JarvisLabs GPU

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:54 AM UTC
• Version: 1.0.2

Overview

This appears to be a legitimate JarvisLabs GPU skill, but it deserves review because it installs an unpinned CLI and gives an authenticated agent broad control over billable cloud instances, including deletion.

Review this before installing. Use only if you trust the JarvisLabs CLI package source, prefer a secret manager or protected environment injection for JL_API_KEY, and require explicit approval before creating billable resources or running jl destroy. Pause instances when preserving data matters, and rotate any token that appears in logs, history, or transcripts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Third-Party CLI Dependency

Content

View full analysis

Remediation

View remediation

" ``` or: ```bash pip install "jarvislabs==" ``` 2. Maintain a lock file or constraints file containing exact transitive dependency versions. 3. Where supported, require package hashes using a hash-locked requirements file. 4. Explicitly use a trusted package index and reject untrusted extra indexes. 5. Document the expected package publisher and release provenance so package identity can be verified. 6. Establish a controlled upgrade process in which new versions are reviewed and tested before the pin is changed. 7. Run the CLI with the minimum necessary local and cloud permissions, limiting the impact of a compromised dependency. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39

Finding

API Token Exposed Through Command-Line Arguments

Content

View full analysis

--yes`. You can also authenticate via `export JL_API_KEY="..."`. ``` ### Technical Analysis The documented `jl setup --token --yes` pattern places the JarvisLabs API token directly in the command-line argument vector. Depending on the operating system, shell, Agent framework, and observability configuration, command-line secrets can be exposed through: - Shell history files. - Process-listing and process-monitoring tools. - Agent execution transcripts. - Terminal recording or audit systems. - Debug and error logs that record complete commands. - Automation wrappers that retain invoked arguments. The environment-variable alternative avoids shell-history exposure when injected securely, but the shown `export JL_API_KEY="..."` form can itself enter shell history and may expose the token to child processes. Neither approach should be logged or embedded directly into reusable scripts. ### Attack Path 1. A user or Agent replaces `` with a valid JarvisLabs API token. 2. The Agent invokes `jl setup --token --yes`. 3. The complete command is retained in shell history, an Agent transcript, process telemetry, or command audit logs. 4. A local user, monitoring service operator, log reader, or party with transcript access retrieves the token. 5. The attacker submits authenticated JarvisLabs API or CLI requests using the recovered credential. 6. The attacker accesses or manipulates resources permitted by the token until it is revoked or expires. ### Impact Assessment The obtainable privileges are limited by the permissions assigned to the exposed token. Based on the operations documented by the Skill, a sufficiently privileged token co ...[truncated 545 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

- Machine commands (`jl create/list/get/pause/resume/destroy/rename/ssh/exec/upload/download`) = GPU instance lifecycle and access.
- `jl run` = managed job on an instance. Uploads code, sets up a Python environment, runs your script in the background with log tracking.
- `jl exec` = run any command on an instance. Use for system checks (nvidia-smi, ps, df), debugging failed runs, inspecting files, or any raw shell access. No environment setup, no tracking. This is your escape hatch when `jl run` doesn't cover your use case.

## Instances

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown documents Destroyed as 'everything deleted' and provides jl destroy <id> --yes --json, but it does not add a clear user-facing caution around the irreversible nature of this action beyond the terse state description. Under the markdown warning rule, destructive operations that affect user data or system integrity should be accompanied by an explicit warning in the skill description.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

| 7007 | IDE (`vs_url` field) |
| 6006 | Available on generic templates like pytorch (`endpoints[0]`) |

VM instances (`jl create --gpu ... --vm`) get SSH-only access. VMs require at least one SSH key registered (`jl ssh-key add`). Use `ssh_command` from `jl get <id> --json`.

To expose a service (FastAPI, Gradio, etc.), bind to `0.0.0.0:6006` — it's accessible via `endpoints[0]` on generic templates. Use `--http-ports "7860,8080"` at creation or resume to expose custom ports. Custom port URLs appear in `endpoints` after the default 6006 entry.

Static analysis

No suspicious patterns detected.