ClawHub
Back to skill

Security audit

Aetherlang Karpathy Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed third-party API connector whose main risk is sending prompts and flow definitions to a hosted service, not hidden local access.

Install only if you are comfortable sending selected prompts and AetherLang flow code to NeuroDoc Pro's hosted API. Do not send secrets, credentials, private files, sensitive personal data, or private/internal URLs, and be cautious with the server-side memory feature because it can persist data across executions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
> **What this skill does:** Sends requests to the hosted AetherLang API
> (`api.neurodoc.app`). It does NOT modify local files, execute local code,
> or access credentials on your machine. All execution happens server-side.

Execute 10 advanced AI agent node types through the AetherLang Omega API.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
skill_type: api_connector
  operator_note: "AetherLang Omega is operated by NeuroDoc Pro (masterswarm.net), hosted on Hetzner EU. Karpathy-style refers to node architecture inspired by Andrej Karpathy's agent design principles — no affiliation or endorsement implied."
  external_endpoints:
    - https://api.neurodoc.app/aetherlang/execute
  domains_not_recommended:
    - medical advice
    - legal advice

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
skill_type: api_connector
  operator_note: "AetherLang Omega is operated by NeuroDoc Pro (masterswarm.net), hosted on Hetzner EU. Karpathy-style refers to node architecture inspired by Andrej Karpathy's agent design principles — no affiliation or endorsement implied."
  external_endpoints:
    - https://api.neurodoc.app/aetherlang/execute
  domains_not_recommended:
    - medical advice
    - legal advice

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This request format explicitly sends user query and flow code to a third-party service at api.neurodoc.app. Even though the file includes data-minimization guidance, the core skill behavior is external transmission, so misuse or misunderstanding could expose sensitive prompts or user data to an external operator.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Request Format

bash
curl -s -X POST https://api.neurodoc.app/aetherlang/execute \
  -H "Content-Type: application/json" \
  -d '{
    "code": "flow FlowName {\n  input text query;\n  node X: <type> <params>;\n  query -> X;\n  output text result from X;\n}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This request format explicitly sends user query and flow code to a third-party service at api.neurodoc.app. Even though the file includes data-minimization guidance, the core skill behavior is external transmission, so misuse or misunderstanding could expose sensitive prompts or user data to an external operator.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Request Format

bash
curl -s -X POST https://api.neurodoc.app/aetherlang/execute \
  -H "Content-Type: application/json" \
  -d '{
    "code": "flow FlowName {\n  input text query;\n  node X: <type> <params>;\n  query -> X;\n  output text result from X;\n}",

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill claims that the agent will ask for confirmation before calling non-example tool URLs, but the documentation provides no enforcement mechanism, policy gate, or implementation detail that would guarantee this behavior. Users may rely on a safety control that does not actually exist, which can lead to unintended outbound requests to arbitrary public endpoints and leakage of user-supplied data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The tool node permits outbound requests to user-specified public REST URLs, which creates an SSRF-like outbound fetch capability from the remote service. While restricted to public URLs in the documentation, there is no technical enforcement shown, so users may be able to trigger requests to unintended destinations or cause third-party data disclosure through crafted flows.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

calling any URL not in the examples below.

text
node T: tool url=https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd method=GET;

8. loop — Iterative Execution

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

text
flow CryptoAnalysis {
  input text query;
  node T: tool url=https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd method=GET;
  node X: transform mode=llm instruction=Summarize_price;
  node A: llm model=gpt-4o-mini;
  query -> T -> X -> A;

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

text
flow CryptoAnalysis {
  input text query;
  node T: tool url=https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd method=GET;
  node X: transform mode=llm instruction=Summarize_price;
  node A: llm model=gpt-4o-mini;
  query -> T -> X -> A;

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

text
flow CryptoAnalysis {
  input text query;
  node T: tool url=https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd method=GET;
  node X: transform mode=llm instruction=Summarize_price;
  node A: llm model=gpt-4o-mini;
  query -> T -> X -> A;

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

text
flow CryptoAnalysis {
  input text query;
  node T: tool url=https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd method=GET;
  node X: transform mode=llm instruction=Summarize_price;
  node A: llm model=gpt-4o-mini;
  query -> T -> X -> A;

Static analysis

No suspicious patterns detected.