Nebula Claw Developer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:52 AM UTC
• Version: 1.0.1

Overview

This skill has a coherent disposable-VM purpose, but it exposes VM creation and hard-delete workflows with weak authentication, unsafe examples, and limited safeguards.

Review this skill before installing. Use it only with a loopback or otherwise strongly protected API, add authentication and TLS before any network exposure, replace all example passwords, avoid command-line password arguments, restrict the OpenNebula account to disposable resources, and confirm delete targets carefully because deletion is a hard terminate operation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/vm_api.sh:29

Finding

JSON Injection Through Unescaped VM Creation Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/vm_api.sh, lines 29-39
Vulnerability Type: Improper JSON construction using unescaped user input
Risk Level: High

Vulnerable Code

bash

create)
  template_name="${2:-}"
  vm_name="${3:-}"
  if [[ -z "$template_name" || -z "$vm_name" ]]; then
    usage
    exit 1
  fi
  curl -s -X POST "$NEBULA_CLAW_DEVELOPER_API_BASE/vms" \
    -H "Content-Type: application/json" \
    -d "{\"template_name\":\"$template_name\",\"name\":\"$vm_name\"}"
  ;;

Technical Analysis

The template_name and vm_name command-line arguments are interpolated directly into a JSON string without JSON encoding or input validation. Shell quoting prevents ordinary shell command substitution from being re-evaluated, but it does not make the resulting JSON safe.

An argument containing quotation marks, backslashes, or JSON delimiters can terminate its intended string value and introduce additional properties. This is especially significant because references/api.md, lines 24-33, documents optional one_user and one_password fields:

json

{
  "template_name": "curated-ubuntu-24-04-for-nebula-claw-developer",
  "name": "test-nebula-api-2026-04-10",
  "one_user": "restrictedapi",
  "one_password": "change-me"
}

If the server accepts these overrides, injected properties could alter which OpenNebula credentials are used. Even where credential overrides are rejected, an attacker can still produce malformed requests or inject other properties supported by the API.

Attack Path

1. An attacker gains the ability to influence either argument supplied to vm_api.sh create.
2. The attacker includes JSON syntax in an argument, such as quotation marks followed by additional property names and values.
3. The script inserts the argument into the request body without escaping it.
4. The API parses the injected properties as part of the request.
5. I ...[truncated 1049 chars]

Remediation

View remediation

Remediation Suggestions

• Build the request body with a real JSON encoder rather than string interpolation. For example:

  bash

  payload="$(
    jq -n \
      --arg template_name "$template_name" \
      --arg name "$vm_name" \
      '{template_name: $template_name, name: $name}'
  )"
  
  curl --fail-with-body --silent --show-error \
    -X POST "$NEBULA_CLAW_DEVELOPER_API_BASE/vms" \
    -H "Content-Type: application/json" \
    --data-binary "$payload"
  

• Validate template and VM names against strict server-compatible patterns and length limits.

• Enforce the curated template allowlist on the server; client-side validation must not be treated as an authorization boundary.

• Remove per-request credential override support from production deployments. If testing requires it, place it behind separate authentication and explicit authorization.

• Configure the server to reject unknown JSON properties and duplicate property names.

• Add tests using quotation marks, backslashes, control characters, duplicate keys, and nested JSON fragments.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/vm_api.sh:4

Finding

VM Control Plane Supports Unauthenticated Plaintext HTTP Requests

Content

View full analysis

Vulnerability Details

File Location: scripts/vm_api.sh, lines 4 and 21-42; references/api.md, lines 42-46; references/setup.md, lines 100-106
Vulnerability Type: Missing API authentication and insecure transport configuration
Risk Level: High

Vulnerable Code

The helper defaults to plaintext HTTP:

bash

NEBULA_CLAW_DEVELOPER_API_BASE="${NEBULA_CLAW_DEVELOPER_API_BASE:-http://127.0.0.1:8080}"

