SONiC KVM Testbed

Deploy and manage a SONiC sonic-mgmt KVM virtual testbed with cEOS neighbors for running pytest-based network tests. Use when setting up a local KVM testbed,...

This instruction-only skill appears coherent for building a SONiC KVM testbed, but it recommends several insecure or high-privilege actions. Before using it: 1) Run the whole procedure inside an isolated VM or disposable host to avoid weakening a production machine. 2) Replace example passwords ('password', 'abc') and the practice of storing them in plaintext with stronger passwords and secure vaulting. 3) Avoid chmod 666 on /var/run/docker.sock — prefer adding the service account to the docker group or use limited sudo rules. 4) Prefer narrowly-scoped sudoers entries instead of NOPASSWD ALL. 5) Avoid sshpass/plaintext password files where possible; use SSH keys or an encrypted vault. 6) Verify any images/tarballs (cEOS, sonic-vs) come from trusted sources and confirm the github repo/PR mentioned is authentic. 7) Review and restrict any fix scripts (fix-configs.sh) before running; they modify ansible group_vars and can overwrite secrets. If you cannot run in an isolated environment, treat this skill as risky and consider manual, hardened steps instead.

Type: OpenClaw Skill Name: sonic-kvm-testbed Version: 1.2.0 The skill bundle is designed to deploy a complex virtual network testbed, which inherently requires significant system access. However, it contains several critical security vulnerabilities: it instructs the agent to create users with hardcoded passwords and passwordless sudo access on the virtual DUT, and most critically, to set the Docker socket to world-writable (`sudo chmod 666 /var/run/docker.sock`) on the DUT. This last action allows any user or process to gain root privileges via Docker. While these actions are plausibly intended for automation and convenience within an isolated testbed, they represent severe security anti-patterns and vulnerabilities (not malicious intent) that could be exploited, making the bundle suspicious. These issues are present across `SKILL.md`, `references/credentials.md`, and `references/troubleshooting.md`.