Security audit

Nebius AI Cloud

Security checks for vulnerabilities and agentic risk

Overview

This Nebius cloud skill is mostly coherent with its purpose, but it grants and normalizes high-impact cloud deployment authority with several unsafe defaults users should review before installation.

Install only if you intend this agent to manage Nebius cloud resources. Require explicit confirmation before any create/update/delete operation, avoid the curl-to-bash installer unless you independently verify it, pin container images and plugins to trusted versions or digests, keep endpoints private or authenticated, do not expose dashboards directly over plaintext public links, verify SSH host keys, and handle IAM or API tokens through a secret manager rather than chat, shell history, or persistent environment variables.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:68
Finding: Unverified Remote Installer Is Downloaded and Executed Directly
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: llms.txt:36
Finding: Mutable and Inconsistent Third-Party Artifacts Create a Supply-Chain Execution Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: examples/deploy-serverless-endpoint.md:57
Finding: Public Agent Dashboards Are Deployed Without Platform Authentication and Use Plaintext Transport
Content: View full analysis
:18789/#token=${WEB_PASSWORD}&gatewayUrl=ws://:18789 ``` The endpoint reference repeats the same pattern: ```bash nebius ai endpoint create \ --name "" \ --image "" \ --platform cpu-e2 \ --container-port 8080 \ --container-port 18789 \ --env "TOKEN_FACTORY_API_KEY=" \ --env "TOKEN_FACTORY_URL=" \ --env "INFERENCE_MODEL=" \ --env "OPENCLAW_WEB_PASSWORD=${WEB_PASSWORD}" \ --public # Dashboard URL: http://:18789/#token=${WEB_PASSWORD}&gatewayUrl=ws://:18789 ``` ### Technical Analysis The CPU deployment creates a public endpoint but does not enable the Nebius platform-level controls shown in the GPU example: ```bash --auth token --token "" ``` Instead, it relies solely on application-level password handling and advertises direct access through plaintext `http://` and `ws://`. A URL fragment is not included in the HTTP request itself, but the browser application subsequently uses the token to authenticate over the configured plaintext WebSocket connection. Without TLS, application traffic and cre ...[truncated 1271 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: examples/deploy-openclaw.md:61
Finding: SSH Host Authentication Is Explicitly Disabled
Content: View full analysis
:18789 nebius@ ``` The Skill also disables verification while executing a privileged remote container command: ```bash ssh -o StrictHostKeyChecking=no nebius@ \ "sudo docker exec \$(sudo docker ps -q | head -1) \ env OPENCLAW_GATEWAY_TOKEN=$PASSWORD openclaw devices approve --latest" ``` ### Technical Analysis `StrictHostKeyChecking=no` instructs SSH to accept an unverified server identity. SSH encryption remains active, but it is established with whichever server answers the connection. This removes the protection that prevents an attacker from impersonating the newly provisioned endpoint. The risk is heightened when the command creates a tunnel to an administrative dashboard or sends a gateway token as part of a remote command. Host-key verification is not incompatible with cloud deployment; the expected fingerprint can be obtained through a trusted control plane, console, provisioning output, or separately validated channel. ### Attack Path 1. The user connects to the endpoint for the first time using the documented command. 2. An attacker intercepts traffic or redirects the target IP through a compromised network path. 3. Because strict checking is disabled, the client accepts the attacker's host key. 4. The tunnel terminates at the attacker-controlled system, or the privileged remote command and gateway token are delivered to that system. 5. The attacker presents a fake dashboard, captures credentials, or uses the token against the legitimate endpoint. ### Impact Assessment An attacker may obtain: - The OpenClaw gateway token transmitted in the remot ...[truncated 292 chars]
Remediation: View remediation
endpoint_known_hosts # Compare its fingerprint against the trusted control-plane value before use. ssh -o UserKnownHostsFile=endpoint_known_hosts \ -o StrictHostKeyChecking=yes \ nebius@"$PUBLIC_IP" ``` 4. Use separate `known_hosts` files for ephemeral cloud instances to avoid weakening global SSH policy. 5. Never transmit gateway secrets until the remote host identity has been verified. 6. If Nebius CLI SSH performs trusted host verification, prefer it and document its verification behavior. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: examples/deploy-gpu-vm.md:51
Finding: VM Templates Grant Root-Equivalent Privileges and Recommend Internet-Wide SSH Access
Content: View full analysis
/tmp/setup-done ``` The networking reference recommends global SSH ingress: ```bash nebius vpc security-rule create \ --parent-id \ --direction ingress \ --protocol tcp \ --port 22 \ --cidr "0.0.0.0/0" \ --format json ``` ### Technical Analysis The configured user has two independent root-equivalent privilege paths: 1. `sudo: ALL=(ALL) NOPASSWD:ALL` permits any command to run as root without further authentication. 2. Membership in the `docker` group permits mounting the host filesystem or launching a privileged container, which normally provides an effective route to root. The SSH rule allows every Internet address to reach port 22. This substantially expands exposure to brute-force attempts, credential theft campaigns, SSH implementation vulnerabilities, and attacks against accidentally enabled authentication methods. Reading a `.pub` file and placing that public key in `ssh_authorized_keys` is legitimate for VM provisioning and does not disclose private-key material. Enabling Docker at startup is also consistent with the stated GPU-container workload. The excessive risk arises from unrestricted sudo, Docker root equivalence, and global ingress. ### Attack Path 1. The Agent creates a VM using the supplied cloud-init template and a public IP. 2. SSH is exposed to `0.0. ...[truncated 827 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:305
Finding: Sensitive Tokens Are Exposed Through Command Arguments, Environment State, Output, and Raw Configuration
Content: View full analysis
--format json \ | jq -r '.data[0].string_value' ``` Secrets are printed and passed through CLI arguments: ```bash PASSWORD=$(openssl rand -hex 16) echo "Dashboard password: $PASSWORD" nebius ai endpoint create \ --env "TOKEN_FACTORY_API_KEY={user's key}" \ --env "OPENCLAW_WEB_PASSWORD=$PASSWORD" \ --public ``` The gateway token is embedded in a remote command: ```bash ssh -o StrictHostKeyChecking=no nebius@ \ "sudo docker exec \$(sudo docker ps -q | head -1) \ env OPENCLAW_GATEWAY_TOKEN=$PASSWORD openclaw devices approve --latest" ``` A persistent process environment is used for an API key: ```bash launchctl setenv NEBIUS_API_KEY "v1.YOUR_KEY_HERE" ``` The Skill also directs users to bypass redaction: ```text Config secrets are redacted: openclaw config get gateway.auth.token returns __OPENCLAW_REDACTED__. Read raw JSON: cat ~/.openclaw/openclaw.json ``` ### Technical Analysis Secrets included in command arguments or expanded remote command strings can be exposed through shell history, process inspection, command tracing, CI logs, terminal capture, and Agent transcripts. Printing generated credentials creates an additional logging and shoulder-surfing risk. Environment variables are commonly inherited by child processes and may remain available to process inspectors or diagnostic tools. `launchctl setenv` makes the API key available to subsequently launched pr ...[truncated 1404 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (85)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README explicitly states the skill auto-triggers for broad deployment and infrastructure requests, making it likely to activate on ambiguous user intent. In an agent setting, this can cause unintended cloud actions, resource creation, and cost-incurring changes without sufficiently explicit provider or execution confirmation.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The installation command fetches a remote script and pipes it directly into bash, executing unverified code from the network. If the hosting endpoint, connection, or script supply chain is compromised, this yields immediate arbitrary code execution on the user's machine or CI runner.
Content: Scanner excerpt · README.md (reported line 56)May include surrounding context.

