ClawHub
Back to skill

Security audit

AetherLang V3 for Claude Code

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed connector to an external AetherLang API, with no local persistence or hidden execution behavior found.

Install only if you are comfortable sending each submitted query and AetherLang flow to api.neurodoc.app. Do not use it with secrets, private files, system prompts, conversation history, or confidential business/personal data unless you have separately approved that third-party processing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (12)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

Example: Parse Response in Bash

bash
curl -s -X POST https://api.neurodoc.app/aetherlang/execute \
  -H "Content-Type: application/json" \
  -d '{"code":"flow Chef {\n  using target \"neuroaether\" version \">=0.2\";\n  input text query;\n  node Chef: chef cuisine=\"auto\";\n  output text recipe from Chef;\n}","query":"Carbonara recipe"}' \
  | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('result',{}).get('final_output','No output'))"

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The metadata declares an external endpoint and operator, which confirms that the skill is an API connector sending data outside the local environment. In security-sensitive agent contexts, this is a meaningful data-exfiltration surface even if intended functionality requires it.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
metadata:
  skill_type: api_connector
  external_endpoints:
    - https://api.neurodoc.app/aetherlang/execute
  operator_note: "api.neurodoc.app operated by NeuroDoc Pro (same as masterswarm.net), Hetzner DE"
  privacy_policy: https://masterswarm.net
license: MIT

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The API endpoint section instructs use of a third-party service, establishing that requests leave the host environment. This is not inherently malicious, but it is a true security-relevant behavior because user data is transmitted to an external processor.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

API Endpoint

text
POST https://api.neurodoc.app/aetherlang/execute
Content-Type: application/json

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This finding duplicates the same external POST behavior shown in the simple engine example. The risk is real because users may send sensitive queries to a third-party API while assuming the skill is just an internal Claude Code capability.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

1. Simple Engine Call

bash
curl -s -X POST https://api.neurodoc.app/aetherlang/execute \
  -H "Content-Type: application/json" \
  -d '{
    "code": "flow Chat {\n  using target \"neuroaether\" version \">=0.2\";\n  input text query;\n  node Engine: <ENGINE_TYPE> analysis=\"auto\";\n  output text result from Engine;\n}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This finding duplicates the same external POST behavior shown in the simple engine example. The risk is real because users may send sensitive queries to a third-party API while assuming the skill is just an internal Claude Code capability.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

1. Simple Engine Call

bash
curl -s -X POST https://api.neurodoc.app/aetherlang/execute \
  -H "Content-Type: application/json" \
  -d '{
    "code": "flow Chat {\n  using target \"neuroaether\" version \">=0.2\";\n  input text query;\n  node Engine: <ENGINE_TYPE> analysis=\"auto\";\n  output text result from Engine;\n}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The multi-engine pipeline example transmits user queries and workflow definitions to an external service, potentially amplifying exposure by encouraging richer, more detailed prompts. Because the skill targets strategy, research, and analysis, users may include confidential corporate or personal information.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

2. Multi-Engine Pipeline

bash
curl -s -X POST https://api.neurodoc.app/aetherlang/execute \
  -H "Content-Type: application/json" \
  -d '{
    "code": "flow Pipeline {\n  using target \"neuroaether\" version \">=0.2\";\n  input text query;\n  node Guard: guard mode=\"MODERATE\";\n  node Research: lab domain=\"business\";\n  node Strategy: apex analysis=\"strategic\";\n  Guard -> Research -> Strategy;\n  output text report from Strategy;\n}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This duplicate endpoint finding reflects the same remote call in the bash parsing example. The danger comes from normalizing external submission of arbitrary prompts with no built-in enforcement beyond advisory text.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

Example: Parse Response in Bash

bash
curl -s -X POST https://api.neurodoc.app/aetherlang/execute \
  -H "Content-Type: application/json" \
  -d '{"code":"flow Chef {\n  using target \"neuroaether\" version \">=0.2\";\n  input text query;\n  node Chef: chef cuisine=\"auto\";\n  output text recipe from Chef;\n}","query":"Carbonara recipe"}' \
  | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('result',{}).get('final_output','No output'))"

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This duplicate endpoint finding reflects the same remote call in the bash parsing example. The danger comes from normalizing external submission of arbitrary prompts with no built-in enforcement beyond advisory text.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

Example: Parse Response in Bash

bash
curl -s -X POST https://api.neurodoc.app/aetherlang/execute \
  -H "Content-Type: application/json" \
  -d '{"code":"flow Chef {\n  using target \"neuroaether\" version \">=0.2\";\n  input text query;\n  node Chef: chef cuisine=\"auto\";\n  output text recipe from Chef;\n}","query":"Carbonara recipe"}' \
  | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('result',{}).get('final_output','No output'))"

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This duplicate finding again confirms outbound transmission in the Python integration example. The skill context makes this more concerning because it is designed for domains that often involve proprietary strategy, research, and business planning data.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md
node E: {engine} analysis="auto";
  output text result from E;
}}'''
    r = requests.post("https://api.neurodoc.app/aetherlang/execute",
        json={"code": code, "query": query})
    return r.json().get("result", {}).get("final_output", "")

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This duplicate finding again confirms outbound transmission in the Python integration example. The skill context makes this more concerning because it is designed for domains that often involve proprietary strategy, research, and business planning data.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md
node E: {engine} analysis="auto";
  output text result from E;
}}'''
    r = requests.post("https://api.neurodoc.app/aetherlang/execute",
        json={"code": code, "query": query})
    return r.json().get("result", {}).get("final_output", "")

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This duplicate finding again confirms outbound transmission in the Python integration example. The skill context makes this more concerning because it is designed for domains that often involve proprietary strategy, research, and business planning data.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md
node E: {engine} analysis="auto";
  output text result from E;
}}'''
    r = requests.post("https://api.neurodoc.app/aetherlang/execute",
        json={"code": code, "query": query})
    return r.json().get("result", {}).get("final_output", "")

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly states that responses are in Greek, which constrains output language without user opt-in. This can cause usability, transparency, and policy-compliance issues, especially if users expect responses in another language or need to understand safety-critical output.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.