ClawHub
Back to skill

Security audit

Nomad

Security checks for vulnerabilities and agentic risk

Overview

The skill is a simple Nomad CLI reference, but it includes commands that can reveal secrets from Nomad variables and logs without warning or scoping guidance.

Install only for users who understand their Nomad ACL scope. Use a least-privilege token, avoid retrieving variable values or raw logs unless needed, and redact secrets before sharing command output in chats, tickets, or transcripts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:118
Finding

Arbitrary Retrieval of Potentially Sensitive Nomad Variables

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:118-127
Vulnerability Type: Sensitive Data Access
Risk Level: Medium

Complete Code Snippet:

markdown
### Variables

List variables:
```bash
nomad var list

Get variable:

bash
nomad var get <path>
text

### Technical Analysis

The skill permits users or agents to enumerate Nomad variable paths with `nomad var list` and retrieve the contents of any ACL-accessible variable with `nomad var get <path>`. Nomad variables may contain credentials, access tokens, application configuration secrets, or other sensitive data.

Although these commands do not modify cluster state, arbitrary value retrieval extends beyond basic cluster-health monitoring. The documentation provides no path allowlist, output redaction, explicit confirmation requirement, or warning against retrieving secret-bearing variables. Consequently, sensitive values may be written to terminal output and incorporated into the agent's conversation context or logs.

### Attack Path

1. Load or invoke the Nomad skill in an environment containing a configured `NOMAD_ADDR` and an ACL token with variable-read permission.
2. Run `nomad var list` to enumerate accessible variable paths.
3. Identify a path likely to contain credentials or other sensitive configuration.
4. Run `nomad var get <path>`.
5. The Nomad CLI returns the variable contents, exposing them in command output and potentially in the agent transcript or execution logs.

### Impact Assessment

Exploitation does not itself grant permissions beyond those already associated with the configured Nomad token. However, it can disclose every Nomad variable readable by that token. Depending on the contents, this may expose application credentials, API tokens, or configuration secrets that enable access to other services. The practical scope is bounded by Nomad ACL policy, namespace and region settings, and the pri
...[truncated 28 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove arbitrary variable retrieval from this monitoring-focused skill unless it is essential to its documented purpose.
  • If retrieval is required, demand explicit user confirmation before reading a variable's value.
  • Restrict access to an allowlist of approved, non-secret variable paths.
  • Display variable metadata by default and require a separate, deliberate operation to reveal values.
  • Redact sensitive fields before returning output to the agent or storing it in transcripts and logs.
  • Use a dedicated least-privilege Nomad ACL token that denies variable-read capabilities by default.
  • Separate secret-management operations into a dedicated skill with stricter authorization, auditing, and output-handling controls.
  • Clearly document that Nomad variables may contain secrets and must not be retrieved or displayed without authorization.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly documents nomad var list / nomad var get and allocation log access in a supposedly read-only troubleshooting context, but it does not warn that both features commonly expose secrets, tokens, credentials, and sensitive application data. Read-only access does not make this safe: operators may retrieve confidential runtime data from logs or Nomad variables and inadvertently disclose it to downstream tools, users, or chat transcripts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.