Cerebrun

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:04 PM UTC
• Version: 1.0.1

Overview

This skill is a coherent Cerebrun client, but it handles very sensitive personal data and outbound LLM messages with too little user-facing scoping and warning.

Install only if you trust Cerebrun with personal context, stored knowledge, conversation history, and any Layer 2 or vault-adjacent data. Prefer CEREBRUN_API_KEY over --api-key, avoid sending secrets or retrieved private context through chat_with_llm unless you explicitly intend to, and review any update_context or push_knowledge use because those change persistent remote data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cerebrun.py:154
• Finding: Bearer API Token Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/cerebrun.py:154-155` and `SKILL.md:59-64` **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code `scripts/cerebrun.py:154-155`: ```python parser.add_argument("--api-key", default=os.getenv("CEREBRUN_API_KEY"), help="Cerebrun API key (or CEREBRUN_API_KEY env)") ``` `SKILL.md:59-64`: ```markdown scripts/cerebrun.py get_context --layer 0 --api-key YOUR_KEY scripts/cerebrun.py search_context --query "project" --api-key YOUR_KEY scripts/cerebrun.py push_knowledge --content "New idea" --category "todo" --api-key YOUR_KEY ``` ```markdown Store API key in environment: `CEREBRUN_API_KEY` or pass via `--api-key` ``` ### Technical Analysis The CLI accepts the Cerebrun bearer token directly through the `--api-key` argument, and the documentation actively demonstrates this usage. Command-line arguments may be retained in shell history and exposed through process inspection, endpoint monitoring, terminal logging, command auditing, or diagnostic data. This token is subsequently placed in the HTTP `Authorization` header and transmitted to the declared `https://cereb.run/mcp` endpoint. Sending the token to that endpoint over HTTPS is necessary for the advertised remote-client functionality. The vulnerability is not the intended network request itself, but the avoidable exposure created by accepting and documenting the secret as a command-line argument. ### Attack Path 1. A user follows the documented example and invokes the script using `--api-key` with a real bearer token. 2. The command containing the token is recorded in shell history, process metadata, monitoring telemetry, or audit logs. 3. A local user, compromised process, administrator, or party with access to collected logs retrieves the exposed token. 4. The attacker submits authenticated requests to ...[truncated 953 chars]
• Remediation: ## Remediation Suggestions 1. Remove the `--api-key` command-line option so secrets cannot be supplied through process arguments. 2. Prefer a protected credential source such as an operating-system keyring, a secret manager, or a configuration file restricted to the current user. 3. Retain `CEREBRUN_API_KEY` only as a compatibility mechanism and document the security implications of environment-based secrets. 4. If interactive operation is required, obtain the token with `getpass.getpass()` so it is not echoed or stored in shell history. 5. Replace all documentation examples that use `--api-key` with secure credential-setup instructions. 6. Ensure errors, debug output, telemetry, and HTTP diagnostics never include the `Authorization` header or token value. 7. Encourage short-lived, narrowly scoped tokens and provide token rotation and revocation guidance in case exposure is suspected.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill description advertises retrieval and management of highly sensitive personal context, including identity data, API keys, and an encrypted vault, but does not present a clear privacy and consent warning. This is dangerous because users or downstream agents may invoke the skill without understanding that secrets and personal information can be transmitted to a remote service and possibly to third-party LLM providers via the gateway.

