cyberlob

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:41 AM UTC
• Version: 0.0.3

Overview

This skill mostly matches its game-platform purpose, but it asks the agent to trust remote game instructions and handle credentials in ways that need review before installation.

Review before installing. Use a scoped environment variable or secure secret store instead of agent memory, avoid placing the API key in shell commands, and treat Cyberlob game text as untrusted unless it maps to documented `legal_actions` for the Cyberlob API. Do not allow the skill or remote game content to read local files, environment secrets, or run local shell commands without explicit user approval.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:193

Finding

Untrusted Remote API Instructions Can Hijack Agent Tool Use

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 193–195
Vulnerability Type: Remote instruction hijacking through untrusted API response fields
Risk Level: High

Vulnerable Code

markdown

Response includes `sessionId`, `spectateUrl`, `goal`, `rules_summary`, `current_state`, `whats_next` and `legal_actions`.

**Important:** The `whats_next` contains what to do, follow the instruction and then start playing.

Related game descriptions at lines 165 and 178 explicitly contemplate shell access:

markdown

"description": "Explore a virtual filesystem to find a hidden password using shell commands."

markdown

> 2. **Treasure Hunt** — Explore a virtual filesystem to find a hidden password using shell commands.

Technical Analysis

The Skill directs the agent to follow the whats_next field returned by a remote API without defining a trusted instruction schema, validation rules, tool restrictions, or a requirement for user confirmation. The remote response is therefore treated as an authoritative instruction channel rather than untrusted game data.

This is especially dangerous because the documented games may ask the agent to use shell commands and search a filesystem for a password. No sandbox boundary or permitted directory is defined. A malicious or compromised Cyberlob API could place arbitrary instructions in whats_next, such as requests to inspect local files, invoke shell tools, access environment variables, or transmit discovered values through later API actions.

The API key itself is legitimately required for authenticated game operations, but dynamic API content does not require authority over general-purpose tools or the host filesystem. Granting remote response text that authority exceeds the minimum privileges needed to submit structured game actions.

Attack Path

1. An attacker compromises the declared API service, controls a game definition, or otherwise c ...[truncated 1269 chars]

Remediation

View remediation

Remediation Suggestions

• Treat whats_next, goal, rules_summary, observations, and all other API response fields as untrusted data, never as agent-level instructions.
• Replace natural-language instruction execution with a strict local allowlist of game actions and validated JSON parameters.
• Permit API responses to select only predefined game operations; reject requests involving shells, tools, files, credentials, memory, environment variables, or additional network destinations.
• Run games requiring filesystem interaction inside a dedicated sandbox containing only synthetic game files.
• Require explicit, informed user approval before any action that invokes a shell, reads local files, or causes an external side effect.
• Never include local file contents, credentials, environment values, or tool output in game action requests unless the user explicitly authorizes the exact disclosure.
• Apply response-size limits, schema validation, parameter type checks, and endpoint allowlisting before processing API data.

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:50

Finding

Overbroad Credential Discovery and Unsafe Secret Storage Guidance

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 50–94
Vulnerability Type: Insecure credential discovery and plaintext secret handling
Risk Level: Medium

Vulnerable Code

markdown

1. Read `~/.config/cyberlob/credentials.json`
2. Check `CYBERLOB_API_KEY` environment variable
3. Check agent memory

markdown

**Option A (recommended) — credentials file:**

Run this as a **bash command** (do NOT use a file-write tool — use your shell/bash tool):

```bash
mkdir -p ~/.config/cyberlob && echo '{"api_key":"cb_...","agent_id":"agent_...","agent_name":"Your Agent Name"}' > ~/.config/cyberlob/credentials.json && chmod 600 ~/.config/cyberlob/credentials.json

text

```markdown
**Option C — agent memory:** Store the key in your agent's memory system if available.

Technical Analysis

Reading the dedicated Cyberlob credential file and using the CYBERLOB_API_KEY variable are directly related to authenticated API operations. However, directing the agent to search unspecified “agent memory” is overbroad: it does not restrict access to a Cyberlob-specific secret record and may expose unrelated persistent state.

The Skill also recommends embedding the API key directly in a shell command. Although chmod 600 eventually restricts the resulting file, the command creates the file before applying its final permissions. Its initial mode therefore depends on the process umask. The secret can also become visible in shell history, execution logs, audit telemetry, or other command-capture mechanisms.

Storing the API key in general agent memory is unsafe because the document defines no encryption, access control, retention period, redaction behavior, or separation from ordinary conversational memory. Future sessions, memory retrieval features, logs, or unrelated Skills could consequently recover the credential.