Every lifecycle operation is sent without an authentication header or client credential:

bash

case "$cmd" in
  health)
    curl -s "$NEBULA_CLAW_DEVELOPER_API_BASE/health"
    ;;
  list)
    curl -s "$NEBULA_CLAW_DEVELOPER_API_BASE/vms"
    ;;
  create)
    template_name="${2:-}"
    vm_name="${3:-}"
    if [[ -z "$template_name" || -z "$vm_name" ]]; then
      usage
      exit 1
    fi
    curl -s -X POST "$NEBULA_CLAW_DEVELOPER_API_BASE/vms" \
      -H "Content-Type: application/json" \
      -d "{\"template_name\":\"$template_name\",\"name\":\"$vm_name\"}"
    ;;
  delete)
    vm_ref="${2:-}"
    if [[ -z "$vm_ref" ]]; then
      usage
      exit 1
    fi
    curl -s -X DELETE "$NEBULA_CLAW_DEVELOPER_API_BASE/vms/$vm_ref"
    ;;

The API reference includes a non-loopback plaintext endpoint:

bash

NEBULA_CLAW_DEVELOPER_API_BASE=http://10.1.1.130:8080 ./scripts/vm_api.sh health

The setup guide identifies authentication and exposure restrictions as future hardening rather than existing requirements:

markdown

## Follow-up hardening

- Move the password out of JSON config.
- Add API authentication.
- Keep the curated `templates` allowlist small and documented with descriptions.
- Add TTL-based cleanup for disposable VMs.
- Restrict bind address and network exposure according to the deployment.
- Ensure the service account has passwordless sudo for the exact `one*` binaries used by the API, otherwise systemd runs can hang on s
...[truncated 2171 chars]

Remediation

View remediation

Remediation Suggestions

• Require authenticated HTTPS for every non-loopback deployment.
• Add short-lived bearer tokens, mutually authenticated TLS, or signed requests. Authorize each lifecycle operation separately.
• Bind the API to loopback by default and fail closed if a non-loopback listener is configured without TLS and authentication.
• Reject remote plaintext http:// base URLs in the helper unless an explicit development-only override is supplied.
• Store client credentials in a protected secret store rather than command-line arguments or published configuration.
• Apply firewall rules and network segmentation so only designated clients can reach the API.
• Add rate limits, quotas, request auditing, and alerts for repeated creation or deletion operations.
• Require stronger confirmation or operation-specific authorization for hard termination.
• Use curl --fail-with-body --silent --show-error and validate the URL scheme and host before sending requests.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/setup.md:17

Finding

Predictable OpenNebula Password Published in Executable Setup Commands

Content

View full analysis

Vulnerability Details

File Location: references/setup.md, lines 17-18 and 57-76
Vulnerability Type: Hardcoded example credential and insecure credential handling guidance
Risk Level: Medium

Vulnerable Code

The setup guide creates an account with a fixed password:

bash

sudo -u oneadmin env HOME=/var/lib/one \
  oneuser create restrictedapi StrongTempPass123!

It then repeats the same password in directly executable test commands:

bash

sudo -u oneadmin env HOME=/var/lib/one \
  onevm list --csv --user restrictedapi --password StrongTempPass123!

bash

sudo -u oneadmin env HOME=/var/lib/one \
  onetemplate instantiate curated-ubuntu-24-04-for-nebula-claw-developer \
  --name restricted-api-test \
  --user restrictedapi \
  --password StrongTempPass123!

bash

sudo -u oneadmin env HOME=/var/lib/one \
  onevm terminate restricted-api-test \
  --hard \
  --user restrictedapi \
  --password StrongTempPass123!

Technical Analysis

Although the value appears intended as an example, it is embedded in commands that operators can copy and run unchanged. This can result in deployments sharing a publicly known credential. The password is also passed as a command-line argument, which may expose it through shell history, process inspection, terminal logs, automation logs, or audit records.

