Nerve Bridge Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:36 PM UTC
• Version: v1.0.0

Overview

The skill is not clearly malicious, but it can control Trae to run IDE instructions and uses a weak local feedback file, so it needs careful review before installation.

Install only if you intentionally want Codex to drive Trae through macOS Accessibility. Review the instruction text before sending it, avoid using it in sensitive repositories or active sessions, and treat the completion file as an unreliable signal unless the skill is changed to use per-run authenticated feedback and safer cleanup.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/nerve_bridge.py:66

Finding

Unauthenticated and Race-Prone Feedback Channel

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill clearly describes capabilities to inject clipboard contents into an IDE, execute commands indirectly through Trae, and write a feedback file, yet it declares no explicit permission or allowed-tools scope. That mismatch weakens user consent and policy enforcement, making it easier for the skill to perform system-affecting actions without transparent guardrails.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The skill establishes a persistence-like feedback mechanism by requiring generated code to write a status file under the user's home directory and then waiting on that file as an out-of-band signal. In context this is likely intended as synchronization, not stealth, but it still creates a durable control channel that could be repurposed to coordinate repeated or unauthorized actions across sessions.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

Example:

bash

python3 nerve_bridge.py "Create a new Python file and add a simple 'Hello World' function. After creating, add a print statement to test it."

How It Works

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill's workflow performs clipboard manipulation, GUI keystroke injection into Trae, and file creation for signaling, but the user-facing description does not prominently warn that it will control another application and alter local state. This is dangerous because users may invoke it expecting a passive helper, while it can actively execute instructions in an IDE context with whatever privileges that IDE/session has.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script silently deletes and recreates a file in the user's home directory as part of its control flow, without clear consent or integrity checks. This can overwrite expected state, enable spoofed completion signals via a predictable path, and create unsafe behavior if another local process manipulates the feedback file or path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script silently overwrites the clipboard and uses AppleScript/System Events to inject keystrokes into Trae, causing arbitrary instruction text plus appended hook code to be pasted and executed. In this skill's context, that is especially dangerous because the entire purpose is bi-directional remote control of an IDE, so unreviewed or attacker-supplied instructions could trigger code execution, file modification, or destructive actions on the host.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/nerve_bridge.py (reported line 42)May include surrounding context.

python

)

    # 3. Inject Signal (Send to Clipboard)
    p = subprocess.Popen(['pbcopy'], stdin=subprocess.PIPE)
    p.communicate(input=full_payload.encode('utf-8'))

    # 4. Fire Neural Pulse (AppleScript)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/nerve_bridge.py (reported line 60)May include surrounding context.

python

' key code 36\n'  # Enter
        'end tell'
    )
    subprocess.run(['osascript', '-e', script])

    print("➡️ [Send] Instruction sent. Waiting for Trae signal...")

Static analysis

No suspicious patterns detected.