ClawHub
Back to skill

Security audit

Network Aiops

Security checks across malware telemetry and agentic risk

Overview

This network-operations skill is high impact, but its artifacts clearly disclose device access, config writes, credential handling, audit state, dry-run support, and confirmation controls.

Install only if you intend to let an agent operate real network devices. Use read-only device accounts for inventory and backup tasks, reserve config-capable credentials for planned changes, review diffs before merge or replace, keep ~/.network-aiops and .env locked down, and configure policy or maintenance-window rules before using it on production infrastructure.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The capability file documents write operations that can directly modify or replace live network device configurations, including full config replacement, but it does not state any explicit requirement for user confirmation, approval gating, or interactive safety checks before execution. In a network-operations skill, this omission is dangerous because an agent could proceed from a natural-language request to disruptive configuration changes, causing outages, loss of management access, or rollback complexity across production infrastructure.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal