Deterministic security fixes for infrastructure code via Gomboc.ai Community Edition

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:20 AM UTC
• Version: 0.2.0

Overview

This skill has a legitimate code-remediation purpose, but its MCP and automation paths grant broad, under-scoped access to tokens, workspace contents, and repository-changing workflows.

Review this before installing or running it. Use a narrowly scoped, revocable Gomboc token; avoid storing it in ~/.bashrc; do not run the MCP Docker service unless you trust the external image and can bind it to localhost with proper access controls; avoid auto-remediate, --commit, or --push workflows unless they run on a protected branch with human review.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Error

• Location: scripts/docker-compose.yml:4

Finding

Mutable Third-Party Container Executes with Access to the Bearer Token and Workspace

Content

View full analysis

Vulnerability Details

File Location: scripts/docker-compose.yml:4-17
Vulnerability Type: Unpinned third-party container with sensitive credentials and workspace access
Risk Level: High

Vulnerable Code

yaml

gomboc-mcp:
  image: gombocai/mcp:latest
  container_name: gomboc-mcp-server
  ports:
    - "3100:3100"
  environment:
    - GOMBOC_PAT=${GOMBOC_PAT}
    - MCP_PORT=3100
    - LOG_LEVEL=info
  volumes:
    - ./:/workspace:ro
  healthcheck:
    test: ["CMD", "curl", "-f", "http://localhost:3100/health"]
    interval: 10s
    timeout: 5s
    retries: 3
    start_period: 20s
  restart: unless-stopped

Technical Analysis

The recommended deployment executes gombocai/mcp:latest, a mutable container image whose contents may change after the Skill has been reviewed. No immutable image digest, source revision, signature-verification policy, or reproducible build information is provided.

The container receives the complete GOMBOC_PAT bearer token, outbound network access, and read access to the mounted workspace. It also publishes a host port and is configured to restart automatically. The read-only mount prevents direct workspace modification through that mount, but it does not prevent source-code collection or credential exfiltration.

This design creates a supply-chain trust boundary in which any future image replacement or registry compromise can alter the effective executable payload without changing the audited Skill package.

Attack Path

1. An attacker compromises the image publisher, container registry, or credentials used to publish gombocai/mcp.
2. The attacker replaces the image associated with the mutable latest tag.
3. A user follows the documented command and starts or pulls the Compose service.
4. Docker executes the replaced image and injects GOMBOC_PAT.
5. The malicious image reads files under /workspace, accesses the bearer token, an ...[truncated 629 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the image to an immutable SHA-256 digest, for example gombocai/mcp@sha256:....
• Publish the container source, build manifest, and reproducible build procedure.
• Require container-image signature and provenance verification before execution.
• Use a short-lived token restricted to the minimum required API operations and repository scope.
• Do not inject the PAT into the container unless the selected operation requires it.
• Add read_only: true, drop all Linux capabilities, enable no-new-privileges, and run as a dedicated non-root user.
• Restrict outbound network access to the explicitly required API endpoint.
• Remove restart: unless-stopped from the default development configuration.
• Bind the service only to loopback and document how users can stop and remove it.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/docker-compose.yml:6

Finding

MCP Mutation Endpoints Are Published on All Host Interfaces Without Documented Request Authentication

Content

View full analysis

Vulnerability Details

File Location: scripts/docker-compose.yml:6-10; related unauthenticated request examples at references/mcp-integration.md:43-69
Vulnerability Type: Excessive network exposure and missing documented endpoint access control
Risk Level: High

Vulnerable Code

yaml

ports:
  - "3100:3100"
environment:
  - GOMBOC_PAT=${GOMBOC_PAT}
  - MCP_PORT=3100

The corresponding endpoint examples provide no authentication credential:

bash

curl -X POST http://localhost:3100/scan \
  -H "Content-Type: application/json" \
  -d '{"path": "./src", "policy": "default"}'

curl -X POST http://localhost:3100/fix \
  -H "Content-Type: application/json" \
  -d '{"path": "./src", "scanId": "scan-id"}'

Technical Analysis

Docker Compose short port syntax (3100:3100) normally publishes the container port on every host interface, not exclusively on loopback. This conflicts with documentation that presents the server as being available at localhost.

The documented scan and fix requests contain no authentication or authorization header, while the container itself possesses the user's GOMBOC_PAT. Consequently, the network service may act as a credential-bearing proxy for callers that can reach port 3100.