Nebius CLI installed and authenticated:
bash
# Install curl -sSL https://storage.eu-north1.nebius.cloud/cli/install.sh | bash exec -l $SHELL # Authenticate (interactive — requires browser)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The shell pipeline | bash enables direct execution of remotely retrieved content and is a classic chaining pattern that amplifies supply-chain and command-injection risk. In the context of a skill README that users or agents may follow automatically, this is especially dangerous because it normalizes immediate execution without verification.
Content: Scanner excerpt · README.md (reported line 56)May include surrounding context.

Nebius CLI installed and authenticated:
bash
# Install curl -sSL https://storage.eu-north1.nebius.cloud/cli/install.sh | bash exec -l $SHELL # Authenticate (interactive — requires browser)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The usage examples reinforce that generic phrases like 'Deploy my app' or 'I need a GPU' will trigger this skill by default. Because this is a cloud-provisioning skill, over-broad activation materially increases the chance of unintended infrastructure operations and billable resource creation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This is a clear description-behavior mismatch. The description frames the skill as the default executor for Nebius cloud deployment and infrastructure operations. However, the actual code is only a local pre-flight diagnostic script for the Nebius CLI environment. It verifies installation, config presence, authentication, active profile, project ID, connectivity, and optional tooling. Those checks are related to Nebius usage, but they are preparatory/supporting behavior rather than the declared primary purpose of performing cloud deployment or infrastructure tasks. The resource access is limited to local shell environment, user config files, and lightweight CLI/API checks; it does not provision, modify, or manage Nebius infrastructure.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: This is the same dangerous curl ... | bash pattern in the main setup instructions, making remote code execution part of the primary onboarding path. Because this skill is intended for deployment/admin tasks, operators are likely to run it on privileged workstations or cloud hosts, which raises the impact substantially.
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
Step 1. Install the Nebius CLI

bash
curl -sSL https://storage.eu-north1.nebius.cloud/cli/install.sh | bash exec -l $SHELL # reload shell so 'nebius' is on PATH nebius version # confirm installation

