Deterministic security fixes for infrastructure code via Gomboc.ai Community Edition

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:20 AM UTC
• Version: 0.2.0

Overview

This skill has a legitimate code-remediation purpose, but its MCP and automation paths grant broad, under-scoped access to tokens, workspace contents, and repository-changing workflows.

Review this before installing or running it. Use a narrowly scoped, revocable Gomboc token; avoid storing it in ~/.bashrc; do not run the MCP Docker service unless you trust the external image and can bind it to localhost with proper access controls; avoid auto-remediate, --commit, or --push workflows unless they run on a protected branch with human review.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Error

• Location: scripts/docker-compose.yml:4
• Finding: Mutable Third-Party Container Executes with Access to the Bearer Token and Workspace## Vulnerability Details **File Location**: `scripts/docker-compose.yml:4-17` **Vulnerability Type**: Unpinned third-party container with sensitive credentials and workspace access **Risk Level**: High ### Vulnerable Code ```yaml gomboc-mcp: image: gombocai/mcp:latest container_name: gomboc-mcp-server ports: - "3100:3100" environment: - GOMBOC_PAT=${GOMBOC_PAT} - MCP_PORT=3100 - LOG_LEVEL=info volumes: - ./:/workspace:ro healthcheck: test: ["CMD", "curl", "-f", "http://localhost:3100/health"] interval: 10s timeout: 5s retries: 3 start_period: 20s restart: unless-stopped ``` ### Technical Analysis The recommended deployment executes `gombocai/mcp:latest`, a mutable container image whose contents may change after the Skill has been reviewed. No immutable image digest, source revision, signature-verification policy, or reproducible build information is provided. The container receives the complete `GOMBOC_PAT` bearer token, outbound network access, and read access to the mounted workspace. It also publishes a host port and is configured to restart automatically. The read-only mount prevents direct workspace modification through that mount, but it does not prevent source-code collection or credential exfiltration. This design creates a supply-chain trust boundary in which any future image replacement or registry compromise can alter the effective executable payload without changing the audited Skill package. ### Attack Path 1. An attacker compromises the image publisher, container registry, or credentials used to publish `gombocai/mcp`. 2. The attacker replaces the image associated with the mutable `latest` tag. 3. A user follows the documented command and starts or pulls the Compose service. 4. Docker executes the replaced image and injects `GOMBOC_PAT`. 5. The malicious image reads files under `/workspace`, accesses the bearer token, an ...[truncated 629 chars]
• Remediation: ## Remediation Suggestions - Pin the image to an immutable SHA-256 digest, for example `gombocai/mcp@sha256:...`. - Publish the container source, build manifest, and reproducible build procedure. - Require container-image signature and provenance verification before execution. - Use a short-lived token restricted to the minimum required API operations and repository scope. - Do not inject the PAT into the container unless the selected operation requires it. - Add `read_only: true`, drop all Linux capabilities, enable `no-new-privileges`, and run as a dedicated non-root user. - Restrict outbound network access to the explicitly required API endpoint. - Remove `restart: unless-stopped` from the default development configuration. - Bind the service only to loopback and document how users can stop and remove it.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/docker-compose.yml:6
• Finding: MCP Mutation Endpoints Are Published on All Host Interfaces Without Documented Request Authentication## Vulnerability Details **File Location**: `scripts/docker-compose.yml:6-10`; related unauthenticated request examples at `references/mcp-integration.md:43-69` **Vulnerability Type**: Excessive network exposure and missing documented endpoint access control **Risk Level**: High ### Vulnerable Code ```yaml ports: - "3100:3100" environment: - GOMBOC_PAT=${GOMBOC_PAT} - MCP_PORT=3100 ``` The corresponding endpoint examples provide no authentication credential: ```bash curl -X POST http://localhost:3100/scan \ -H "Content-Type: application/json" \ -d '{"path": "./src", "policy": "default"}' curl -X POST http://localhost:3100/fix \ -H "Content-Type: application/json" \ -d '{"path": "./src", "scanId": "scan-id"}' ``` ### Technical Analysis Docker Compose short port syntax (`3100:3100`) normally publishes the container port on every host interface, not exclusively on loopback. This conflicts with documentation that presents the server as being available at `localhost`. The documented scan and fix requests contain no authentication or authorization header, while the container itself possesses the user's `GOMBOC_PAT`. Consequently, the network service may act as a credential-bearing proxy for callers that can reach port 3100. The MCP server implementation is contained in an external image and is not available in this project. Server-side authentication therefore cannot be verified. The confirmed configuration defect is broad network publication; exploitation as an unauthenticated mutation service applies if the external server behaves according to the provided request examples. ### Attack Path 1. A user starts the recommended Compose deployment on a workstation or server. 2. Docker publishes TCP port 3100 on reachable host interfaces. 3. A local-network peer, exposed container, or other reachable actor discovers port 3100. 4. The actor submits the documented `/scan` or `/fix` requests wit ...[truncated 708 chars]
