ClawHub
Back to skill

Security audit

xcpng-aiops

Security checks for vulnerabilities and agentic risk

Overview

This skill manages virtual machines, but its MCP guidance can leave destructive actions without user confirmation.

Start with a dedicated read-only XO account. Before enabling MCP writes, require approval for the exact operation and target through your agent client; CLI confirmations do not protect MCP calls. Snapshot deletion and reversion cannot be undone. Configure xo_self_vm_uuid to protect the VM hosting XO, and test outside production first.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-reference.md (reported line 12)May include surrounding context.

bash
xcpng-aiops init                    # onboarding wizard: XO URL, TLS verify (default yes), encrypted token
xcpng-aiops doctor [--skip-auth]    # config + secret store + XO reachability + pool count
xcpng-aiops overview [-t xo1]       # one-shot fleet health summary (JSON)
xcpng-aiops mcp                     # start the MCP server (stdio)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-reference.md (reported line 83)May include surrounding context.

xcpng-aiops secret set [--value ] # omit --value to be prompted (hidden) xcpng-aiops secret list # names only xcpng-aiops secret rm xcpng-aiops secret migrate # import legacy plaintext .env xcpng-aiops secret rotate-password # re-encrypt under a new master password

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
//github.com/AIops-tools/XCPng-AIops","emoji":"🖥️","os":["macos","linux"]}}
compatibility: >
  Standalone, self-governed XCP-ng operations via Xen Orchestra's REST API /rest/v0. REQUIRES a Xen Orchestra instance (XO from sources or the Xen Orchestra Appliance, 5.x) — XO is the management plane; direct per-host XAPI access is out of scope for v0.1. The governance harness (audit, policy, token/runaway budget, undo, risk-tiers) is bundled in the package — no external skill-family dependency.
  All write operations are audited to a local SQLite DB under ~/.xcpng-aiops/ (relocatable via XCPNG_AIOPS_HOME).
  Credentials: Each XO target's personal authentication token is stored ENCRYPTED in ~/.xcpng-aiops/secrets.enc (Fernet/AES-128 + scrypt-derived key) — never plaintext on disk. Run 'xcpng-aiops init' to onboard, or 'xcpng-aiops secret set <target>' to add one (create the token in the XO UI: user menu → Personal tokens, or `xo-cli --createToken`). The store is unlocked by a master password

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
87% confidence
Finding

With a write-capable XO token, the documented MCP path exposes destructive operations without an independently enforced approval gate; account permissions limit capability but do not establish the user's authorization for each action. An erroneous or prompt-injected agent could therefore stop workloads or irreversibly revert/delete snapshots, while CLI-only confirmations and audit logging do not prevent those MCP actions. The recommendation to omit destructive-action confirmation instructions increases this risk, although read-only XO credentials mitigate it.

Content

Scanner excerpt · references/agent-guardrails.md (reported line 15)May include surrounding context.

md
## Authorization is not this tool's job — decide it where it belongs

Whether a write should happen is your decision, or the account's. The tool does
not gate it — there is no read-only switch and no approval prompt to configure.
The two right places to control read vs write:

- **The Xen Orchestra account whose token you connect with.** Give that XO user

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/cli-reference.md (reported line 12)May include surrounding context.

bash
xcpng-aiops init                    # onboarding wizard: XO URL, TLS verify (default yes), encrypted token
xcpng-aiops doctor [--skip-auth]    # config + secret store + XO reachability + pool count
xcpng-aiops overview [-t xo1]       # one-shot fleet health summary (JSON)
xcpng-aiops mcp                     # start the MCP server (stdio)

Static analysis

No suspicious patterns detected.