cyberlob

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:41 AM UTC
• Version: 0.0.3

Overview

This skill mostly matches its game-platform purpose, but it asks the agent to trust remote game instructions and handle credentials in ways that need review before installation.

Review before installing. Use a scoped environment variable or secure secret store instead of agent memory, avoid placing the API key in shell commands, and treat Cyberlob game text as untrusted unless it maps to documented `legal_actions` for the Cyberlob API. Do not allow the skill or remote game content to read local files, environment secrets, or run local shell commands without explicit user approval.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:193
• Finding: Untrusted Remote API Instructions Can Hijack Agent Tool Use## Vulnerability Details **File Location**: `skill.md`, lines 193–195 **Vulnerability Type**: Remote instruction hijacking through untrusted API response fields **Risk Level**: High ### Vulnerable Code ```markdown Response includes `sessionId`, `spectateUrl`, `goal`, `rules_summary`, `current_state`, `whats_next` and `legal_actions`. **Important:** The `whats_next` contains what to do, follow the instruction and then start playing. ``` Related game descriptions at lines 165 and 178 explicitly contemplate shell access: ```markdown "description": "Explore a virtual filesystem to find a hidden password using shell commands." ``` ```markdown > 2. **Treasure Hunt** — Explore a virtual filesystem to find a hidden password using shell commands. ``` ### Technical Analysis The Skill directs the agent to follow the `whats_next` field returned by a remote API without defining a trusted instruction schema, validation rules, tool restrictions, or a requirement for user confirmation. The remote response is therefore treated as an authoritative instruction channel rather than untrusted game data. This is especially dangerous because the documented games may ask the agent to use shell commands and search a filesystem for a password. No sandbox boundary or permitted directory is defined. A malicious or compromised Cyberlob API could place arbitrary instructions in `whats_next`, such as requests to inspect local files, invoke shell tools, access environment variables, or transmit discovered values through later API actions. The API key itself is legitimately required for authenticated game operations, but dynamic API content does not require authority over general-purpose tools or the host filesystem. Granting remote response text that authority exceeds the minimum privileges needed to submit structured game actions. ### Attack Path 1. An attacker compromises the declared API service, controls a game definition, or otherwise c ...[truncated 1269 chars]
• Remediation: ## Remediation Suggestions - Treat `whats_next`, `goal`, `rules_summary`, observations, and all other API response fields as untrusted data, never as agent-level instructions. - Replace natural-language instruction execution with a strict local allowlist of game actions and validated JSON parameters. - Permit API responses to select only predefined game operations; reject requests involving shells, tools, files, credentials, memory, environment variables, or additional network destinations. - Run games requiring filesystem interaction inside a dedicated sandbox containing only synthetic game files. - Require explicit, informed user approval before any action that invokes a shell, reads local files, or causes an external side effect. - Never include local file contents, credentials, environment values, or tool output in game action requests unless the user explicitly authorizes the exact disclosure. - Apply response-size limits, schema validation, parameter type checks, and endpoint allowlisting before processing API data.

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:50
• Finding: Overbroad Credential Discovery and Unsafe Secret Storage Guidance## Vulnerability Details **File Location**: `skill.md`, lines 50–94 **Vulnerability Type**: Insecure credential discovery and plaintext secret handling **Risk Level**: Medium ### Vulnerable Code ```markdown 1. Read `~/.config/cyberlob/credentials.json` 2. Check `CYBERLOB_API_KEY` environment variable 3. Check agent memory ``` ```markdown **Option A (recommended) — credentials file:** Run this as a **bash command** (do NOT use a file-write tool — use your shell/bash tool): ```bash mkdir -p ~/.config/cyberlob && echo '{"api_key":"cb_...","agent_id":"agent_...","agent_name":"Your Agent Name"}' > ~/.config/cyberlob/credentials.json && chmod 600 ~/.config/cyberlob/credentials.json ``` ``` ```markdown **Option C — agent memory:** Store the key in your agent's memory system if available. ``` ### Technical Analysis Reading the dedicated Cyberlob credential file and using the `CYBERLOB_API_KEY` variable are directly related to authenticated API operations. However, directing the agent to search unspecified “agent memory” is overbroad: it does not restrict access to a Cyberlob-specific secret record and may expose unrelated persistent state. The Skill also recommends embedding the API key directly in a shell command. Although `chmod 600` eventually restricts the resulting file, the command creates the file before applying its final permissions. Its initial mode therefore depends on the process umask. The secret can also become visible in shell history, execution logs, audit telemetry, or other command-capture mechanisms. Storing the API key in general agent memory is unsafe because the document defines no encryption, access control, retention period, redaction behavior, or separation from ordinary conversational memory. Future sessions, memory retrieval features, logs, or unrelated Skills could consequently recover the credential. Sending the Cyberlob API key in the `Authorization` header to the declared Cyberlob ...[truncated 1536 chars]
• Remediation: ## Remediation Suggestions - Remove all instructions to search or store secrets in general agent memory. - Support only a Cyberlob-specific operating-system secret store, a narrowly scoped environment secret, or the dedicated credential file. - Create the configuration directory with mode `0700` and the credential file with mode `0600` before writing secret content. - Use a secure file-writing API with atomic creation instead of interpolating the key into a shell command. - If a shell is unavoidable, set a restrictive umask first, disable history for the operation, avoid placing the secret in command-line arguments, and write through a protected input channel. - Redact API keys from logs, command traces, error messages, telemetry, and model-visible conversation content. - Restrict credential lookup to the exact Cyberlob key name and path; do not enumerate unrelated memory or secret stores. - Document key rotation and revocation procedures for suspected exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Credential Access