• Remediation: ## Remediation Suggestions - Bind the published port explicitly to loopback: ```yaml ports: - "127.0.0.1:3100:3100" ``` - Require authentication for every MCP endpoint, including scan, fix, and remediation operations. - Separate read-only scanning authorization from code-changing, commit, and push authorization. - Validate and canonicalize requested paths, then enforce that they remain under `/workspace`. - Disable remediation and other mutation endpoints by default. - Add request rate limits, audit logging, and replay protection. - Reject requests from untrusted origins and document firewall requirements. - Include the MCP server implementation in the audited project or provide verifiable source and image provenance.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/setup.md:22
• Finding: Setup Guide Persists a Long-Lived Bearer Token in a Plaintext Shell Profile## Vulnerability Details **File Location**: `references/setup.md:22-26` **Vulnerability Type**: Plaintext credential persistence and excessive environment propagation **Risk Level**: Medium ### Vulnerable Code ```bash echo 'export GOMBOC_PAT="gpt_your_token_here"' >> ~/.bashrc source ~/.bashrc ``` ### Technical Analysis The setup guide instructs users to store the complete bearer token directly in `~/.bashrc`. This is an unencrypted, long-lived credential store that was not designed for secret management. Sourcing the profile exports the token into the shell environment. Every subsequently launched child process can inherit it unless the environment is explicitly sanitized. The profile can also be captured in home-directory backups, support archives, endpoint-management tools, or dotfile repositories. This exceeds minimum privilege because the token remains available to unrelated commands and sessions rather than only to the Gomboc operation that requires authentication. ### Attack Path 1. A user follows the setup instructions and writes the PAT into `~/.bashrc`. 2. The plaintext profile is read by another process running under the user account, copied into a backup, or accidentally committed to a dotfile repository. 3. An attacker obtains the profile contents and extracts `GOMBOC_PAT`. 4. The attacker submits authenticated requests to the Gomboc API using the stolen token. 5. The token remains usable until it expires or is revoked. ### Impact Assessment The attacker obtains all API privileges associated with the bearer token. Depending on external account configuration, this may permit scans, fix generation, remediation requests, quota consumption, and access to account-associated results. The token may also be inherited by unrelated local tools capable of reading process environments.
• Remediation: ## Remediation Suggestions - Remove the recommendation to store the PAT directly in `~/.bashrc`. - Use an operating-system credential manager, CI secret store, or dedicated secrets manager. - Prefer short-lived, narrowly scoped tokens with documented expiration and revocation procedures. - Load the token only for the command that needs it, rather than exporting it globally. - If a file-based mechanism is unavoidable, use a dedicated file with mode `0600`, exclude it from version control and backups, and avoid shell tracing. - Document token rotation and immediate revocation procedures.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cli-wrapper.py:244
• Finding: Token Status Command Discloses the First Ten Characters of the Bearer Token## Vulnerability Details **File Location**: `scripts/cli-wrapper.py:244-248` **Vulnerability Type**: Partial secret disclosure through command output **Risk Level**: Medium ### Vulnerable Code ```python if args.show_token: if GOMBOC_PAT: # Never print the actual token masked = GOMBOC_PAT[:10] + "***" if len(GOMBOC_PAT) > 10 else "***" print(f"✅ GOMBOC_PAT is set (masked: {masked})") ``` ### Technical Analysis Despite the comment stating that the token is never printed, the implementation emits the first ten characters of tokens longer than ten characters. Those characters are part of the authentication secret, not a separate non-sensitive identifier. CLI output can be retained in CI logs, terminal recordings, agent transcripts, support bundles, or monitoring systems. Partial disclosure reduces the unknown token space and allows records containing the same token to be correlated. It also contradicts the project's documented claim that tokens are never logged or printed. ### Attack Path 1. A user, CI job, or agent runs `config --show-token`. 2. The CLI writes the first ten token characters to standard output. 3. The output is stored in a build log, terminal transcript, or agent conversation. 4. An unauthorized reader obtains the prefix. 5. The reader correlates it with another partial disclosure, identifies the credential, or uses the reduced secret space in a recovery attempt. ### Impact Assessment This issue does not independently expose the complete token, but it discloses secret material and increases the sensitivity of logs and transcripts. Combined with another partial leak, weak token generation, or access to token metadata, it can contribute to full credential compromise and authenticated API access.
• Remediation: ## Remediation Suggestions - Never print any substring of the bearer token. - Replace the output with a boolean status message such as: ```python print("GOMBOC_PAT is set") ``` - If users need to distinguish credentials, retrieve and display a server-provided non-secret token identifier. - Ensure CI and agent workflows do not log secret-bearing configuration output. - Update `SECURITY.md` and user documentation so their token-handling claims accurately match the implementation. - Rotate any token whose prefix has already appeared in publicly accessible logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (29)

