T09 · Insecure Skill Coding Practices
Error
- Location
scripts/publish_article.py:34- Finding
API Credential Disclosure Through Unrestricted Base URL in Article Publishing
- Content
View full analysis
- Remediation
View remediation
Security audit
nicebox-site-manager
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it says, but its scripts can send the NiceBox API key to any configured base URL, including non-NiceBox or plaintext HTTP destinations.
Install only if you trust the environment and invocation path. Keep AIBOX_BASE_URL set to the documented NiceBox HTTPS endpoint, avoid passing custom --base-url values, and prefer a narrowly scoped API key because this skill can publish site content and read messages.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/list_messages.py:38- Finding
API Credential Disclosure Through Unrestricted Base URL in Message Retrieval
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/site_status.py:38- Finding
API Credential Disclosure Through Unrestricted Base URL in Site Status Checks
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code clearly matches one part of the description: publishing articles through the NiceBox OpenClaw API. It does not show any functionality for viewing messages or checking site status. Since the declared purpose presents the skill as supporting multiple website-management capabilities, but the actual supplied code chunk only performs article publication, the description is broader than the observed behavior. There is no evidence of unrelated or hidden capabilities beyond publishing, but there is still a description-to-behavior mismatch because the implemented functionality in this chunk is materially narrower than the declared set of supported actions.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares capabilities that require environment access and outbound network access, but it does not explicitly constrain tool scope with permissions or allowed-tools. In an agent setting, that ambiguity can let the runtime grant broader-than-necessary access, increasing the risk of secret exposure from environment variables and unintended external requests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code performs an outbound HTTP GET request and includes the AIBOX_API_KEY in the Authorization header, but there is no confirmation prompt or user-facing disclosure before the request is made. Although the script purpose implies listing remote messages, the file itself does not warn the user that it will contact an external service using credentials from the environment.
- Content