Cerebrun

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:04 PM UTC
• Version: 1.0.1

Overview

This skill is a coherent Cerebrun client, but it handles very sensitive personal data and outbound LLM messages with too little user-facing scoping and warning.

Install only if you trust Cerebrun with personal context, stored knowledge, conversation history, and any Layer 2 or vault-adjacent data. Prefer CEREBRUN_API_KEY over --api-key, avoid sending secrets or retrieved private context through chat_with_llm unless you explicitly intend to, and review any update_context or push_knowledge use because those change persistent remote data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cerebrun.py:154

Finding

Bearer API Token Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/cerebrun.py:154-155 and SKILL.md:59-64
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

scripts/cerebrun.py:154-155:

python

parser.add_argument("--api-key", default=os.getenv("CEREBRUN_API_KEY"),
                    help="Cerebrun API key (or CEREBRUN_API_KEY env)")

SKILL.md:59-64:

markdown

scripts/cerebrun.py get_context --layer 0 --api-key YOUR_KEY
scripts/cerebrun.py search_context --query "project" --api-key YOUR_KEY
scripts/cerebrun.py push_knowledge --content "New idea" --category "todo" --api-key YOUR_KEY

markdown

Store API key in environment: `CEREBRUN_API_KEY` or pass via `--api-key`

Technical Analysis

The CLI accepts the Cerebrun bearer token directly through the --api-key argument, and the documentation actively demonstrates this usage. Command-line arguments may be retained in shell history and exposed through process inspection, endpoint monitoring, terminal logging, command auditing, or diagnostic data.

This token is subsequently placed in the HTTP Authorization header and transmitted to the declared https://cereb.run/mcp endpoint. Sending the token to that endpoint over HTTPS is necessary for the advertised remote-client functionality. The vulnerability is not the intended network request itself, but the avoidable exposure created by accepting and documenting the secret as a command-line argument.

Attack Path

1. A user follows the documented example and invokes the script using --api-key with a real bearer token.
2. The command containing the token is recorded in shell history, process metadata, monitoring telemetry, or audit logs.
3. A local user, compromised process, administrator, or party with access to collected logs retrieves the exposed token.
4. The attacker submits authenticated requests to ...[truncated 953 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --api-key command-line option so secrets cannot be supplied through process arguments.
2. Prefer a protected credential source such as an operating-system keyring, a secret manager, or a configuration file restricted to the current user.
3. Retain CEREBRUN_API_KEY only as a compatibility mechanism and document the security implications of environment-based secrets.
4. If interactive operation is required, obtain the token with getpass.getpass() so it is not echoed or stored in shell history.
5. Replace all documentation examples that use --api-key with secure credential-setup instructions.
6. Ensure errors, debug output, telemetry, and HTTP diagnostics never include the Authorization header or token value.
7. Encourage short-lived, narrowly scoped tokens and provide token rotation and revocation guidance in case exposure is suspected.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill description advertises retrieval and management of highly sensitive personal context, including identity data, API keys, and an encrypted vault, but does not present a clear privacy and consent warning. This is dangerous because users or downstream agents may invoke the skill without understanding that secrets and personal information can be transmitted to a remote service and possibly to third-party LLM providers via the gateway.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

The chat_with_llm command is a legitimate feature, but in this skill context it creates a realistic exfiltration path because data from user context, knowledge base, or conversation history can be packaged into a prompt and sent to external LLM providers. The danger is amplified by the same skill bundling both sensitive-data retrieval and outbound messaging capabilities in one place.

Content

Scanner excerpt · references/REFERENCES.md (reported line 174)May include surrounding context.

text

### chat_with_llm
Send message to an LLM through the Gateway.

**Parameters:**
- `message` (required): Message to send

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script exposes a direct function to request access to encrypted vault data without any local confirmation, policy check, or interactive warning. In this skill's context, the vault likely contains the user's most sensitive secrets or identity data, so a thin wrapper that makes vault requests easy is materially dangerous if invoked by an untrusted workflow or prompt-injected agent.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 95% confidence

Finding

The chat function transmits arbitrary user messages to an external LLM provider, which is an exfiltration path for sensitive data if the caller includes secrets, personal context, or proprietary material. In this skill, that risk is amplified because the surrounding features encourage retrieval of memory, knowledge, and conversation history that could then be forwarded to third-party models.

