NetBox API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:11 AM UTC
• Version: 1.0.2

Overview

The skill is transparent about NetBox API automation, but its helper can send a NetBox bearer token to non-NetBox URLs and can disable TLS verification.

Install only if you trust the publisher and are prepared to review or patch the helper first. Use a narrowly scoped NetBox token, avoid --token on shared systems, do not set NETBOX_INSECURE_TLS except in a controlled emergency, and require explicit confirmation before any batch PATCH or DELETE.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/netbox_api.py:48

Finding

Bearer Token Forwarding to Arbitrary Origins

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/netbox_api.py:41

Finding

Optional TLS Verification Bypass Exposes NetBox Credentials and Operations

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/netbox_api.py:29

Finding

API Token Accepted Through Process Command-Line Arguments

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tainted flow: 'r' from os.environ.get (line 48, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request URL is ultimately influenced by untrusted environment/configuration input and the code always attaches the Bearer token before sending the request. Because absolute URLs are permitted, a caller can direct the tool to an arbitrary host and exfiltrate the NetBox API token or use the skill as a generic authenticated HTTP client, which is especially risky in an agent context.

Content

Scanner excerpt · scripts/netbox_api.py (reported line 54)May include surrounding context.

python

r.add_header("Authorization", "Bearer " + TOK)
    r.add_header("Content-Type", "application/json")
    try:
        with urllib.request.urlopen(r, context=ctx) as resp:
            return resp.status, json.loads(resp.read().decode() or "null")
    except urllib.error.HTTPError as e:
        return e.code, json.loads(e.read().decode() or "null")

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/batch-device-operations.md (reported line 57)May include surrounding context.

md

`object_id`, `object.{name,device.name}`).
4. Assert: exactly one end is the target node, the other end is an EXPECTED
   peer set (e.g. the two switch device names). Any unexpected peer → ABORT.
5. `DELETE /api/dcim/cables/{id}/` per cable; expect 200/204.
6. Read back: re-fetch interfaces, assert zero cabled interfaces in the target set.

## Gotchas seen in practice

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The note explicitly documents an insecure TLS bypass via NETBOX_INSECURE_TLS=1 equivalent to curl -k, which disables certificate validation and enables man-in-the-middle interception of API traffic. Because this skill is for administrative batch changes against infrastructure systems, compromised TLS could expose credentials or permit tampering with destructive API requests and responses.

Content

Scanner excerpt · references/batch-device-operations.md (reported line 69)May include surrounding context.

md

- 42U racks: U positions counted from 1; "RU 1 → 2" style docs = 2U nodes at
  starting units 1, 3, 5, ….
- TLS: internal cert — the script verifies certificates by default; for
  self-signed CAs export `NETBOX_INSECURE_TLS=1` (equivalent to `curl -k`).
- Keep tokens in the script/session only; do NOT write them into skill files or
  reference notes (this file intentionally has none).

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/netbox_api.py (reported line 7)May include surrounding context.

python

Usage:
  netbox_api.py get  "/api/dcim/devices/?limit=100&fields=name,rack,position"
  netbox_api.py patch /api/dcim/devices/42/ '{"name":"x","position":3}'
  netbox_api.py delete /api/dcim/cables/56/
  netbox_api.py all  "/api/dcim/interfaces/?limit=500"   # follows `next`, prints JSON list

Env: NETBOX_BASE (your instance, e.g. https://netbox.example.com).

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 83% confidence

Finding

The documented NETBOX_INSECURE_TLS=1 option disables certificate validation and hostname checking, enabling man-in-the-middle interception of API traffic and the Bearer token. In a batch/agent automation skill that performs authenticated destructive actions, this weakens transport security significantly, particularly on untrusted networks.

Content

Scanner excerpt · scripts/netbox_api.py (reported line 14)May include surrounding context.

python

Auth: --token *** flag, else read from ~/.config/netbox/token (chmod 600,
      one token per line). Never hardcode the token in files or commits.
TLS: certificate verification ON by default. Internal/self-signed CAs:
     export NETBOX_INSECURE_TLS=1 (equivalent to curl -k).
Stdout: JSON. Exit: 0 ok, 1 HTTP error, 2 usage/auth error.

Pagination: `all` follows the `next` URL from each response — never steps

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill describes network/API automation and explicitly references running a Python script against a live NetBox instance, but it declares no permissions or allowed-tools scope. In an agent environment, that means the skill may obtain broader shell, network, or environment access than users expect, increasing the risk of unintended outbound calls, token exposure, or unauthorized modifications to infrastructure inventory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This skill is designed to perform live NetBox write operations such as PATCH and DELETE against production inventory, but it does not prominently warn that these actions can modify or remove real infrastructure records. In an agentic workflow, the absence of an explicit destructive-action warning can cause users or downstream agents to treat the skill as informational, leading to accidental changes at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file documents relocating devices, renaming them, modifying descriptions, and deleting 68 stale cables via API, all of which can affect inventory integrity and connectivity. While the procedure includes verification steps, it does not clearly warn the user at the skill-description level that these actions are destructive or may disrupt systems if performed incorrectly.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/netbox_api.py (reported line 11)May include surrounding context.

python

netbox_api.py all  "/api/dcim/interfaces/?limit=500"   # follows `next`, prints JSON list

Env: NETBOX_BASE (your instance, e.g. https://netbox.example.com).
Auth: --token *** flag, else read from ~/.config/netbox/token (chmod 600,
      one token per line). Never hardcode the token in files or commits.
TLS: certificate verification ON by default. Internal/self-signed CAs:
     export NETBOX_INSECURE_TLS=1 (equivalent to curl -k).

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/netbox_api.py (reported line 66)May include surrounding context.

python

netbox_api.py all  "/api/dcim/interfaces/?limit=500"   # follows `next`, prints JSON list

Env: NETBOX_BASE (your instance, e.g. https://netbox.example.com).
Auth: --token *** flag, else read from ~/.config/netbox/token (chmod 600,
      one token per line). Never hardcode the token in files or commits.
TLS: certificate verification ON by default. Internal/self-signed CAs:
     export NETBOX_INSECURE_TLS=1 (equivalent to curl -k).

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

url = path if path.startswith("http") else BASE + path allows any absolute URL to bypass the configured NetBox base. In combination with automatic Bearer-token attachment and all following server-provided next URLs, this expands the tool from a NetBox client into an arbitrary outbound request primitive and can leak credentials to attacker-controlled hosts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

These lines instruct the reader to PATCH devices and IP objects, including relocating devices and changing management IP assignments, which can affect system inventory integrity. The document gives procedural details but does not include a caution or warning that these are write operations that modify live NetBox data.

Content

No source excerpt is available for this finding.