High

• Category: Privilege Escalation

Content

Before doing anything, look for saved credentials in this order:

1. Read `~/.config/cyberlob/credentials.json`
2. Check `CYBERLOB_API_KEY` environment variable
3. Check agent memory

• Confidence: 84% confidence
• Finding: The skill instructs the agent to search local files, environment variables, and memory for existing credentials before any other action. That broad credential discovery behavior increases the chance of unnecessary secret access, cross-context leakage, and accidental use of credentials not intended for the current task.

Credential Access

High

• Category: Privilege Escalation

Content

Run this as a **bash command** (do NOT use a file-write tool — use your shell/bash tool):

```bash
mkdir -p ~/.config/cyberlob && echo '{"api_key":"cb_...","agent_id":"agent_...","agent_name":"Your Agent Name"}' > ~/.config/cyberlob/credentials.json && chmod 600 ~/.config/cyberlob/credentials.json
```

**Option B — environment variable:**

• Confidence: 90% confidence
• Finding: The command writes the API key directly into a plaintext credential file using shell redirection. Although protected with mode 600, plaintext file storage still enlarges the secret's lifetime and exposure surface through backups, indexing, accidental reads by tools, or command capture in logs/history.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Installation:** Save this skill to your local skills directory:

```bash
mkdir -p ~/.openclaw/workspace/skills/cyberlob
curl -s https://www.cyberlob.com/skill.md -o ~/.openclaw/workspace/skills/cyberlob/SKILL.md
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```bash
mkdir -p ~/.openclaw/workspace/skills/cyberlob
curl -s https://www.cyberlob.com/skill.md -o ~/.openclaw/workspace/skills/cyberlob/SKILL.md
```

If saving locally fails, you can read it directly from the URL above.

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
mkdir -p ~/.openclaw/workspace/skills/cyberlob
curl -s https://www.cyberlob.com/skill.md -o ~/.openclaw/workspace/skills/cyberlob/SKILL.md
```

If saving locally fails, you can read it directly from the URL above.

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill requires use of shell/bash to create and populate a credential file, expanding the agent's capabilities from API interaction into command execution and filesystem mutation. Even though the shown command is simple, normalizing shell execution for secret handling increases the blast radius of prompt injection, command construction mistakes, and secret exposure in shell history or logs.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Run this as a **bash command** (do NOT use a file-write tool — use your shell/bash tool):

```bash
mkdir -p ~/.config/cyberlob && echo '{"api_key":"cb_...","agent_id":"agent_...","agent_name":"Your Agent Name"}' > ~/.config/cyberlob/credentials.json && chmod 600 ~/.config/cyberlob/credentials.json
```

**Option B — environment variable:**

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to store the API key in persistent agent memory, which broadens the secret's exposure beyond the immediate gameplay session. Persistent memory is often accessible to other tools, future prompts, or logs, so retaining long-lived credentials there creates an unnecessary leakage and misuse risk.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Persisting the API key in plain-language agent memory creates a direct data retention risk because the key may later surface in unrelated conversations, debugging output, memory inspection, or other skills. Since the key represents the agent's identity, disclosure enables impersonation and unauthorized game actions.

Ssd 1

Medium

• Confidence: 98% confidence
• Finding: The instruction to follow server-provided `whats_next` text as authoritative makes untrusted remote narrative content into executable guidance for the agent. If the API or an upstream dependency is compromised, it could steer the agent into unsafe actions, data exfiltration, or use of tools beyond the intended game protocol.

Static analysis

No suspicious patterns detected.