Content

Scanner excerpt · scripts/cerebrun.py (reported line 92)May include surrounding context.

python

def chat_with_llm(api_key: str, message: str, provider: str, model: str,
                  conversation_id: str = None, title: str = None):
    """Send message to LLM via Gateway"""
    params = {
        "message": message,
        "provider": provider,

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · references/REFERENCES.md (reported line 225)May include surrounding context.

md

return make_request(api_key, "list_knowledge_categories")

def list_tools(api_key: str):
    """List all available MCP tools"""
    payload = {
        "jsonrpc": "2.0",
        "id": 1,

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · scripts/cerebrun.py (reported line 152)May include surrounding context.

python

return make_request(api_key, "list_knowledge_categories")

def list_tools(api_key: str):
    """List all available MCP tools"""
    payload = {
        "jsonrpc": "2.0",
        "id": 1,

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/cerebrun.py (reported line 216)May include surrounding context.

python

p.add_argument("--provider", choices=["openai", "gemini", "anthropic", "ollama"])
    
    # chat_with_llm
    p = subparsers.add_parser("chat_with_llm", help="Send message to LLM")
    p.add_argument("--message", required=True)
    p.add_argument("--provider", required=True)
    p.add_argument("--model", required=True)

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · scripts/cerebrun.py (reported line 254)May include surrounding context.

python

subparsers.add_parser("list_knowledge_categories", help="List knowledge categories")
    
    # list_tools
    subparsers.add_parser("list_tools", help="List available MCP tools")
    
    args = parser.parse_args()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill exposes capabilities that involve environment access and outbound network use, but it does not declare any explicit tool scope or permissions boundaries. For a skill that handles personal context, API keys, and vault data, missing scope declarations increases the risk of over-broad execution and accidental or unauthorized access to sensitive resources.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The documented usage performs external POST requests carrying authorization tokens and personal context to a remote endpoint. External transmission is expected for an MCP client, but in this skill's context it is more dangerous because the transmitted material may include identity information, API keys, vault contents, and conversation history, making disclosure or misuse materially harmful if consent and minimization controls are absent.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

## Usage

### Get Context
curl -X POST \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_context","arguments":{"layer":0}}}' \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented context APIs expose highly sensitive user data, including personal identity information and an encrypted vault, but the reference does not consistently warn that these operations require explicit user awareness, least-privilege access, and special handling for sensitive fields. In a skill whose purpose is memory and personal context management, omission of privacy warnings increases the chance that downstream agents will over-collect or retrieve sensitive context by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The chat_with_llm documentation describes sending arbitrary messages through an external provider but does not warn that prompts and embedded user data may be transmitted to third-party LLM services. Because this skill also provides access to personal context, knowledge base contents, and conversation history, an agent could easily forward sensitive material off-platform without clear disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

These functions retrieve highly sensitive personal context and conversation history from a remote service, but the script provides no execution-time disclosure, consent gate, or data-minimization safeguards. In an agent-skill setting, that increases the risk that a user or calling agent sends or fetches private data without understanding that external transmission and storage are involved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The tool sends user-provided messages and knowledge-base content to a remote API, including LLM gateway interactions, without any execution-time notice or outbound-data review. Because this skill is explicitly designed for personal memory and knowledge management, the likelihood of transmitting sensitive personal or organizational content is high.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The CLI accepts the API key from CEREBRUN_API_KEY, which is sensitive credential material. Although using an environment variable is common, this file does not include any user-facing note about secure handling of the key or caution against exposing it in shell history via command-line arguments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.