ClawHub
Back to skill

Security audit

firewall-aiops

Security checks across malware telemetry and agentic risk

Overview

The skill is transparent about its purpose, but it gives an agent live firewall write and reboot authority without an in-tool approval or read-only gate.

Install only with a least-privilege or read-only firewall API account unless you intentionally want the agent to make changes. For write use, keep console or out-of-band access available, require your own workflow approval before high-risk actions, and treat reboot, apply_changes, reconfigure, kill_states, and service restarts as live operational changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Authorization is not this tool's job — decide it where it belongs

Whether a write should happen is your decision, or the account's. The tool does
not gate it — there is no read-only switch and no approval prompt to configure.
The two right places to control read vs write:

- **The account you connect with.** Give the OPNsense/pfSense API user a
Confidence
96% confidence
Finding
The guardrail explicitly states that the tool does not enforce read-only mode or approval for write actions, leaving destructive firewall changes to model behavior, prompt instructions, or API account permissions. In this skill’s context, that is dangerous because the same toolset can toggle rules, restart services, kill states, apply changes, or reboot a live firewall, so a mis-prompted, compromised, or overly autonomous agent could make impactful network changes without an in-band authorization check.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/agent-guardrails.md:41