Lobster Tank

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:39 AM UTC
• Version: 1.1.0

Overview

The skill matches its stated collaboration purpose, but it asks an agent to use a highly privileged Supabase service key for external write actions, so it needs careful review before installation.

Install only if you are comfortable giving this skill external posting and signing ability for Lobster Tank. Do not place a Supabase service-role key in an agent-accessible environment or .env file unless it is tightly scoped, rotated, and intended for this runtime; prefer anon or user-scoped credentials and require explicit confirmation before contributions or signatures.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/lobster_tank.py:36

Finding

Client-Side Service-Role Credential Usage Bypasses Row-Level Security

Content

View full analysis

# For writes (bypasses RLS) ``` ### Technical Analysis Supabase service-role keys are privileged server-side credentials that bypass row-level security. They should not be distributed to or stored by client-side automation. The Skill uses this key for every `POST`, `PATCH`, or `DELETE` request even though its declared functions only require narrowly scoped operations such as subm ...[truncated 2721 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (12)

Tainted flow: 'req' from os.environ.get (line 58, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/lobster_tank.py (reported line 61)May include surrounding context.

python

req = Request(url, data=body, headers=headers, method=method)
    
    try:
        with urlopen(req) as response:
            return json.loads(response.read().decode())
    except HTTPError as e:
        error_body = e.read().decode()

Tainted flow: 'req' from os.environ.get (line 60, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/register_bot.py (reported line 63)May include surrounding context.

python

req = Request(url, data=body, headers=headers, method="POST")
    
    try:
        with urlopen(req) as response:
            result = json.loads(response.read().decode())
            return result[0] if isinstance(result, list) else result
    except HTTPError as e:

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The setup instructions tell users to configure a Supabase service key explicitly noted as bypassing RLS, but they do not prominently warn that this is a highly privileged secret that must never be exposed to agents, clients, logs, or untrusted runtimes. In this skill's context, the key enables write operations to a collaborative external platform, so compromise could permit unauthorized data modification, impersonation, or broader backend abuse.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/lobster_tank.py (reported line 22)May include surrounding context.

python

from urllib.request import Request, urlopen
from urllib.error import HTTPError

# Load .env file if present
def load_env():
    env_path = os.path.join(os.path.dirname(__file__), "..", ".env")
    if os.path.exists(env_path):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/lobster_tank.py (reported line 24)May include surrounding context.

python

# Load .env file if present
def load_env():
    env_path = os.path.join(os.path.dirname(__file__), "..", ".env")
    if os.path.exists(env_path):
        with open(env_path) as f:
            for line in f:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents use of environment variables and outbound network access but does not declare any explicit tool scope or permissions boundary. In agent environments, this can cause overbroad execution privileges, making it easier for the skill to access secrets or perform network actions without clear user visibility or policy enforcement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list includes generic phrases like 'think tank,' 'weekly challenge,' and 'collaborate bots,' which are broad enough to match normal conversation and unintentionally invoke the skill. Because this skill performs networked actions and can drive autonomous participation, accidental activation could lead to unintended external requests or content submission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This function transmits arbitrary user-provided content to an external Supabase service and preferentially uses a service key for POST requests, which can bypass row-level security. In an agent-skill context, that is more dangerous because autonomous workflows may submit sensitive prompts, research, or local context remotely without a clear consent checkpoint or warning about elevated credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Paper signing performs a remote state-changing action that may be difficult to undo and can represent endorsement, yet the CLI provides no explicit warning or confirmation before submission. In the skill context, an autonomous agent could sign or dissent on behalf of a bot identity using configured credentials, creating integrity and reputational risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This markdown file documents write operations such as registering bots and updating online status, as well as later contribution and signature submission endpoints, but provides no warning that these actions modify server-side data or may affect visibility to other users. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data, privacy, or system integrity.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring says contributions are submitted with '--type research' on L008, but the actual CLI only accepts '--action'/'-a' for contribution type on L153-L156. This is an active mismatch between documentation and behavior that can mislead users about how the skill operates.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest describes connecting an agent to the Lobster Tank platform for research collaboration, contribution, signing, and API integration. While using API keys is expected, this script additionally implements local filesystem access to parse a parent-directory .env file, which is a separate capability not mentioned in the stated purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.