Exfiltration Commands

High

• Category: Prompt Injection

Content

```

### chat_with_llm
Send message to an LLM through the Gateway.

**Parameters:**
- `message` (required): Message to send

• Confidence: 90% confidence
• Finding: The chat_with_llm command is a legitimate feature, but in this skill context it creates a realistic exfiltration path because data from user context, knowledge base, or conversation history can be packaged into a prompt and sent to external LLM providers. The danger is amplified by the same skill bundling both sensitive-data retrieval and outbound messaging capabilities in one place.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The script exposes a direct function to request access to encrypted vault data without any local confirmation, policy check, or interactive warning. In this skill's context, the vault likely contains the user's most sensitive secrets or identity data, so a thin wrapper that makes vault requests easy is materially dangerous if invoked by an untrusted workflow or prompt-injected agent.

Exfiltration Commands

High

• Category: Prompt Injection

Content

def chat_with_llm(api_key: str, message: str, provider: str, model: str,
                  conversation_id: str = None, title: str = None):
    """Send message to LLM via Gateway"""
    params = {
        "message": message,
        "provider": provider,

• Confidence: 95% confidence
• Finding: The chat function transmits arbitrary user messages to an external LLM provider, which is an exfiltration path for sensitive data if the caller includes secrets, personal context, or proprietary material. In this skill, that risk is amplified because the surrounding features encourage retrieval of memory, knowledge, and conversation history that could then be forwarded to third-party models.

MCP Config Access

High

• Category: Agent Snooping

Content

return make_request(api_key, "list_knowledge_categories")

def list_tools(api_key: str):
    """List all available MCP tools"""
    payload = {
        "jsonrpc": "2.0",
        "id": 1,

• Confidence: 80% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

MCP Config Access

High

• Category: Agent Snooping

Content

return make_request(api_key, "list_knowledge_categories")

def list_tools(api_key: str):
    """List all available MCP tools"""
    payload = {
        "jsonrpc": "2.0",
        "id": 1,

• Confidence: 80% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Exfiltration Commands

High

• Category: Prompt Injection

Content

p.add_argument("--provider", choices=["openai", "gemini", "anthropic", "ollama"])
    
    # chat_with_llm
    p = subparsers.add_parser("chat_with_llm", help="Send message to LLM")
    p.add_argument("--message", required=True)
    p.add_argument("--provider", required=True)
    p.add_argument("--model", required=True)

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

MCP Config Access

High

• Category: Agent Snooping

Content

subparsers.add_parser("list_knowledge_categories", help="List knowledge categories")
    
    # list_tools
    subparsers.add_parser("list_tools", help="List available MCP tools")
    
    args = parser.parse_args()

• Confidence: 80% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill exposes capabilities that involve environment access and outbound network use, but it does not declare any explicit tool scope or permissions boundaries. For a skill that handles personal context, API keys, and vault data, missing scope declarations increases the risk of over-broad execution and accidental or unauthorized access to sensitive resources.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Usage

### Get Context
curl -X POST \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_context","arguments":{"layer":0}}}' \

• Confidence: 90% confidence
• Finding: The documented usage performs external POST requests carrying authorization tokens and personal context to a remote endpoint. External transmission is expected for an MCP client, but in this skill's context it is more dangerous because the transmitted material may include identity information, API keys, vault contents, and conversation history, making disclosure or misuse materially harmful if consent and minimization controls are absent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documented context APIs expose highly sensitive user data, including personal identity information and an encrypted vault, but the reference does not consistently warn that these operations require explicit user awareness, least-privilege access, and special handling for sensitive fields. In a skill whose purpose is memory and personal context management, omission of privacy warnings increases the chance that downstream agents will over-collect or retrieve sensitive context by default.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The chat_with_llm documentation describes sending arbitrary messages through an external provider but does not warn that prompts and embedded user data may be transmitted to third-party LLM services. Because this skill also provides access to personal context, knowledge base contents, and conversation history, an agent could easily forward sensitive material off-platform without clear disclosure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: These functions retrieve highly sensitive personal context and conversation history from a remote service, but the script provides no execution-time disclosure, consent gate, or data-minimization safeguards. In an agent-skill setting, that increases the risk that a user or calling agent sends or fetches private data without understanding that external transmission and storage are involved.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The tool sends user-provided messages and knowledge-base content to a remote API, including LLM gateway interactions, without any execution-time notice or outbound-data review. Because this skill is explicitly designed for personal memory and knowledge management, the likelihood of transmitting sensitive personal or organizational content is high.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The CLI accepts the API key from CEREBRUN_API_KEY, which is sensitive credential material. Although using an environment variable is common, this file does not include any user-facing note about secure handling of the key or caution against exposing it in shell history via command-line arguments.

Static analysis

No suspicious patterns detected.