ClawHub
Back to skill

Security audit

AetherLang Chef V3

Security checks for vulnerabilities and agentic risk

Overview

This culinary skill is an external API connector, but its network use is disclosed, food-focused, and constrained to the user’s recipe query.

Install only if you are comfortable sending recipe or food-related questions to api.neurodoc.app. Do not include personal details, credentials, private files, medical information, or sensitive dietary/business data in prompts, and expect responses primarily in Greek.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This skill is an API connector that transmits user queries to a third-party endpoint, creating an inherent data exfiltration surface. Although the document includes minimization rules and disclosure text, any external transmission risks exposing sensitive user content if the agent sends more than the explicit food query or if users include personal data in the prompt.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
metadata:
  skill_type: api_connector
  external_endpoints:
    - https://api.neurodoc.app/aetherlang/execute
  operator_note: "api.neurodoc.app operated by NeuroDoc Pro (omnimusmind.com), Hetzner DE"
---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The markdown says 'Ask naturally about any food topic,' which is a very broad invocation description that overlaps with ordinary conversation and does not define when the skill should or should not activate. It also lacks negative examples or scope constraints that would reduce unintended invocation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The explicit POST instruction to api.neurodoc.app confirms operational dependence on an external service, which means user-supplied content leaves the local trust boundary. In this skill context the danger is somewhat reduced by clear safeguards and a narrow two-field schema, but the risk remains real because natural-language queries can still contain sensitive information and are sent to a third party.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

API Details

text
POST https://api.neurodoc.app/aetherlang/execute
Content-Type: application/json

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The language section states that the skill understands English queries but responds in Greek, which imposes a specific output language regardless of the user's language choice. This is a natural-language locale policy concern because no user opt-in or alternate language selection is offered.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill is an API connector that transmits user queries to a third-party endpoint, which creates a genuine data exposure boundary outside the local agent environment. Although the file discloses the endpoint and says confirmation is required, the privacy claims are unverifiable in the skill itself and users may still send sensitive dietary, business, or personal information to an external operator.

Content

Scanner excerpt · aetherlang-chef/SKILL.md (reported line 13)May include surrounding context.

md
metadata:
  skill_type: api_connector
  external_endpoints:
    - https://api.neurodoc.app/aetherlang/execute
  operator_note: "api.neurodoc.app operated by NeuroDoc Pro (same as masterswarm.net), Hetzner DE"
  privacy_policy: https://masterswarm.net
license: MIT

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The documented POST request to api.neurodoc.app confirms that user prompts are sent to an external service for processing, which is a real exfiltration surface even if intended functionality depends on it. In context, the danger is moderated by explicit disclosure and a stated confirmation requirement, but it remains risky because the skill cannot guarantee users won't include sensitive information in free-text food queries.

Content

Scanner excerpt · aetherlang-chef/SKILL.md (reported line 89)May include surrounding context.

API Details

text
POST https://api.neurodoc.app/aetherlang/execute
Content-Type: application/json

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly states that English queries will receive Greek responses, removing user choice and potentially causing misunderstanding of safety-critical cooking information such as temperatures, allergens, or process steps. While not an exploit in the classic sense, it is a real product-security and safety issue because users may act on instructions they cannot fully understand.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.