The account is described as restricted rather than administrative, but it has sufficient authority to list, create, and hard-terminate VMs. A predictable password therefore remains security-sensitive.

Attack Path

1. An operator follows the setup guide verbatim and creates restrictedapi with StrongTempPass123!.
2. The password remains unchanged after setup or is placed in API configuration.
3. An attacker identifies a reachable OpenNebula authentication surface or obtains local access to the service environment.
4. The attacker authenticates using the public ...[truncated 832 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the literal password with an unmistakable nonfunctional placeholder such as <GENERATE_A_UNIQUE_SECRET>.
• Generate a cryptographically random credential independently for every deployment.
• Require password rotation immediately if a temporary bootstrap credential is used.
• Store the secret in a protected secret manager or root-readable credential file rather than JSON configuration.
• Avoid passing passwords directly on command lines. Use the OpenNebula client's protected credential mechanism, standard input where supported, or a securely permissioned authentication file.
• Add explicit warnings that published example values must never be used in a real deployment.
• Review existing installations for use of StrongTempPass123! and rotate any matching credentials.
• Restrict the account to the minimum curated templates, networks, images, and VM operations required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

Allowing deletion by a free-form vm_id_or_name path parameter creates a dangerous control surface because an agent or caller can target arbitrary VMs by either identifier or name. In this skill context, the API performs hard termination, so ambiguous or insufficiently constrained targeting can result in irreversible destruction of the wrong VM or unauthorized deletion outside the intended disposable scope.

Content

Scanner excerpt · references/api.md (reported line 12)May include surrounding context.

md

- `GET /health`
- `GET /vms`
- `POST /vms`
- `DELETE /vms/<vm_id_or_name>`

Prefer readable VM and template names over numeric identifiers whenever possible.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

The example encourages deletion by name, which is risky when names may be user-chosen, duplicated, mistyped, or manipulated by an upstream agent. Because the documented delete operation maps to hard terminate, a mistaken or abused name parameter can cause immediate and irreversible loss of the wrong disposable VM, and potentially other VMs if server-side scoping is weak.

Content

Scanner excerpt · references/api.md (reported line 43)May include surrounding context.

Delete by name when possible:

text

DELETE /vms/test-nebula-api-2026-04-10

Expected environment inputs

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill describes and bundles shell-based operational capabilities (scripts/vm_api.sh) but does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch can cause the agent runtime to expose broader shell access than reviewers expect, increasing the risk of unintended command execution or misuse of local host capabilities while performing VM control tasks.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 66)May include surrounding context.

md

The API can also expose a configured curated template catalog via `GET /templates` and in the `templates` field of `GET /health` and `GET /vms`.

## Curl examples

Health:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file documents a delete operation and explicitly notes that the path maps to a hard terminate action in OpenNebula, but it does not include a clear caution about data loss or irreversibility for users invoking the skill. Under the markdown-specific missing-warning rule, destructive behavior that can affect system integrity should be accompanied by an explicit warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation embeds a concrete password directly in shell commands, which encourages insecure copy/paste use and exposes credentials via shell history, process arguments, logs, and screenshots. In this skill's context, the password is for a control-plane account that can provision and terminate VMs, so compromise could enable unauthorized infrastructure actions.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 17)May include surrounding context.

Create the restricted user

bash

sudo -u oneadmin env HOME=/var/lib/one \
  oneuser create restrictedapi StrongTempPass123!

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 24)May include surrounding context.

Create the restricted user

bash

sudo -u oneadmin env HOME=/var/lib/one \
  oneuser create restrictedapi StrongTempPass123!

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 33)May include surrounding context.

Create the restricted user

bash

sudo -u oneadmin env HOME=/var/lib/one \
  oneuser create restrictedapi StrongTempPass123!

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 35)May include surrounding context.

Create the restricted user

bash

sudo -u oneadmin env HOME=/var/lib/one \
  oneuser create restrictedapi StrongTempPass123!

