Security audit

Nomad Backup

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a read-only Nomad helper, but it includes broad variable-reading and an unsafe shell example that deserve review before installation.

Review before installing. Use this only with a least-privilege Nomad ACL token, avoid granting variable-read access unless needed, do not paste or display secret variable values in chat, and validate or safely quote job IDs before running the shell examples.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:122
Finding: Arbitrary Nomad Variable Retrieval May Expose Secrets
Content: View full analysis
``` ``` ### Technical Analysis The skill is presented as a read-only monitoring and troubleshooting utility, but it instructs the agent to enumerate and retrieve arbitrary Nomad variables. Nomad variables may contain application credentials, API tokens, private configuration, or other sensitive values. Although these commands do not modify the cluster and remain subject to Nomad ACL enforcement, read-only access can still disclose secrets. The skill provides no path allowlist, output redaction, confirmation requirement, or warning against displaying sensitive values in model responses, command logs, or conversation history. Exploitation depends on the configured `NOMAD_TOKEN` having permission to list or read variables. The commands do not bypass Nomad ACLs; the accessible scope is limited to the token's existing permissions. ### Attack Path 1. The agent runs with a `NOMAD_TOKEN` that permits reading Nomad variables. 2. An attacker or untrusted user supplies or influences a sensitive variable path. 3. The agent follows the skill instructions and executes `nomad var get `. 4. Nomad returns the variable content under the authority of the configured token. 5. Sensitive values may be exposed through terminal output, agent context, logs, or the final response. ### Impact Assessment An attacker could obtain any Nomad variable readable by the configured ACL token. Depending on the cluster configuration, this may expose service credentials, API keys, deployment configuration, or tokens that enable access to other systems. The issue does not inherently grant permissions beyond those already assigned to `NOMAD_TOKEN`, but it may misuse b ...[truncated 103 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:166
Finding: Unquoted Job Identifier in Shell Command Substitution
Content: View full analysis
| jq -r '.[0].ID') ``` ``` ### Technical Analysis The documented command places the `` placeholder unquoted inside a shell expression that also uses command substitution and a pipeline. If an agent replaces this placeholder with attacker-controlled text without validating it, shell metacharacters such as command separators, substitutions, or redirections may be interpreted by the local shell. This can convert what appears to be a Nomad query into arbitrary local command execution. The vulnerability is conditional on the command being constructed as a shell string and the supplied job identifier being inserted verbatim. A caller that validates identifiers and invokes commands through argument arrays rather than a shell would not be vulnerable. ### Attack Path 1. An attacker supplies a crafted value where the workflow expects a Nomad job identifier. 2. The agent substitutes that value directly for `` in the documented shell template. 3. The agent passes the resulting command to a shell. 4. The shell interprets injected metacharacters or command-substitution syntax. 5. The injected command executes with the operating-system privileges and environment of the agent process. 6. The attacker may use that execution to read local files, access environment variables such as `NOMAD_TOKEN`, alter user-accessible data, or contact external systems where network policy permits. ### Impact Assessment Successful exploitation can execute arbitrary commands under the local account running the skill. This may expose Nomad credentials, client certificates, local configuration, and any files readable by that account. It may also allow modification of file ...[truncated 313 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description and manifest claim a limited read-only scope focused on jobs, nodes, allocations, evaluations, and services, but the documented commands also include namespace enumeration and Nomad variable access. Even if still read-only, nomad var list and nomad var get can expose sensitive configuration or secrets, and the mismatch can cause users or agents to invoke broader data access than expected.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.