The MCP server implementation is contained in an external image and is not available in this project. Server-side authentication therefore cannot be verified. The confirmed configuration defect is broad network publication; exploitation as an unauthenticated mutation service applies if the external server behaves according to the provided request examples.

Attack Path

1. A user starts the recommended Compose deployment on a workstation or server.
2. Docker publishes TCP port 3100 on reachable host interfaces.
3. A local-network peer, exposed container, or other reachable actor discovers port 3100.
4. The actor submits the documented /scan or /fix requests wit ...[truncated 708 chars]

Remediation

View remediation

Remediation Suggestions

• Bind the published port explicitly to loopback:

  yaml

  ports:
    - "127.0.0.1:3100:3100"
  

• Require authentication for every MCP endpoint, including scan, fix, and remediation operations.
• Separate read-only scanning authorization from code-changing, commit, and push authorization.
• Validate and canonicalize requested paths, then enforce that they remain under /workspace.
• Disable remediation and other mutation endpoints by default.
• Add request rate limits, audit logging, and replay protection.
• Reject requests from untrusted origins and document firewall requirements.
• Include the MCP server implementation in the audited project or provide verifiable source and image provenance.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/setup.md:22

Finding

Setup Guide Persists a Long-Lived Bearer Token in a Plaintext Shell Profile

Content

View full analysis

Vulnerability Details

File Location: references/setup.md:22-26
Vulnerability Type: Plaintext credential persistence and excessive environment propagation
Risk Level: Medium

Vulnerable Code

bash

echo 'export GOMBOC_PAT="gpt_your_token_here"' >> ~/.bashrc
source ~/.bashrc

Technical Analysis

The setup guide instructs users to store the complete bearer token directly in ~/.bashrc. This is an unencrypted, long-lived credential store that was not designed for secret management.

Sourcing the profile exports the token into the shell environment. Every subsequently launched child process can inherit it unless the environment is explicitly sanitized. The profile can also be captured in home-directory backups, support archives, endpoint-management tools, or dotfile repositories.

This exceeds minimum privilege because the token remains available to unrelated commands and sessions rather than only to the Gomboc operation that requires authentication.

Attack Path

1. A user follows the setup instructions and writes the PAT into ~/.bashrc.
2. The plaintext profile is read by another process running under the user account, copied into a backup, or accidentally committed to a dotfile repository.
3. An attacker obtains the profile contents and extracts GOMBOC_PAT.
4. The attacker submits authenticated requests to the Gomboc API using the stolen token.
5. The token remains usable until it expires or is revoked.

Impact Assessment

The attacker obtains all API privileges associated with the bearer token. Depending on external account configuration, this may permit scans, fix generation, remediation requests, quota consumption, and access to account-associated results. The token may also be inherited by unrelated local tools capable of reading process environments.

Remediation

View remediation

Remediation Suggestions

• Remove the recommendation to store the PAT directly in ~/.bashrc.
• Use an operating-system credential manager, CI secret store, or dedicated secrets manager.
• Prefer short-lived, narrowly scoped tokens with documented expiration and revocation procedures.
• Load the token only for the command that needs it, rather than exporting it globally.
• If a file-based mechanism is unavoidable, use a dedicated file with mode 0600, exclude it from version control and backups, and avoid shell tracing.
• Document token rotation and immediate revocation procedures.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cli-wrapper.py:244

Finding

Token Status Command Discloses the First Ten Characters of the Bearer Token

Content

View full analysis

Vulnerability Details

File Location: scripts/cli-wrapper.py:244-248
Vulnerability Type: Partial secret disclosure through command output
Risk Level: Medium

Vulnerable Code

python

if args.show_token:
    if GOMBOC_PAT:
        # Never print the actual token
        masked = GOMBOC_PAT[:10] + "***" if len(GOMBOC_PAT) > 10 else "***"
        print(f"✅ GOMBOC_PAT is set (masked: {masked})")

Technical Analysis

Despite the comment stating that the token is never printed, the implementation emits the first ten characters of tokens longer than ten characters. Those characters are part of the authentication secret, not a separate non-sensitive identifier.

CLI output can be retained in CI logs, terminal recordings, agent transcripts, support bundles, or monitoring systems. Partial disclosure reduces the unknown token space and allows records containing the same token to be correlated. It also contradicts the project's documented claim that tokens are never logged or printed.

