ClawHub
Back to skill

Security audit

iaiops-plcnext

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for PLCnext diagnostics, but its claimed read-only profile conflicts with listed export, publish, and historian-push capabilities.

Review this skill carefully before installing in an industrial environment. It may be appropriate for read-first PLCnext diagnostics, but the publisher should clarify or remove the export, publish, historian-push, report, and evidence-bundle capabilities from this read-only edition, or explicitly document their side effects and approval requirements.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest and description repeatedly claim this edition is read-only, but the documented tool list includes capabilities such as historian_push, export_data, stream_publish, uns_publish, stream_publish_event, and compliance_report/evidence bundle generation that can create outbound data flows or persistent side effects. In an industrial environment, misleading operators or higher-level agents about write/egress behavior undermines trust boundaries and may cause unintended data exfiltration, message publication, or stateful changes despite a declared read-only profile.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file contains the main operational instructions in Chinese, while the policy requires flagging language or locale constraints that are imposed without user choice. There is no visible note offering an English alternative, user language selection, or justification that the skill is region-specific.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The file repeatedly presents this edition as read-only, including the manifest and workflow text. Yet the same workflow section discusses write operations, approvals, undo values, and MOC procedures, which blurs whether this skill itself is strictly read-only or is expected to participate in write workflows. This is not merely incomplete documentation; it creates conflicting statements about operational intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.