ClawHub
Back to skill

Security audit

olvm-aiops

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent read-only OLVM/oVirt diagnostics integration, with disclosed local credential and audit storage and no artifact evidence of hidden destructive or exfiltration behavior.

Before installing, confirm you trust the olvm-aiops package source, prefer a pinned reviewed version, connect with a read-only OLVM/oVirt account, keep ~/.olvm-aiops private, avoid plaintext legacy password environment variables, and do not disable TLS verification except for disposable lab engines.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
```bash
olvm-aiops init                      # wizard: URL, username with profile, CA file, TLS, password
olvm-aiops doctor                    # config, encrypted store, login, engine product version
olvm-aiops doctor --skip-auth        # offline checks only
olvm-aiops mcp                       # run the MCP server over stdio
```
Confidence
70% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High
Category
Privilege Escalation
Content
olvm-aiops secret list               # names only
olvm-aiops secret rm <target>
olvm-aiops secret rotate-password    # re-encrypt under a new master password
olvm-aiops secret migrate            # import a legacy plaintext .env
```

## Environment variables
Confidence
93% confidence
Finding
Referencing `secret migrate` from a legacy plaintext `.env` indicates the system accepts or normalizes credentials stored in an insecure format. Plaintext credential sources are commonly exposed through shell history, backups, repo commits, process environments, and weak file permissions, making credential theft materially easier in an infrastructure-management context.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest description says the skill is 'Read-only in this release,' which implies no state-changing behavior. However, the same file documents local writes for audit logging and encrypted secret storage via init/secret-management flows, so the actual behavior is not purely read-only even if engine-side operations are read-only.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The compatibility section states 'Writes: none in this release,' but nearby lines state that every call is audited to a local SQLite DB and that credentials are stored encrypted on disk. That is an active contradiction in the documentation: there may be no engine writes, but there are clearly local writes.

Session Persistence

Medium
Category
Rogue Agent
Content
## Troubleshooting

### "Config file not found"
Run `olvm-aiops init`, or create `~/.olvm-aiops/config.yaml` with a `targets` list.

### "No password for target '<name>'"
Store it with `olvm-aiops secret set <name>`.
Confidence
79% confidence
Finding
The skill intentionally persists operational configuration and encrypted credentials under the user's home directory, which creates a local secret-retention surface. If the host is multi-user, poorly secured, backed up broadly, or compromised, attackers may obtain engine target metadata and the encrypted secret blob, and legacy plaintext environment-variable fallback further increases exposure risk.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
The skill reads and records; it does **not** decide what an agent may change. That belongs to the engine account you connect it with — give it a read-only role and the engine itself refuses anything else.

- **Audit is the guarantee, and it is not bypassable.** Every call — MCP and CLI alike — is logged to `~/.olvm-aiops/audit.db` (relocatable via `OLVM_AIOPS_HOME`): params (secrets redacted), result, status, duration, and the risk tier.
- The engine password is stored **encrypted** in `~/.olvm-aiops/secrets.enc` (Fernet/AES-128 + scrypt key derivation; chmod 600); the master password is never stored. The SSO token is held only in memory and revoked when the connection closes.
- SSO session ids that the engine prints in login events are redacted before any event text is returned.
- **Budget / runaway guard** — a safety backstop, not authorization: caps cumulative tool calls and wall-time, and trips on tight polling loops.
- **Risk tier** is a descriptive label on the audit row derived from `risk_level`; it gates nothing.
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Unsafe Defaults

Medium
Category
Tool Misuse
Content
```bash
olvm-aiops init                      # wizard: URL, username with profile, CA file, TLS, password
olvm-aiops doctor                    # config, encrypted store, login, engine product version
olvm-aiops doctor --skip-auth        # offline checks only
olvm-aiops mcp                       # run the MCP server over stdio
```
Confidence
80% confidence
Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This markdown file documents `secret rm <target>` and `secret migrate` but does not explicitly warn that one deletes stored credentials and the other imports a legacy plaintext `.env` containing sensitive secrets. Because this is a markdown file, SQP-2 applies when descriptions omit warnings about behaviors affecting user data or privacy.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The setup guide instructs users to launch the MCP server with `uvx --from olvm-aiops olvm-aiops-mcp` without pinning an exact package version. This causes the client to resolve and execute whatever the latest published package is at install/run time, increasing supply-chain risk if a malicious or compromised release is published or if a breaking update changes security behavior.

Intent-Code Divergence

Low
Confidence
86% confidence
Finding
The statement 'Read-only in this release' is contradicted by other documented behaviors in the same file: init and secret set persist configuration and credentials locally, and every call writes audit records. The contradiction is softened because the intended meaning appears to be read-only against the engine, but the wording is still materially misleading.

Static analysis

No suspicious patterns detected.