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The skill instructs the user to obtain and export an IAM access token into the environment for headless use. In agent-mediated or logged environments, environment variables, shell history, debug output, and transcripts can expose these credentials and enable unauthorized cloud access.
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
If your token expires later, re-authenticate by re-running `nebius profile create` (reopens browser login). ### Step 3. Get your IAM access token For **non-interactive / headless environments** (CI/CD, containers, Claude Code on the web), the user must provide their IAM token. They can obtain it on their local machine:

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The skill reads the user's local SSH public key from ~/.ssh/id_ed25519.pub and injects it into a remote resource creation command. Even though this is a public key, accessing user credential material from the local environment without explicit consent is sensitive, and normalizes agent access to authentication artifacts that may later extend to private keys or other secrets.
Content: Scanner excerpt · SKILL.md (reported line 330)May include surrounding context.
--env "INFERENCE_MODEL=$MODEL"
--env "OPENCLAW_WEB_PASSWORD=$PASSWORD"
--public
--ssh-key "$(cat ~/.ssh/id_ed25519.pub 2>/dev/null || echo '')"
--format json

text

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The documented install command fetches a remote script over the network and pipes it directly to bash, with no integrity verification, pinning, or out-of-band validation. If the remote endpoint or transport path were compromised, this would enable arbitrary code execution on the operator's machine.
Content: Scanner excerpt · SKILL.md (reported line 562)May include surrounding context.
md
| Problem | Solution | |---|---| | `nebius: command not found` | Install: `curl -sSL https://storage.eu-north1.nebius.cloud/cli/install.sh \| bash && exec -l $SHELL` | | `UNAUTHENTICATED` (exit code 7) | Re-run `nebius profile create` (user auth) or check service account key | | `PERMISSION_DENIED` (exit code 15) | Check IAM group membership. User needs `editors` group. | | `NOT_FOUND` (exit code 13) | Verify resource ID and that you're in the correct project/profile |

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: Piping a remote script directly from curl into bash executes unverified code from the network with no integrity check, review step, or signature validation. If the hosting bucket, transport path, or upstream script is compromised, users could run arbitrary code on their machine immediately during installation.
Content: Scanner excerpt · examples/deploy-openclaw.md (reported line 9)May include surrounding context.
1. Install the Nebius CLI and authenticate:

bash
curl -sSL https://storage.eu-north1.nebius.cloud/cli/install.sh | bash exec -l $SHELL nebius profile create # opens browser — log in with your Nebius account

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The | bash construct is the dangerous execution primitive that turns a remote fetch into immediate code execution, enabling chaining abuse if any part of the upstream content is malicious or altered. In an infrastructure/deployment skill, this is especially sensitive because users are likely to run the command from privileged developer environments containing cloud credentials.
Content: Scanner excerpt · examples/deploy-openclaw.md (reported line 9)May include surrounding context.
1. Install the Nebius CLI and authenticate:

bash
curl -sSL https://storage.eu-north1.nebius.cloud/cli/install.sh | bash exec -l $SHELL nebius profile create # opens browser — log in with your Nebius account

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/deploy-gpu-vm.md (reported line 19)May include surrounding context.
3. Confirm your SSH public key exists (this is the key the endpoint will accept):

bash
cat ~/.ssh/id_ed25519.pub || cat ~/.ssh/id_rsa.pub

If you don't have one: ssh-keygen -t ed25519

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/deploy-openclaw.md (reported line 18)May include surrounding context.
3. Confirm your SSH public key exists (this is the key the endpoint will accept):

bash
cat ~/.ssh/id_ed25519.pub || cat ~/.ssh/id_rsa.pub

If you don't have one: ssh-keygen -t ed25519

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/deploy-gpu-vm.md (reported line 19)May include surrounding context.
3. Confirm your SSH public key exists (this is the key the endpoint will accept):

bash
cat ~/.ssh/id_ed25519.pub || cat ~/.ssh/id_rsa.pub

If you don't have one: ssh-keygen -t ed25519

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/deploy-openclaw.md (reported line 18)May include surrounding context.
3. Confirm your SSH public key exists (this is the key the endpoint will accept):

bash
cat ~/.ssh/id_ed25519.pub || cat ~/.ssh/id_rsa.pub

If you don't have one: ssh-keygen -t ed25519

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/deploy-openclaw.md (reported line 41)May include surrounding context.
3. Confirm your SSH public key exists (this is the key the endpoint will accept):

bash
cat ~/.ssh/id_ed25519.pub || cat ~/.ssh/id_rsa.pub

If you don't have one: ssh-keygen -t ed25519

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · llms.txt (reported line 47)May include surrounding context.
text
**3. Confirm your SSH public key exists** (this is the key the endpoint will accept): ```bash cat ~/.ssh/id_ed25519.pub || cat ~/.ssh/id_rsa.pub ``` If you don't have one: `ssh-keygen -t ed25519`