Attack Path

1. A user, CI job, or agent runs config --show-token.
2. The CLI writes the first ten token characters to standard output.
3. The output is stored in a build log, terminal transcript, or agent conversation.
4. An unauthorized reader obtains the prefix.
5. The reader correlates it with another partial disclosure, identifies the credential, or uses the reduced secret space in a recovery attempt.

Impact Assessment

This issue does not independently expose the complete token, but it discloses secret material and increases the sensitivity of logs and transcripts. Combined with another partial leak, weak token generation, or access to token metadata, it can contribute to full credential compromise and authenticated API access.

Remediation

View remediation

Remediation Suggestions

• Never print any substring of the bearer token.
• Replace the output with a boolean status message such as:

  python

  print("GOMBOC_PAT is set")
  

• If users need to distinguish credentials, retrieve and display a server-provided non-secret token identifier.
• Ensure CI and agent workflows do not log secret-bearing configuration output.
• Update SECURITY.md and user documentation so their token-handling claims accurately match the implementation.
• Rotate any token whose prefix has already appeared in publicly accessible logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (29)

Tainted flow: 'req' from os.getenv (line 31, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cli-wrapper.py (reported line 41)May include surrounding context.

python

method="POST"
        )
        
        with urllib.request.urlopen(req, timeout=30) as response:
            result = json.loads(response.read())
            
            if "errors" in result:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .clawhub.yml (reported line 50)May include surrounding context.

yaml

authentication:
  type: bearer-token
  variable: GOMBOC_PAT
  description: Gomboc Personal Access Token
  required: true
  sensitive: true
  help: https://docs.gomboc.ai/getting-started/generate-a-personal-access-token

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .clawhub.yml (reported line 57)May include surrounding context.

yaml

authentication:
  type: bearer-token
  variable: GOMBOC_PAT
  description: Gomboc Personal Access Token
  required: true
  sensitive: true
  help: https://docs.gomboc.ai/getting-started/generate-a-personal-access-token

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-integration.md (reported line 76)May include surrounding context.

md

- Python 3.7+
- Gomboc account (free at https://app.gomboc.ai)
- Personal Access Token from Gomboc

## 1. Get a Token

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 7)May include surrounding context.

md

- Python 3.7+
- Gomboc account (free at https://app.gomboc.ai)
- Personal Access Token from Gomboc

## 1. Get a Token

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 23)May include surrounding context.

md

1. Sign up at https://app.gomboc.ai (Community Edition is free)
2. Go to Settings → API Tokens
3. Generate a new Personal Access Token
4. Copy the token (starts with `gpt_`)

## 2. Set Environment Variable

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

1. Sign up at https://app.gomboc.ai (Community Edition is free)
2. Go to Settings → API Tokens
3. Generate a new Personal Access Token
4. Copy the token (starts with `gpt_`)

## 2. Set Environment Variable

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md

1. Sign up at https://app.gomboc.ai (Community Edition is free)
2. Go to Settings → API Tokens
3. Generate a new Personal Access Token
4. Copy the token (starts with `gpt_`)

## 2. Set Environment Variable

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 13)May include surrounding context.

md

1. Sign up at https://app.gomboc.ai (Community Edition is free)
2. Go to Settings → API Tokens
3. Generate a new Personal Access Token
4. Copy the token (starts with `gpt_`)

## 2. Set Environment Variable

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

oc account (free at https://app.gomboc.ai)

• Personal Access Token from Gomboc

1. Get a Token

1. Sign up at https://app.gomboc.ai (Community Edition is free)
2. Go to Settings → API Tokens
3. Generate a new Personal Access Token
4. Copy the token (starts with gpt_)

2. Set Environment Variable

bash

export GOMBOC_PAT="gpt_your_token_here"

Or add to your shell profile:

bash

echo 'export GOMBOC_PAT="gpt_your_token_here"' >> ~/.bashrc
source ~/.bashrc

3. Verify Setup

bash

bash scripts/verify-setup.sh

Should output:

text

✅ GOMBOC_PAT is set
✅ Python 3 found: Python 3.7+
✅ CLI wrapper found
✅ API connection successful
✅ Setup verification complete!

