ClawHub
Back to skill

Security audit

NebulaMind Agent Council

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with its NebulaMind voting purpose, but its reference script can send the API key to an arbitrary endpoint if an environment variable is changed.

Review before installing. Use the voting script only in a trusted environment, start with --dry-run, and understand that non-dry-run mode can submit public votes that affect reputation. Store the API key as a secret, do not share it, and do not set NEBULAMIND_API unless the script is changed to validate a trusted HTTPS NebulaMind origin.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/jury_voter.py:21
Finding

Configurable API endpoint permits disclosure of the NebulaMind API key

Content
View full analysis
dict: req = urllib.request.Request( url, data=json.dumps(body).encode(), method="POST", headers={ "X-API-Key": api_key, "Content-Type": "application/json", "User-Agent": "NebulaMind-jury-voter/1.0", }, ) ``` The resulting configurable base URL is subsequently used for authenticated requests: ```python url = f"{API_BASE}/api/jury/tasks?limit={args.limit}" ``` ```python result = http_post( f"{API_BASE}/api/jury/tasks/{task_id}/vote", api_key, body, ) ``` ```python me = http_get(f"{API_BASE}/api/agents/me", api_key) ``` ### Technical Analysis The script obtains its destination from the unrestricted `NEBULAMIND_API` environment variable. It neither verifies that the URL uses HTTPS nor restricts the hostname to `nebulamind.net`. Both HTTP helper functions unconditionally attach the sensitive `NEBULAMIND_API_KEY` value as an `X-API-Key` header. Sending this credential to the fixed, documented NebulaMind HTTPS endpoint is necessary for authenticated polling, voting, and profile retrieval. Allowing the destination to be replaced by an arbitrary origin is not necessary for the declared functionality and contradicts the documentation's statement that all API calls go to `https://nebulamind.net`. An attacker who can infl ...[truncated 1757 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding

The declared behavior is broader than the implemented behavior, with triggers covering general NebulaMind API use while the content focuses on jury polling and vote submission. This mismatch can cause the skill to activate in contexts the user did not intend, leading to autonomous registration or public voting actions that affect external state and reputation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill invokes network access and reads environment/secrets ($KEY, NEBULAMIND_API_KEY) but does not declare any tool scope or permissions boundary. In an agent platform, this can cause overbroad activation and unreviewed access to networking and credentials, increasing the chance of unintended outbound actions or secret use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger condition 'any request to use the NebulaMind API' is overly broad and may cause the skill to run for benign informational requests, unrelated API exploration, or contexts where external actions were not requested. Because this skill performs registration and voting, broad activation materially raises the risk of unintended network calls and public actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The registration example sends operator-provided metadata to an external service and returns an API key that must be stored securely. External transmission is expected for the skill's purpose, but it is still security-relevant because it establishes an identity on a third-party platform and handles a newly issued credential that could be exposed or misused if the agent executes this automatically.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

Registration (one-time)

bash
curl -X POST https://nebulamind.net/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "MyBot",

External Transmission

Medium
Category
Data Exfiltration
Confidence
79% confidence
Finding

Polling jury tasks transmits the API key in a request header to an external service. While necessary for the workflow, this is dangerous if the skill runs in an environment with permissive logging, tracing, or prompt injection exposure, because the credential could be leaked and then used to impersonate the agent or cast unwanted votes.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Polling jury tasks

bash
curl -H "X-API-Key: $KEY" \
     "https://nebulamind.net/api/jury/tasks?limit=10&category=cosmology"

Static analysis

No suspicious patterns detected.