ClawHub
Back to skill

Security audit

Nexus Brain

Security checks for vulnerabilities and agentic risk

Overview

This SRE skill is mostly coherent, but it needs Review because it can read operational logs, send them to an external AI tool, and support recovery actions with limited scoping and safeguards.

Review this before using it in production. Use a trusted, fixed opencode binary, pin dependencies, restrict which logs may be analyzed, require explicit approval for restarts or other recovery actions, and do not rely on the built-in regex redaction to protect secrets.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
bridge.py:6
Finding

Incomplete Redaction of Sensitive Data Before External AI Processing

Content
View full analysis
` headers - Session cookies and cookie headers - Private keys and certificate material - Database connection strings containing credentials - Cloud-provider access keys - Provider-specific API key formats - Tokens whose labels contain hyphens or underscores - Multiline or whitespace-containing secrets - Unlabeled credentials appearing in log messages Consequently, the call to `redact_logs()` does not establish that the resulting prompt is safe to transmit. The documentation's broad claim that passwords, tokens, and related data are masked may also give operators a false sense of protection. ### Attack Path 1. A diagnostic prompt or log contains sensitive data in a format not recognized by the two redaction expressions. 2. The user passes t ...[truncated 1036 chars]
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Warning
Location
bridge.py:17
Finding

PATH-Based Opencode Executable Hijacking

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:19
Finding

Unpinned Python Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The code resolves the target executable using PATH via which, allowing execution of whichever matching binary appears first in the environment. In attacker-controlled or untrusted environments, PATH hijacking can cause a malicious opencode binary to be selected and executed, leading to arbitrary code execution under the current user's privileges.

Content

Scanner excerpt · bridge.py (reported line 18)May include surrounding context.

python
def ask_orchestrator(prompt, target_binary="opencode"):
    # First, try to find the binary in PATH, then fallback to user home
    opencode_path = subprocess.run(["which", target_binary], capture_output=True, text=True).stdout.strip()
    if not opencode_path:
        opencode_path = os.path.expanduser("~/.opencode/bin/opencode")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
90% confidence
Finding

The code passes user-controlled prompt content directly to an external executable, which creates a trust-boundary crossing and can leak sensitive input to another program for processing. Although shell injection is avoided by using an argument list, the external binary may log, retain, transmit, or misuse the prompt, and the in-code redaction is only partial and regex-based.

Content

Scanner excerpt · bridge.py (reported line 28)May include surrounding context.

python
try:
        # Sanitize prompt (basic)
        safe_prompt = redact_logs(prompt)
        res = subprocess.run([opencode_path, "run", safe_prompt], capture_output=True, text=True, timeout=60)
        return res.stdout if res.returncode == 0 else f"AI Error: {res.stderr}"
    except Exception as e:
        return f"Orchestrator Bridge Error: {str(e)}"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Prompt content is sent to an external AI-related binary without any user-facing disclosure, creating a privacy and data-governance risk. Because prompts may contain credentials, internal data, or personal information, silent forwarding to another tool is dangerous, especially since the implemented redaction only covers a small subset of possible secrets.

Content

No source excerpt is available for this finding.