Nebula Claw Developer

• Outcome: Review
• Latest audit: May 28, 2026 · 1:22 PM UTC
• Version: 1.0.1

Overview

This skill has a clear disposable-VM purpose, but it gives agents infrastructure-changing power with weakly documented authentication, credential handling, deletion safeguards, and privileged setup boundaries.

Install only in a controlled OpenNebula environment after confirming the API is authenticated, bound to localhost or a protected network, uses least-privilege credentials, avoids plaintext password passing, and requires careful target verification before any hard VM deletion.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises shell-capable bundled resources (`scripts/vm_api.sh`) and operational behavior that can provision and destroy infrastructure, but it does not declare any explicit permissions. This creates a transparency and governance gap: callers may invoke a skill with infrastructure-changing capabilities without an auditable permission boundary, increasing the chance of unintended execution or misuse.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The document states that actions use a dedicated non-admin user, but the examples actually run the local CLI as `oneadmin` and then pass restricted-user credentials to the API-facing commands. This can mislead deployers about the true trust boundary and may normalize running the service through a privileged local account, increasing the chance of privilege misuse or accidental expansion beyond the intended restricted control plane.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The setup instructions embed a real-looking password directly in commands and examples, which encourages credential reuse and exposes secrets via shell history, process listings, logs, screenshots, and copied documentation. In a control-plane skill that provisions and terminates VMs, leaked credentials could allow unauthorized VM creation, inspection, or destruction within the allowed scope.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- Keep the curated `templates` allowlist small and documented with descriptions.
- Add TTL-based cleanup for disposable VMs.
- Restrict bind address and network exposure according to the deployment.
- Ensure the service account has passwordless sudo for the exact `one*` binaries used by the API, otherwise systemd runs can hang on sudo prompts.

• Confidence: 93% confidence
• Finding: Recommending passwordless sudo for `one*` binaries materially increases the risk of local privilege escalation or control-plane abuse if the service account, API, or command construction is compromised. In this skill context, those binaries can provision, inspect, and terminate infrastructure resources, so any weakness in input validation or service exposure could turn sudo access into broad VM lifecycle control.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- Keep the curated `templates` allowlist small and documented with descriptions.
- Add TTL-based cleanup for disposable VMs.
- Restrict bind address and network exposure according to the deployment.
- Ensure the service account has passwordless sudo for the exact `one*` binaries used by the API, otherwise systemd runs can hang on sudo prompts.

• Confidence: 93% confidence
• Finding: Recommending passwordless sudo for `one*` binaries materially increases the risk of local privilege escalation or control-plane abuse if the service account, API, or command construction is compromised. In this skill context, those binaries can provision, inspect, and terminate infrastructure resources, so any weakness in input validation or service exposure could turn sudo access into broad VM lifecycle control.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `GET /health`
- `GET /vms`
- `POST /vms`
- `DELETE /vms/<vm_id_or_name>`

Prefer readable VM and template names over numeric identifiers whenever possible.

• Confidence: 88% confidence
• Finding: Allowing `DELETE /vms/<vm_id_or_name>` introduces a dangerous parameter surface because identifiers flow directly into a destructive operation. If the implementation does not strictly validate and resolve names safely, an attacker or mistaken caller could target unintended VMs, exploit path handling ambiguities, or trigger deletion of similarly named resources in this disposable-environment control plane.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

Delete by name when possible:

```text
DELETE /vms/test-nebula-api-2026-04-10
```

## Expected environment inputs

• Confidence: 85% confidence
• Finding: The example explicitly demonstrates deletion by name, which makes destructive actions easier to invoke with human-chosen identifiers that may be guessable, colliding, or ambiguous. In a multi-tenant or automated environment, this increases the risk of deleting the wrong VM if name resolution, normalization, or authorization is imperfect.

Static analysis

No suspicious patterns detected.