ClawHub
Back to skill

Security audit

truenas-aiops

Security checks across malware telemetry and agentic risk

Overview

This TrueNAS operations skill is clearly documented, but it can perform high-impact storage writes without an enforced read-only mode or approval gate.

Install only if you are comfortable giving the agent access to a TrueNAS API key. Use a least-privilege or read-only TrueNAS account by default, avoid long-lived master passwords in shell environments where possible, migrate any plaintext legacy .env keys, and enable write permissions only for sessions where snapshot deletion, dataset creation, scrubs, service restart, or undo operations are intentionally needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The guide explicitly recommends exporting the master password as an environment variable for unattended use, but does not warn that environment variables can be exposed through shell history, process inspection, inherited child environments, CI logs, or misconfigured service managers. Because this password unlocks the encrypted secret store, disclosure can lead to recovery of the TrueNAS API key and unauthorized access to the appliance.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Authorization is not this tool's job — decide it where it belongs

Whether a write should happen is your decision, or the account's. The tool does
not gate it — there is no read-only switch and no approval prompt to configure.
The two right places to control read vs write:

- **The account you connect with.** Scope the TrueNAS API key to a
Confidence
92% confidence
Finding
The guardrail document explicitly states that the tool does not enforce a read-only mode or approval prompt for writes, and instead relies on external account permissions or the caller's prompt. In an agent setting, prompt-level restrictions are not a strong security boundary, so a misaligned or compromised model could invoke destructive write tools such as snapshot deletion or service restart if the connected credentials allow it.

Credential Access

High
Category
Privilege Escalation
Content
truenas-aiops replication cloudsync
truenas-aiops secret set <target>                     # store API key encrypted
truenas-aiops secret list                             # names only
truenas-aiops secret migrate                          # import legacy plaintext .env
truenas-aiops secret rotate-password
truenas-aiops doctor
truenas-aiops mcp                                     # start MCP server (stdio)
Confidence
93% confidence
Finding
The documented support for importing legacy plaintext API keys from a .env source creates a real credential-exposure risk. Environment files are commonly overexposed through shell history, process environments, backups, CI logs, or accidental commits, and a migration path that normalizes their use can prolong insecure secret handling.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/agent-guardrails.md:43