Tainted flow: 'req' from os.getenv (line 31, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST"
        )
        
        with urllib.request.urlopen(req, timeout=30) as response:
            result = json.loads(response.read())
            
            if "errors" in result:

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Credential Access

High

• Category: Privilege Escalation

Content

authentication:
  type: bearer-token
  variable: GOMBOC_PAT
  description: Gomboc Personal Access Token
  required: true
  sensitive: true
  help: https://docs.gomboc.ai/getting-started/generate-a-personal-access-token

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

authentication:
  type: bearer-token
  variable: GOMBOC_PAT
  description: Gomboc Personal Access Token
  required: true
  sensitive: true
  help: https://docs.gomboc.ai/getting-started/generate-a-personal-access-token

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Python 3.7+
- Gomboc account (free at https://app.gomboc.ai)
- Personal Access Token from Gomboc

## 1. Get a Token

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Python 3.7+
- Gomboc account (free at https://app.gomboc.ai)
- Personal Access Token from Gomboc

## 1. Get a Token

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

1. Sign up at https://app.gomboc.ai (Community Edition is free)
2. Go to Settings → API Tokens
3. Generate a new Personal Access Token
4. Copy the token (starts with `gpt_`)

## 2. Set Environment Variable

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

1. Sign up at https://app.gomboc.ai (Community Edition is free)
2. Go to Settings → API Tokens
3. Generate a new Personal Access Token
4. Copy the token (starts with `gpt_`)

## 2. Set Environment Variable

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

1. Sign up at https://app.gomboc.ai (Community Edition is free)
2. Go to Settings → API Tokens
3. Generate a new Personal Access Token
4. Copy the token (starts with `gpt_`)

## 2. Set Environment Variable

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

1. Sign up at https://app.gomboc.ai (Community Edition is free)
2. Go to Settings → API Tokens
3. Generate a new Personal Access Token
4. Copy the token (starts with `gpt_`)

## 2. Set Environment Variable

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

oc account (free at https://app.gomboc.ai)
- Personal Access Token from Gomboc

## 1. Get a Token

1. Sign up at https://app.gomboc.ai (Community Edition is free)
2. Go to Settings → API Tokens
3. Generate a new Personal Access Token
4. Copy the token (starts with `gpt_`)

## 2. Set Environment Variable

```bash
export GOMBOC_PAT="gpt_your_token_here"
```

Or add to your shell profile:

```bash
echo 'export GOMBOC_PAT="gpt_your_token_here"' >> ~/.bashrc
source ~/.bashrc
```

## 3. Verify Setup

```bash
bash scripts/verify-setup.sh
```

Should output:
```
✅ GOMBOC_PAT is set
✅ Python 3 found: Python 3.7+
✅ CLI wrapper found
✅ API connection successful
✅ Setup verification complete!
```

