ClawHub
Back to skill

Security audit

KlausNomi

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Nomi API command-line skill with normal API-key, network, room, avatar, and local-state behavior for its purpose, and I found no hidden or deceptive activity.

Install only if you are comfortable giving the skill access to your Nomi account through NOMI_API_KEY. Treat chats, profile data, room notes, and saved summaries as potentially sensitive, clear the local nomi/ directory when needed, and require explicit confirmation before room updates or deletions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Tainted flow: 'req' from os.environ.get (line 61, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
req = request.Request(url, data=body, headers=headers, method=method)

    try:
        with request.urlopen(req, timeout=_timeout_seconds()) as response:
            content = response.read()
            content_type = response.headers.get("Content-Type", "")
            return content, content_type
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The declared description suggests simple conversation functionality, but the documented commands also support metadata retrieval, avatar downloads, room management, local file persistence, and networked API operations. This mismatch can mislead users and security reviewers about the skill's real behavior, which is dangerous because broader capabilities may be invoked without informed consent or proper review.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill exposes capabilities that imply environment access, local file writes, and network use, but it does not declare an explicit tool scope such as permissions or allowed-tools. That makes the skill's effective authority less transparent to users and reviewers, increasing the risk of unintended data access or outbound communication when invoked.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill mentions that data may be kept in the local nomi/ directory between sessions, but it does not present this as a prominent user-facing warning in the description. Users may share sensitive conversation content or room notes without realizing that non-secret context can persist locally, creating privacy and retention risks on the host system.

External Transmission

Medium
Category
Data Exfiltration
Content
from typing import Any
from urllib import error, request

BASE_URL = "https://api.nomi.ai/v1"
DEFAULT_TIMEOUT_SECONDS = 120.0
AVATAR_OUTPUT_DIR = Path("nomi") / "avatars"
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The manifest description is narrowly framed around engaging in conversations with Nomi AI companions. The code goes beyond conversation by creating, updating, and deleting rooms, and elsewhere writes avatar images to disk, which are broader account/content management operations rather than just conversation.

Description-Behavior Mismatch

Low
Confidence
88% confidence
Finding
The `avatar` command fetches companion avatar content and saves it under a local directory. Downloading media and writing files is not implied by a description limited to engaging in conversations via a CLI.

Static analysis

No suspicious patterns detected.