Cogmate Client

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:24 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent Cogmate API client, but it handles access tokens in URLs, command lines, and HTTP examples in ways that can leak private knowledge access.

Review before installing. Use this only with Cogmate instances you trust, prefer HTTPS-only endpoints, use the lowest-scope and shortest-lived token available, and avoid typing real tokens directly into the provided helper-script command lines. If you already used these examples with a real token, rotate that token and check server or proxy logs for exposure.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:15

Finding

Access tokens and sensitive queries may be transmitted over plaintext HTTP

Content

View full analysis

Remediation

View remediation

&2; exit 1 ;; esac ``` 3. Replace all documented `http://` examples with HTTPS examples. 4. Do not add `curl -k` or otherwise disable certificate verification. 5. Where deployments need custom certificate authorities, support an explicit trusted CA file rather than bypassing TLS verification. 6. Consider an allowlist or explicit confirmation for unfamiliar hosts because the caller-selected endpoint receives both credentials and user data. 7. Clearly document that questions, searches, and returned knowledge may be sensitive and are transmitted to the configured Cogmate operator. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ask.sh:3

Finding

Access tokens are exposed through command-line arguments and URL query parameters

Content

View full analysis

"question" COGMATE_URL="${1%/}" TOKEN="$2" QUESTION="$3" if [ -z "$COGMATE_URL" ] || [ -z "$TOKEN" ] || [ -z "$QUESTION" ]; then echo "Usage: $0 \"question\"" echo "Example: $0 http://example.com:8000 tok_xxx \"What do you know about AI?\"" exit 1 fi curl -s -X POST "${COGMATE_URL}/api/ask?token=${TOKEN}" \ ``` From `scripts/search.sh`: ```bash # Usage: ./search.sh "search term" COGMATE_URL="${1%/}" TOKEN="$2" SEARCH="$3" if [ -z "$COGMATE_URL" ] || [ -z "$TOKEN" ]; then echo "Usage: $0 [search_term]" echo "Example: $0 http://example.com:8000 tok_xxx \"AI\"" exit 1 fi PARAMS="token=${TOKEN}" [ -n "$SEARCH" ] && PARAMS="${PARAMS}&search=${SEARCH}" curl -s "${COGMATE_URL}/api/visual/facts?${PARAMS}" | \ ``` ### Technical Analysis Both scripts require the token as a positional command-line argument. Depending on the operating system and execution environment, process arguments may be visible to other local users, process-monitoring agents, audit systems, terminal logs, or shell history. The scripts then place the token in the URL query string. Query strings are commonly retained in reverse-proxy access logs, API server logs, network monitoring products, tracing platforms, browser or tooling history, and diagnostic output. HTTPS protects a URL while it is in transit but does not prevent endpoint-side or local process logging. This credential exposure is avoidable and therefore does not satisfy least-privilege handling of authentication material. ### Attack Path 1. A victim invokes a helper script with a valid t ...[truncated 985 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/search.sh:13

Finding

Question and search inputs are interpolated without JSON or URL encoding

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: cogmate-client
description: Access Cogmate personal knowledge systems via API. Use when querying someone's Cogmate/模拟世界 for knowledge retrieval, semantic search, or Q&A. Requires valid access token from CogNexus (https://github.com/MaxiiWang/CogNexus). Triggers on: "ask Cogmate", "query knowledge base", "search Cogmate", "access 模拟世界".
---

# Cogmate Client

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

---
name: cogmate-client
description: Access Cogmate personal knowledge systems via API. Use when querying someone's Cogmate/模拟世界 for knowledge retrieval, semantic search, or Q&A. Requires valid access token from CogNexus (https://github.com/MaxiiWang/CogNexus). Triggers on: "ask Cogmate", "query knowledge base", "search Cogmate", "access 模拟世界".
---

# Cogmate Client

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

Browse or search facts.

**Parameters:**
- `token` (required): Access token
- `search` (optional): Search query
- `layer` (optional): Filter by layer (fact/connection/abstract)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-details.md (reported line 66)May include surrounding context.

md

### /api/visual/facts

**Query Parameters:**
- `token`: Access token (required)
- `search`: Search query (optional)
- `layer`: Filter by layer - fact/connection/abstract (optional)
- `limit`: Max results (optional, default 50)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The curl example sends a secret in the request URL and uses an http:// endpoint, combining credential exposure with lack of transport security. This makes interception and downstream logging of the token much more likely, especially if copied directly by users.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

Ask a Question

bash

curl -X POST "http://{COGMATE_URL}/api/ask?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"question": "你的问题"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation explicitly instructs users to place access tokens in URL query parameters, including over plain HTTP in examples. Query-string tokens are commonly exposed through browser history, logs, reverse proxies, monitoring systems, shell history, and referrer leakage, making accidental credential disclosure materially more likely.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This example code transmits the token to an external service as a URL parameter, which exposes it to intermediary logging and telemetry even if the transmission itself is intended. In context, the skill is designed to contact external Cogmate instances, so the issue is not the outbound request itself but the unsafe method of including the credential.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

TOKEN = "your_token_here"

# Ask a question (token in query params, question in body)
response = requests.post(
    f"{COGMATE_URL}/api/ask",
    params={"token": TOKEN},
    json={"question": "What are the key insights about X?"}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation explicitly instructs clients to pass bearer-style access tokens in the URL query string. Query parameters are commonly exposed in browser history, server logs, reverse proxy logs, referrer headers, analytics systems, and shared screenshots, so this pattern increases the chance of token leakage even if TLS is used. In this context, the token grants access to protected API endpoints, making accidental disclosure security-relevant.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The script places the authentication token in the URL query string when making the POST request. Query parameters are commonly exposed through shell history, process listings, reverse proxies, web server access logs, and monitoring systems, which can lead to credential disclosure even if the request otherwise succeeds.

Content

Scanner excerpt · scripts/ask.sh (reported line 15)May include surrounding context.

sh

exit 1
fi

curl -s -X POST "${COGMATE_URL}/api/ask?token=${TOKEN}" \
    -H "Content-Type: application/json" \
    -d "{\"question\": \"${QUESTION}\"}" | \
    python3 -c "import sys,json; r=json.load(sys.stdin); print(r.get('answer','No answer'))"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script performs a network POST request that transmits the supplied question and authentication token to a remote Cogmate server. While the header comments show usage, there is no confirmation prompt, runtime notice, or explicit warning to the user that their input and credential are being sent over the network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script accepts the API token as a positional command-line argument and then places it into the query string of the request URL. This exposes the token through shell history, process listings, proxy/server logs, browser or terminal history, and intermediary monitoring systems, which can lead to credential theft and unauthorized API access.

Content

No source excerpt is available for this finding.