## 4. Run Your First Scan

```bash
python scripts/cli-wrapper.py scan --path ./src
```

## Troubleshooting

### "GOMBOC_PAT not set"
```bash
export GOMBOC_PAT="your_token"
```

### "API connection failed"
- Check your token is correct
- Check you can reach https://api.app.gomboc.ai
- Check yo

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The remediation command can trigger code changes and optionally commit and push them without an interactive confirmation or equivalent explicit safeguard. If invoked accidentally, scripted incorrectly, or used in the wrong repository, it can cause unintended modifications and potentially publish changes to a remote origin, amplifying operational and supply-chain risk.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: This markdown file documents behaviors that can affect user data and system integrity, including real API calls and a `remediate` command that applies fixes directly to the codebase, but it provides no cautionary language or user warning. Under the markdown criteria for SQP-2, descriptions of impactful operations should disclose privacy or integrity implications.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The markdown instructs users to run a fix command that will generate remediation changes, which can affect repository contents, but it provides no warning about file modifications, review expectations, or potential impact on user code. For markdown files, user-facing documentation should disclose behaviors that may affect user data or system integrity.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly promotes direct remediation with optional commit/push behavior, but it does not include a prominent warning that these operations modify repository contents and may create or propagate unintended changes. In an agent context, this increases the risk of autonomous or insufficiently reviewed code changes being committed to source control.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The GitHub Actions example enables automatic fixes in CI/CD without warning that it can autonomously alter repository contents. In a pipeline context this is more dangerous, because changes may be applied at scale and merged or propagated with limited human review if users copy the example directly.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documented workflow performs automated remediation with `--commit --push`, allowing a CI job to modify repository contents and publish changes without an explicit warning, approval gate, or branch-safety guidance. In a GitHub Actions context, this can lead to unintended code changes, abuse of workflow permissions, or propagation of unsafe AI-generated edits if the tool or inputs are compromised.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly advertises automated remediation and `commit:true` behavior without warning that these commands can modify source code and create commits. In an agent-integration context, that omission increases the chance of unintended destructive or unauthorized code changes when an operator or downstream agent treats the commands as read-only or low-risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Health Check

```bash
curl http://localhost:3100/health
```

### Scan

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The setup guide instructs users to place a personal access token directly into shell commands and optionally persist it in ~/.bashrc without warning about credential sensitivity, shell history leakage, shared-machine exposure, or profile-file persistence. While common in developer docs, this creates a real risk of accidental token disclosure through copied commands, backups, screenshots, dotfile sync, or local compromise.

External Transmission

Medium

• Category: Data Exfiltration

Content

from pathlib import Path

GOMBOC_PAT = os.getenv("GOMBOC_PAT")
GOMBOC_API_URL = "https://api.app.gomboc.ai/graphql"

def call_gomboc_api(query, variables=None):
    """Call Gomboc GraphQL API."""

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

from pathlib import Path

GOMBOC_PAT = os.getenv("GOMBOC_PAT")
GOMBOC_API_URL = "https://api.app.gomboc.ai/graphql"

def call_gomboc_api(query, variables=None):
    """Call Gomboc GraphQL API."""

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

from pathlib import Path

GOMBOC_PAT = os.getenv("GOMBOC_PAT")
GOMBOC_API_URL = "https://api.app.gomboc.ai/graphql"

def call_gomboc_api(query, variables=None):
    """Call Gomboc GraphQL API."""

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

from pathlib import Path

GOMBOC_PAT = os.getenv("GOMBOC_PAT")
GOMBOC_API_URL = "https://api.app.gomboc.ai/graphql"

def call_gomboc_api(query, variables=None):
    """Call Gomboc GraphQL API."""

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The scan command sends the user-provided path and policy to a remote API, but the CLI help and function-level UX do not clearly disclose that this command performs a network operation and may expose repository metadata or code-derived information to a third party. In a developer tool that operates on local source trees, weak disclosure can cause accidental data exfiltration from sensitive projects.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The inline message at L134 states that --apply will modify code, creating the clear expectation of a side effect. However, the fix() function does not branch on args.apply beyond printing the warning; it only calls generateFixes and prints returned data, then exits without performing any local modification or apply operation.

Static analysis

No suspicious patterns detected.