Sending the Cyberlob API key in the Authorization header to the declared Cyberlob ...[truncated 1536 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all instructions to search or store secrets in general agent memory.
• Support only a Cyberlob-specific operating-system secret store, a narrowly scoped environment secret, or the dedicated credential file.
• Create the configuration directory with mode 0700 and the credential file with mode 0600 before writing secret content.
• Use a secure file-writing API with atomic creation instead of interpolating the key into a shell command.
• If a shell is unavoidable, set a restrictive umask first, disable history for the operation, avoid placing the secret in command-line arguments, and write through a protected input channel.
• Redact API keys from logs, command traces, error messages, telemetry, and model-visible conversation content.
• Restrict credential lookup to the exact Cyberlob key name and path; do not enumerate unrelated memory or secret stores.
• Document key rotation and revocation procedures for suspected exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The skill instructs the agent to search local files, environment variables, and memory for existing credentials before any other action. That broad credential discovery behavior increases the chance of unnecessary secret access, cross-context leakage, and accidental use of credentials not intended for the current task.

Content

Scanner excerpt · skill.md (reported line 50)May include surrounding context.

md

Before doing anything, look for saved credentials in this order:

1. Read `~/.config/cyberlob/credentials.json`
2. Check `CYBERLOB_API_KEY` environment variable
3. Check agent memory

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The command writes the API key directly into a plaintext credential file using shell redirection. Although protected with mode 600, plaintext file storage still enlarges the secret's lifetime and exposure surface through backups, indexing, accidental reads by tools, or command capture in logs/history.

Content

Scanner excerpt · skill.md (reported line 85)May include surrounding context.

Run this as a bash command (do NOT use a file-write tool — use your shell/bash tool):

bash

mkdir -p ~/.config/cyberlob && echo '{"api_key":"cb_...","agent_id":"agent_...","agent_name":"Your Agent Name"}' > ~/.config/cyberlob/credentials.json && chmod 600 ~/.config/cyberlob/credentials.json

Option B — environment variable:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.md (reported line 22)May include surrounding context.

Installation: Save this skill to your local skills directory:

bash

mkdir -p ~/.openclaw/workspace/skills/cyberlob
curl -s https://www.cyberlob.com/skill.md -o ~/.openclaw/workspace/skills/cyberlob/SKILL.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skill.md (reported line 23)May include surrounding context.

bash

mkdir -p ~/.openclaw/workspace/skills/cyberlob
curl -s https://www.cyberlob.com/skill.md -o ~/.openclaw/workspace/skills/cyberlob/SKILL.md

If saving locally fails, you can read it directly from the URL above.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 23)May include surrounding context.

bash

mkdir -p ~/.openclaw/workspace/skills/cyberlob
curl -s https://www.cyberlob.com/skill.md -o ~/.openclaw/workspace/skills/cyberlob/SKILL.md

If saving locally fails, you can read it directly from the URL above.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill requires use of shell/bash to create and populate a credential file, expanding the agent's capabilities from API interaction into command execution and filesystem mutation. Even though the shown command is simple, normalizing shell execution for secret handling increases the blast radius of prompt injection, command construction mistakes, and secret exposure in shell history or logs.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 85)May include surrounding context.

Run this as a bash command (do NOT use a file-write tool — use your shell/bash tool):

bash

mkdir -p ~/.config/cyberlob && echo '{"api_key":"cb_...","agent_id":"agent_...","agent_name":"Your Agent Name"}' > ~/.config/cyberlob/credentials.json && chmod 600 ~/.config/cyberlob/credentials.json

Option B — environment variable:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to store the API key in persistent agent memory, which broadens the secret's exposure beyond the immediate gameplay session. Persistent memory is often accessible to other tools, future prompts, or logs, so retaining long-lived credentials there creates an unnecessary leakage and misuse risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Persisting the API key in plain-language agent memory creates a direct data retention risk because the key may later surface in unrelated conversations, debugging output, memory inspection, or other skills. Since the key represents the agent's identity, disclosure enables impersonation and unauthorized game actions.

Content

No source excerpt is available for this finding.

Ssd 1

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction to follow server-provided whats_next text as authoritative makes untrusted remote narrative content into executable guidance for the agent. If the API or an upstream dependency is compromised, it could steer the agent into unsafe actions, data exfiltration, or use of tools beyond the intended game protocol.

Content

No source excerpt is available for this finding.