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 42)May include surrounding context.

Create the restricted user

bash

sudo -u oneadmin env HOME=/var/lib/one \
  oneuser create restrictedapi StrongTempPass123!

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 44)May include surrounding context.

Create the restricted user

bash

sudo -u oneadmin env HOME=/var/lib/one \
  oneuser create restrictedapi StrongTempPass123!

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 51)May include surrounding context.

Create the restricted user

bash

sudo -u oneadmin env HOME=/var/lib/one \
  oneuser create restrictedapi StrongTempPass123!

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 53)May include surrounding context.

Create the restricted user

bash

sudo -u oneadmin env HOME=/var/lib/one \
  oneuser create restrictedapi StrongTempPass123!

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Although the sudo itself is not the main issue, this command passes the restricted user's password on the command line, exposing it to shell history, process listings, audit logs, and operational artifacts. Because the account can query and control VM resources through the control plane, leaked credentials can enable unauthorized enumeration and subsequent infrastructure misuse.

Content

Scanner excerpt · references/setup.md (reported line 62)May include surrounding context.

List:

bash

sudo -u oneadmin env HOME=/var/lib/one \
  onevm list --csv --user restrictedapi --password StrongTempPass123!

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This example again exposes credentials on the command line while invoking VM instantiation capability, which is more sensitive because it allows creation of compute resources and potentially cost or abuse escalation. In the context of a disposable VM provisioning skill, compromise of these credentials could let an attacker create arbitrary allowed VMs for persistence, staging, or resource exhaustion.

Content

Scanner excerpt · references/setup.md (reported line 69)May include surrounding context.

Create:

bash

sudo -u oneadmin env HOME=/var/lib/one \
  onetemplate instantiate curated-ubuntu-24-04-for-nebula-claw-developer \
  --name restricted-api-test \
  --user restrictedapi \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file provides a hard-delete example using onevm terminate --hard but does not warn that it will irreversibly destroy the VM and any unsaved data. For markdown files, destructive operations that can affect user data or system integrity should be accompanied by a clear warning.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This command combines destructive VM termination with command-line credential exposure, creating both confidentiality and integrity risk. If the password is leaked, an attacker could terminate disposable or mistakenly broader-scoped VMs allowed to that account, disrupting development workflows or causing broader service impact if scoping is misconfigured.

Content

Scanner excerpt · references/setup.md (reported line 79)May include surrounding context.

Delete:

bash

sudo -u oneadmin env HOME=/var/lib/one \
  onevm terminate restricted-api-test \
  --hard \
  --user restrictedapi \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

Recommending passwordless sudo for the service account introduces a significant privilege boundary concern because any weakness in the API or wrapper logic could be chained into privileged execution of the allowed one* binaries. In this skill's context, the API provisions and terminates VMs; if an attacker can influence arguments or exploit the service, passwordless sudo can amplify impact into broader control-plane abuse or lateral effects on the host.

Content

Scanner excerpt · references/setup.md (reported line 110)May include surrounding context.

md

- Keep the curated `templates` allowlist small and documented with descriptions.
- Add TTL-based cleanup for disposable VMs.
- Restrict bind address and network exposure according to the deployment.
- Ensure the service account has passwordless sudo for the exact `one*` binaries used by the API, otherwise systemd runs can hang on sudo prompts.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/vm_api.sh (reported line 35)May include surrounding context.

sh

usage
      exit 1
    fi
    curl -s -X POST "$NEBULA_CLAW_DEVELOPER_API_BASE/vms" \
      -H "Content-Type: application/json" \
      -d "{\"template_name\":\"$template_name\",\"name\":\"$vm_name\"}"
    ;;

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The delete command issues an HTTP DELETE request against the VM API, which is a destructive and potentially irreversible operation. The script provides no confirmation prompt, warning message, or other user-facing disclosure before performing the deletion.

Content

No source excerpt is available for this finding.