4. Run Your First Scan

bash

python scripts/cli-wrapper.py scan --path ./src

Troubleshooting

"GOMBOC_PAT not set"

bash

export GOMBOC_PAT="your_token"

"API connection failed"

• Check your token is correct
• Check you can reach https://api.app.gomboc.ai
• Check yo

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The remediation command can trigger code changes and optionally commit and push them without an interactive confirmation or equivalent explicit safeguard. If invoked accidentally, scripted incorrectly, or used in the wrong repository, it can cause unintended modifications and potentially publish changes to a remote origin, amplifying operational and supply-chain risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file documents behaviors that can affect user data and system integrity, including real API calls and a remediate command that applies fixes directly to the codebase, but it provides no cautionary language or user warning. Under the markdown criteria for SQP-2, descriptions of impactful operations should disclose privacy or integrity implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown instructs users to run a fix command that will generate remediation changes, which can affect repository contents, but it provides no warning about file modifications, review expectations, or potential impact on user code. For markdown files, user-facing documentation should disclose behaviors that may affect user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly promotes direct remediation with optional commit/push behavior, but it does not include a prominent warning that these operations modify repository contents and may create or propagate unintended changes. In an agent context, this increases the risk of autonomous or insufficiently reviewed code changes being committed to source control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The GitHub Actions example enables automatic fixes in CI/CD without warning that it can autonomously alter repository contents. In a pipeline context this is more dangerous, because changes may be applied at scale and merged or propagated with limited human review if users copy the example directly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documented workflow performs automated remediation with --commit --push, allowing a CI job to modify repository contents and publish changes without an explicit warning, approval gate, or branch-safety guidance. In a GitHub Actions context, this can lead to unintended code changes, abuse of workflow permissions, or propagation of unsafe AI-generated edits if the tool or inputs are compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation explicitly advertises automated remediation and commit:true behavior without warning that these commands can modify source code and create commits. In an agent-integration context, that omission increases the chance of unintended destructive or unauthorized code changes when an operator or downstream agent treats the commands as read-only or low-risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/mcp-integration.md (reported line 53)May include surrounding context.

Health Check

bash

curl http://localhost:3100/health

Scan

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup guide instructs users to place a personal access token directly into shell commands and optionally persist it in ~/.bashrc without warning about credential sensitivity, shell history leakage, shared-machine exposure, or profile-file persistence. While common in developer docs, this creates a real risk of accidental token disclosure through copied commands, backups, screenshots, dotfile sync, or local compromise.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SECURITY.md (reported line 17)May include surrounding context.

md

from pathlib import Path

GOMBOC_PAT = os.getenv("GOMBOC_PAT")
GOMBOC_API_URL = "https://api.app.gomboc.ai/graphql"

def call_gomboc_api(query, variables=None):
    """Call Gomboc GraphQL API."""

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SECURITY.md (reported line 61)May include surrounding context.

md

from pathlib import Path

GOMBOC_PAT = os.getenv("GOMBOC_PAT")
GOMBOC_API_URL = "https://api.app.gomboc.ai/graphql"

def call_gomboc_api(query, variables=None):
    """Call Gomboc GraphQL API."""

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/cli-wrapper.py (reported line 18)May include surrounding context.

python

from pathlib import Path

GOMBOC_PAT = os.getenv("GOMBOC_PAT")
GOMBOC_API_URL = "https://api.app.gomboc.ai/graphql"

def call_gomboc_api(query, variables=None):
    """Call Gomboc GraphQL API."""

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/verify-setup.sh (reported line 46)May include surrounding context.

sh

from pathlib import Path

GOMBOC_PAT = os.getenv("GOMBOC_PAT")
GOMBOC_API_URL = "https://api.app.gomboc.ai/graphql"

def call_gomboc_api(query, variables=None):
    """Call Gomboc GraphQL API."""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The scan command sends the user-provided path and policy to a remote API, but the CLI help and function-level UX do not clearly disclose that this command performs a network operation and may expose repository metadata or code-derived information to a third party. In a developer tool that operates on local source trees, weak disclosure can cause accidental data exfiltration from sensitive projects.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The inline message at L134 states that --apply will modify code, creating the clear expectation of a side effect. However, the fix() function does not branch on args.apply beyond printing the warning; it only calls generateFixes and prints returned data, then exits without performing any local modification or apply operation.

Content

No source excerpt is available for this finding.