ClawHub
Back to skill

Security audit

olvm-aiops

Security checks for vulnerabilities and agentic risk

Overview

The documented behavior fits read-only virtualization troubleshooting, with disclosed credential storage and installation caveats.

Use a dedicated ReadOnlyAdmin account, retain TLS verification and protect the master password and local databases. Pin a reviewed package version: the supplied setup command is unpinned. All five bundled files were inspected, including the configuration-reference gap; external runtime code was unavailable, so its security guarantees could not be verified. Check audit health before relying on a complete activity trail.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The supplied commands install a plugin and inspect skill metadata; they do not connect to an engine or implement the advertised diagnostics or governance controls. Dependency setup can be a supporting implementation detail, but here it is the entire supplied behavior and includes an undeclared environment-changing operation. The installed plugin's functionality cannot be verified from this chunk.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-reference.md (reported line 14)May include surrounding context.

bash
olvm-aiops init                      # wizard: URL, username with profile, CA file, TLS, password
olvm-aiops doctor                    # config, encrypted store, login, engine product version
olvm-aiops doctor --skip-auth        # offline checks only
olvm-aiops mcp                       # run the MCP server over stdio

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-reference.md (reported line 75)May include surrounding context.

olvm-aiops secret list # names only olvm-aiops secret rm olvm-aiops secret rotate-password # re-encrypt under a new master password olvm-aiops secret migrate # import a legacy plaintext .env

text

## Environment variables

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md
## Troubleshooting

### "Config file not found"
Run `olvm-aiops init`, or create `~/.olvm-aiops/config.yaml` with a `targets` list.

### "No password for target '<name>'"
Store it with `olvm-aiops secret set <name>`.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/cli-reference.md (reported line 14)May include surrounding context.

bash
olvm-aiops init                      # wizard: URL, username with profile, CA file, TLS, password
olvm-aiops doctor                    # config, encrypted store, login, engine product version
olvm-aiops doctor --skip-auth        # offline checks only
olvm-aiops mcp                       # run the MCP server over stdio

MCP server referenced without pinned version: 'uvx --from olvm-aiops'.

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The uvx command does not constrain the package version, allowing fresh installations to execute a different release without an explicit configuration change or review. A compromised or malicious future release could run with the MCP process's local privileges and access supplied engine credentials; read-only engine functionality does not constrain malicious package code.

Content

No source excerpt is available for this finding.