin has read-only organization access — writes then fail at the controller). There is no read-only switch, policy file, or approval gate.
Confidence: 88% confidence
Finding: The Governance & Safety section confirms the system relies on persistent credentials/account permissions and local audit records rather than ephemeral, per-action authorization. In context, this means a process with access to the configured controller account can continue issuing powerful fabric writes across sessions, amplifying risk if the host or agent context is compromised.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/agent-guardrails.md:43