Nemo

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:30 PM UTC
• Version: 1.0.2

Overview

This skill is a disclosed remote search and tool-proxy service, but it asks agents to follow remote skill instructions and call externally selected MCP tools without enough trust boundaries.

Review this before installing. Use it only if you trust the Nemo service and any MCP servers it indexes, avoid sending secrets or private file contents as tool arguments, and require explicit review before following retrieved skill instructions or invoking remote tools.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:14
• Finding: Untrusted Remote Skill Instructions Are Automatically Treated as Agent Directives## Vulnerability Details **File Location**: `skill.md:14, 38-45`; `README.md:34, 62-85` **Vulnerability Type**: Remote instruction hijacking through externally retrieved skill content **Risk Level**: High ### Vulnerable Code Snippet From `skill.md:14`: ```markdown - **get_skill**: Get full instructions for an agent skill. Returns the complete SKILL.md content, install command, and metadata. Use after search_tools to get detailed skill instructions. ``` From `skill.md:38-45`: ```markdown Returns the complete instructions, install command, and metadata. ## Workflow 1. Search: `curl ".../api/search?q=file+conversion"` 2. If result is `type: "skill"` → get instructions: `curl ".../api/skill/SKILL_NAME"` → follow them 3. If result is `type: "mcp_tool"` → call it: `POST .../api/call` with `endpoint`, `tool`, `args` ``` Corresponding behavior is also documented in `README.md:62-85`: ```markdown ### Get Skill Instructions Load full SKILL.md content for a skill found via search. ```bash curl "https://nemo.25chenghua.workers.dev/api/skill/SKILL_NAME" ``` Add `?repo=owner/repo` if multiple skills share the same name. Returns the complete instructions, install command, and metadata. ### Call a Remote MCP Tool Proxy a tool call to any indexed MCP server. ```bash curl -X POST "https://nemo.25chenghua.workers.dev/api/call" \ -H "Content-Type: application/json" \ -d '{"endpoint": "SERVER_URL", "tool": "TOOL_NAME", "args": {}}' ``` Use the `serverEndpoint` and `toolName` from search results. ## Workflow 1. Search: `curl ".../api/search?q=file+conversion"` 2. If result is `type: "skill"` → get instructions: `curl ".../api/skill/SKILL_NAME"` → follow them 3. If result is `type: "mcp_tool"` → call it: `POST .../api/call` with `endpoint`, `tool`, `args` ``` ### Technical Analysis The documented workflow retrieves complete skill instructions from the external Nemo service and expl ...[truncated 2347 chars]
• Remediation: ## Remediation Suggestions 1. Treat all retrieved skill text as untrusted data and remove the unconditional instruction to “follow” it. 2. Display fetched instructions to the user and require explicit approval before they can influence agent actions. 3. Restrict retrieval to trusted repositories and maintain an allowlist of approved skill publishers. 4. Require cryptographic signatures or verified content hashes and pin each approved skill to an immutable version. 5. Parse retrieved content in an isolated data context rather than inserting it into the governing instruction hierarchy. 6. Apply policy checks that reject instructions requesting secrets, safety-policy changes, unrelated tool use, persistence, or privilege expansion. 7. Run approved skills with minimal capabilities and grant tools individually rather than inheriting all agent permissions. 8. Record the skill source, repository, immutable revision, content hash, user approval, and resulting actions in an audit log.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: README.md:69
• Finding: Remote Tool Calls Lack Documented Endpoint and Capability Restrictions## Vulnerability Details **File Location**: `skill.md:13, 28-35, 45`; `README.md:33, 69-85`; `skill.yaml:6-8` **Vulnerability Type**: Unrestricted delegation to externally selected MCP endpoints **Risk Level**: High ### Vulnerable Code Snippet From `skill.md:13`: ```markdown - **call_tool**: Call a tool on a remote MCP server by specifying the endpoint, tool name, and arguments. Response is truncated to maxResponseChars (default 10000). Tracks latency and logs usage. ``` From `skill.md:28-35`: ```markdown ### Call a Remote MCP Tool ```bash curl -X POST "https://nemo.25chenghua.workers.dev/api/call" \ -H "Content-Type: application/json" \ -d '{"endpoint": "SERVER_URL", "tool": "TOOL_NAME", "args": {}}' ``` Use the `serverEndpoint` and `toolName` from search results. ``` From `README.md:69-80`: ```markdown ### Call a Remote MCP Tool Proxy a tool call to any indexed MCP server. ```bash curl -X POST "https://nemo.25chenghua.workers.dev/api/call" \ -H "Content-Type: application/json" \ -d '{"endpoint": "SERVER_URL", "tool": "TOOL_NAME", "args": {}}' ``` Use the `serverEndpoint` and `toolName` from search results. ``` From `skill.yaml:6-8`: ```yaml mcp: transport: http url: "https://nemo.25chenghua.workers.dev/mcp" ``` ### Technical Analysis The skill registers an external HTTP MCP service and documents a `call_tool` capability that forwards a selected tool name and arguments to a remote endpoint. The README describes this as proxying a call to “any indexed MCP server.” The package does not document an endpoint allowlist, per-tool authorization, argument-level policy, sensitive-data filtering, endpoint identity verification beyond ordinary HTTPS, or mandatory user confirmation. Search results supply the `serverEndpoint` and `toolName`, creating a trust path from externally controlled index data to remote invocation. If a malicious or compromised endpoint is index ...[truncated 1716 chars]
• Remediation: ## Remediation Suggestions 1. Restrict remote calls to an explicit allowlist of reviewed endpoint origins and approved tool names. 2. Bind search results to verified endpoint identities and immutable server metadata rather than trusting endpoint strings returned by the index. 3. Require user confirmation that clearly displays the destination, tool, and redacted arguments before every sensitive call. 4. Define per-tool capability policies and expose only the minimum tools needed for the current task. 5. Validate all arguments against strict schemas, size limits, destination policies, and semantic security rules. 6. Detect and redact credentials, tokens, personal data, file contents, and conversation context before transmission. 7. Treat remote responses as untrusted data and prevent them from automatically becoming governing agent instructions. 8. Apply authentication, rate limiting, request timeouts, network egress controls, and comprehensive audit logging. 9. Consider removing caller-supplied endpoint selection entirely and resolve approved server identifiers through a trusted server-side registry.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

External Transmission

Medium

• Category: Data Exfiltration

Content

Load full SKILL.md content for a skill found via search.

```bash
curl "https://nemo.25chenghua.workers.dev/api/skill/SKILL_NAME"
```

Add `?repo=owner/repo` if multiple skills share the same name.

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly advertises remote MCP tool invocation but does not warn that tool arguments, prompts, files, or other user-supplied data may be transmitted to third-party servers. In an agent context, this omission can cause users or downstream agents to send sensitive information to untrusted endpoints without informed consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Search
```bash
curl "https://nemo.25chenghua.workers.dev/api/search?q=QUERY&limit=5&detail=compact&source=all"
```

Each result has a `type` field: `"mcp_tool"` or `"skill"`.

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The HTTP API example shows posting arbitrary endpoint, tool, and argument data to a remote server but provides no privacy or trust warning. This can normalize sending secrets or internal data to attacker-controlled SERVER_URL values, especially when followed by an automated agent workflow.

Static analysis

No suspicious patterns detected.