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: Piping a remote script directly into bash executes unverified code from the network with the user's privileges, creating a supply-chain and remote code execution risk. If the hosting endpoint, transport, or upstream artifact is compromised, users can be silently infected during installation.
Content: Scanner excerpt · llms.txt (reported line 14)May include surrounding context.
text
Install the CLI, create a profile, and authenticate: ```bash curl -sSL https://storage.eu-north1.nebius.cloud/cli/install.sh | bash exec -l $SHELL nebius profile create # opens browser — log in with your Nebius account ```

Chaining Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The shell pipeline chains network retrieval directly into command execution, which is a classic abuse pattern because it removes any review boundary between untrusted content and code execution. In a skill meant for operational deployment, this is especially risky because users are likely to run it on privileged developer or CI environments.
Content: Scanner excerpt · llms.txt (reported line 14)May include surrounding context.
text
Install the CLI, create a profile, and authenticate: ```bash curl -sSL https://storage.eu-north1.nebius.cloud/cli/install.sh | bash exec -l $SHELL nebius profile create # opens browser — log in with your Nebius account ```

External Script Fetching

High

Category: Supply Chain
Confidence: 96% confidence
Finding: The troubleshooting section repeats the same insecure pattern of fetching and executing a remote installer in one step. Repetition in multiple places increases the chance that users will copy-paste it without scrutiny, compounding supply-chain risk.
Content: Scanner excerpt · llms.txt (reported line 120)May include surrounding context.
text
| Error | Fix | |---|---| | `nebius: command not found` | `curl -sSL https://storage.eu-north1.nebius.cloud/cli/install.sh \| bash && exec -l $SHELL` | | `UNAUTHENTICATED` (exit 7) | Re-run `nebius profile create` (user auth) or check service account key | | `PERMISSION_DENIED` (exit 15) | User needs `editors` group membership | | `RESOURCE_EXHAUSTED` (exit 24) | Public IP quota — delete unused endpoints |

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/api-reference.md (reported line 226)May include surrounding context.
// Option 2: Service account key file (production) import "github.com/nebius/gosdk/auth" creds := gosdk.ServiceAccountReader( auth.NewServiceAccountCredentialsFileParser(nil, "credentials.json"), ) sdk, err := gosdk.New(ctx, gosdk.WithCredentials(creds))

text

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/api-reference.md (reported line 322)May include surrounding context.
// Option 2: Service account key file (production) import "github.com/nebius/gosdk/auth" creds := gosdk.ServiceAccountReader( auth.NewServiceAccountCredentialsFileParser(nil, "credentials.json"), ) sdk, err := gosdk.New(ctx, gosdk.WithCredentials(creds))

text

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/api-reference.md (reported line 87)May include surrounding context.
nebius iam whoami --format json | jq -r '.user_profile.attributes.name'

NOT .identity.display_name — that field doesn't exist

Get current access token (valid 12 hours)

nebius iam get-access-token

text

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/iam-reference.md (reported line 21)May include surrounding context.
nebius iam whoami --format json | jq -r '.user_profile.attributes.name'

NOT .identity.display_name — that field doesn't exist

Get current access token (valid 12 hours)

nebius iam get-access-token

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/kubernetes-reference.md (reported line 53)May include surrounding context.
Get Cluster Credentials (kubectl access)

bash
# Generate kubeconfig for external access nebius mk8s cluster get-credentials \ --id <CLUSTER_ID> \ --external

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

SkillSpector

Vague Triggers

External Script Fetching

Chaining Abuse

Vague Triggers

Tp4

Chaining Abuse

Step 1. Install the Nebius CLI

Credential Access

Credential Access

External Script Fetching

External Script Fetching

Chaining Abuse

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

External Script Fetching

Chaining Abuse

External Script Fetching

Credential Access

Credential Access

Credential Access

NOT .identity.display_name — that field doesn't exist

Get current access token (valid 12 hours)

Credential Access

NOT .identity.display_name — that field doesn't exist

Get current access token (valid 12 hours)

Credential Access

Get Cluster Credentials (kubectl access)

Static analysis