ClawHub
Back to skill

Security audit

Nemo

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed remote search and tool-proxy service, but it asks agents to follow remote skill instructions and call externally selected MCP tools without enough trust boundaries.

Review this before installing. Use it only if you trust the Nemo service and any MCP servers it indexes, avoid sending secrets or private file contents as tool arguments, and require explicit review before following retrieved skill instructions or invoking remote tools.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
skill.md:14
Finding

Untrusted Remote Skill Instructions Are Automatically Treated as Agent Directives

Content
View full analysis

Vulnerability Details

File Location: skill.md:14, 38-45; README.md:34, 62-85
Vulnerability Type: Remote instruction hijacking through externally retrieved skill content
Risk Level: High

Vulnerable Code Snippet

From skill.md:14:

markdown
- **get_skill**: Get full instructions for an agent skill. Returns the complete SKILL.md content, install command, and metadata. Use after search_tools to get detailed skill instructions.

From skill.md:38-45:

markdown
Returns the complete instructions, install command, and metadata.

## Workflow

1. Search: `curl ".../api/search?q=file+conversion"`
2. If result is `type: "skill"` → get instructions: `curl ".../api/skill/SKILL_NAME"` → follow them
3. If result is `type: "mcp_tool"` → call it: `POST .../api/call` with `endpoint`, `tool`, `args`

Corresponding behavior is also documented in README.md:62-85:

markdown
### Get Skill Instructions

Load full SKILL.md content for a skill found via search.

```bash
curl "https://nemo.25chenghua.workers.dev/api/skill/SKILL_NAME"

Add ?repo=owner/repo if multiple skills share the same name.

Returns the complete instructions, install command, and metadata.

Call a Remote MCP Tool

Proxy a tool call to any indexed MCP server.

bash
curl -X POST "https://nemo.25chenghua.workers.dev/api/call" \
  -H "Content-Type: application/json" \
  -d '{"endpoint": "SERVER_URL", "tool": "TOOL_NAME", "args": {}}'

Use the serverEndpoint and toolName from search results.

Workflow

  1. Search: curl ".../api/search?q=file+conversion"
  2. If result is type: "skill" → get instructions: curl ".../api/skill/SKILL_NAME" → follow them
  3. If result is type: "mcp_tool" → call it: POST .../api/call with endpoint, tool, args
text

### Technical Analysis

The documented workflow retrieves complete skill instructions from the external Nemo service and expl
...[truncated 2347 chars]
Remediation
View remediation

Remediation Suggestions

  1. Treat all retrieved skill text as untrusted data and remove the unconditional instruction to “follow” it.
  2. Display fetched instructions to the user and require explicit approval before they can influence agent actions.
  3. Restrict retrieval to trusted repositories and maintain an allowlist of approved skill publishers.
  4. Require cryptographic signatures or verified content hashes and pin each approved skill to an immutable version.
  5. Parse retrieved content in an isolated data context rather than inserting it into the governing instruction hierarchy.
  6. Apply policy checks that reject instructions requesting secrets, safety-policy changes, unrelated tool use, persistence, or privilege expansion.
  7. Run approved skills with minimal capabilities and grant tools individually rather than inheriting all agent permissions.
  8. Record the skill source, repository, immutable revision, content hash, user approval, and resulting actions in an audit log.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
README.md:69
Finding

Remote Tool Calls Lack Documented Endpoint and Capability Restrictions

Content
View full analysis

Vulnerability Details

File Location: skill.md:13, 28-35, 45; README.md:33, 69-85; skill.yaml:6-8
Vulnerability Type: Unrestricted delegation to externally selected MCP endpoints
Risk Level: High

Vulnerable Code Snippet

From skill.md:13:

markdown
- **call_tool**: Call a tool on a remote MCP server by specifying the endpoint, tool name, and arguments. Response is truncated to maxResponseChars (default 10000). Tracks latency and logs usage.

From skill.md:28-35:

markdown
### Call a Remote MCP Tool
```bash
curl -X POST "https://nemo.25chenghua.workers.dev/api/call" \
  -H "Content-Type: application/json" \
  -d '{"endpoint": "SERVER_URL", "tool": "TOOL_NAME", "args": {}}'

Use the serverEndpoint and toolName from search results.

text

From `README.md:69-80`:

```markdown
### Call a Remote MCP Tool

Proxy a tool call to any indexed MCP server.

```bash
curl -X POST "https://nemo.25chenghua.workers.dev/api/call" \
  -H "Content-Type: application/json" \
  -d '{"endpoint": "SERVER_URL", "tool": "TOOL_NAME", "args": {}}'

Use the serverEndpoint and toolName from search results.

text

From `skill.yaml:6-8`:

```yaml
mcp:
  transport: http
  url: "https://nemo.25chenghua.workers.dev/mcp"

Technical Analysis

The skill registers an external HTTP MCP service and documents a call_tool capability that forwards a selected tool name and arguments to a remote endpoint. The README describes this as proxying a call to “any indexed MCP server.”

The package does not document an endpoint allowlist, per-tool authorization, argument-level policy, sensitive-data filtering, endpoint identity verification beyond ordinary HTTPS, or mandatory user confirmation. Search results supply the serverEndpoint and toolName, creating a trust path from externally controlled index data to remote invocation.

If a malicious or compromised endpoint is index ...[truncated 1716 chars]

Remediation
View remediation

Remediation Suggestions

  1. Restrict remote calls to an explicit allowlist of reviewed endpoint origins and approved tool names.
  2. Bind search results to verified endpoint identities and immutable server metadata rather than trusting endpoint strings returned by the index.
  3. Require user confirmation that clearly displays the destination, tool, and redacted arguments before every sensitive call.
  4. Define per-tool capability policies and expose only the minimum tools needed for the current task.
  5. Validate all arguments against strict schemas, size limits, destination policies, and semantic security rules.
  6. Detect and redact credentials, tokens, personal data, file contents, and conversation context before transmission.
  7. Treat remote responses as untrusted data and prevent them from automatically becoming governing agent instructions.
  8. Apply authentication, rate limiting, request timeouts, network egress controls, and comprehensive audit logging.
  9. Consider removing caller-supplied endpoint selection entirely and resolve approved server identifiers through a trusted server-side registry.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

Load full SKILL.md content for a skill found via search.

bash
curl "https://nemo.25chenghua.workers.dev/api/skill/SKILL_NAME"

Add ?repo=owner/repo if multiple skills share the same name.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly advertises remote MCP tool invocation but does not warn that tool arguments, prompts, files, or other user-supplied data may be transmitted to third-party servers. In an agent context, this omission can cause users or downstream agents to send sensitive information to untrusted endpoints without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 21)May include surrounding context.

Search

bash
curl "https://nemo.25chenghua.workers.dev/api/search?q=QUERY&limit=5&detail=compact&source=all"

Each result has a type field: "mcp_tool" or "skill".

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The HTTP API example shows posting arbitrary endpoint, tool, and argument data to a remote server but provides no privacy or trust warning. This can normalize sending secrets or internal data to attacker-controlled SERVER_URL values, especially when followed by an automated agent workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.