Security audit

Nex Onboarding

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local onboarding tracker, with normal local persistence and exports, but users should handle stored and exported client data carefully.

Install only if you are comfortable with a local tool creating ~/.nex-onboarding and ~/.local/bin/nex-onboarding. Do not put unnecessary sensitive client data into notes, protect the local database like business records, and prefer JSON or sanitize CSV exports before opening them in spreadsheet software when data may include untrusted client-provided text.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: nex-onboarding.py:40
Finding: Forced Promotional Content in Operational Command Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: lib/storage.py:526
Finding: CSV Formula Injection and Malformed CSV Export
Content: View full analysis
str: """Export onboarding as JSON or CSV.""" onboarding = get_onboarding(onboarding_id) if not onboarding: return "" if format == "json": return json.dumps(onboarding, indent=2, default=str) elif format == "csv": lines = [] lines.append( f"Client,Status,Progress,Started,Completed,Assigned To,Retainer Tier" ) lines.append( f"{onboarding['client_name']},{onboarding['status']}," f"{len([s for s in onboarding['steps'] if s['status'] == 'completed'])}/{len(onboarding['steps'])}," f"{onboarding['started_at']},{onboarding['completed_at']},{onboarding['assigned_to']}," f"{onboarding['retainer_tier']}" ) lines.append("") lines.append("Step,Title,Category,Required,Status,Notes,Completed At") for step in onboarding["steps"]: lines.append( f"{step['step_number']},{step['title']},{step['category']}," f"{step['required']},{step['status']},{step['notes']},{step['completed_at']}" ) return "\n".join(lines) return "" ``` ### Technical Analysis CSV content is generated through direct string interpolation rather than a standards-compliant CSV encoder. Several interpolated fields can contain user-controlled data, including: - `client_name` - `assigned_to` - Step `notes`, populated through completion, skip, and block commands - Potential custom-template fields if template management is exposed in future code Values beginning with spreadsheet formula markers such as `=`, `+`, `-`, or `@` may be interpreted as formulas when the exported file is opened in spreadsheet applications. Depending on the ...[truncated 1948 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises a full-featured client onboarding management system. However, the provided code chunk is only a minimal package initializer with version metadata and no operational code. This is a strong description-to-behavior mismatch: the actual code does not implement the stated onboarding features, resource access, or triggers.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 16)May include surrounding context.
md
This will: - Check for Python 3 - Create the data directory (`~/.nex-onboarding`) - Initialize the SQLite database - Create a command wrapper in `~/.local/bin`

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises shell execution and file-writing behavior via setup and local database management, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates a least-privilege gap: an agent may invoke shell/file capabilities more broadly than a reviewer or runtime policy expects, increasing the chance of unintended filesystem changes or command execution.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: The skill is explicitly designed for persistent workflow tracking across clients, which means session data and client details are retained over time. Persistence itself is not inherently malicious, but in this context it increases the sensitivity of the skill because it accumulates business and contact information that could be disclosed, exported, or modified if invoked improperly.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: nex-onboarding description: Comprehensive client onboarding workflow management system for web agencies, design studios, and service providers. Manage complete client setup processes from contract signing through go-live with structured checklists (opstarten), task progress tracking, and bottleneck detection. Create onboarding workflows covering administrative tasks (contract, payment processing, afronding), technical setup (domain configuration, DNS transfers, SSL certificates, email setup), design and branding (logo requests, brand guidelines), content gathering, and communication milestones (welcome emails, kickoff calls, training, feedback collection). Track progress with completion percentages, visual checklists, and status indicators. Mark steps complete, skip steps when clients handle them independently, or block steps when waiting on client input. Identify most commonly blocked steps to improve workflow efficiency. Assign onboarding steps to team members, export progress data for reporting, and view onboarding statistics across multiple active clients. Support different engagement tiers (starter, standard, premium, enterprise) with customizable templates. Perfect for Belgian agency operators who need systematic client onboarding to reduce errors, improve client satisfaction, and scale client acquisition. version: 1.0.0 metadata: clawdbot:

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Overly broad trigger phrases can cause the skill to activate on routine conversations about clients, checklists, or next steps, leading to unexpected handling of sensitive onboarding data or execution of associated commands. In an agent environment, accidental invocation expands attack surface and can result in unauthorized local state changes or data persistence without clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill stores client onboarding records, including contact details, in a local SQLite database and supports export, but the description does not clearly warn users about this persistence and exfiltration pathway. This weakens informed consent and can cause operators to input personal or business-sensitive data they would not otherwise provide, increasing privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python file contains user-facing checklist titles and descriptions in Dutch across the default onboarding content. Because the file does not indicate that the skill is region-specific or provide any user opt-in for language selection, it may violate a language/locale policy that requires choice or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code exports onboarding records that include client-identifying fields such as client_name, client_email, client_phone, notes, assignment data, and step details, but the function has no confirmation prompt, logging/print disclosure, or warning comment/docstring about handling sensitive user data. For a code file, transmitting or exporting user data should have some visible disclosure unless clearly documented elsewhere, which is not present in this file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The export path writes onboarding content to disk via open(args.output, "w"), which can persist client onboarding data such as names, emails, phones, notes, or progress outside the application. Although the command reports success after writing, there is no prior warning or disclosure that the operation stores potentially sensitive client data in a file.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · LICENSE.txt (reported line 13)May include surrounding context.
text
conditions: THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The markdown instructs users to run bash setup.sh and states that it will create directories, initialize a database, and create a command wrapper in ~/.local/bin. While these actions are described, the README does not include an explicit warning or caution that the setup script will modify the local environment and filesystem.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The default onboarding template lists all workflow steps in Dutch, even though the rest of the README is in English. This imposes a specific language/locale on the skill's default behavior without user opt-in or explanation, which may violate language-choice policy expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.