ClawHub
Back to skill

Security audit

Bonito

Security checks for vulnerabilities and agentic risk

Overview

This Bonito onboarding skill is mostly coherent, but it tells users to install and run unpinned external code, Docker containers, and deployment commands with credentials.

Review this skill before installing. Use disposable or least-privilege Bonito and provider credentials, avoid production accounts, pin and inspect bonito-cli and the Atlas repository before running them, review Docker Compose and shell scripts first, and prefer dry-run deployment before making account changes.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
references/atlas-guide.md:9
Finding

Unpinned Third-Party Package and Mutable Remote Repository Are Executed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: references/atlas-guide.md:9-43; related instructions also appear in SKILL.md:17,73 and scripts/verify_deploy.py:69,108
Vulnerability Type: Unverified third-party supply-chain execution and remote payload retrieval
Risk Level: Medium

Vulnerable Code Snippets

references/atlas-guide.md:9

bash
- bonito-cli: `pip install bonito-cli`

references/atlas-guide.md:14-25

bash
git clone https://github.com/ShabariRepo/atlas.git
cd atlas
cp .env.example .env
# Edit .env with your Bonito credentials + at least one provider key
# (or use managed inference — just set BONITO_EMAIL/PASSWORD/API_URL)

# Start 4 mock MCP servers (GitHub, PagerDuty, Slack, Jira on ports 3100-3103)
docker compose -f docker-compose.mcp.yml up -d

# Authenticate and deploy
bonito auth login
bonito deploy -f bonito.yaml          # --dry-run to validate first

references/atlas-guide.md:43

bash
./scripts/test-agents.sh

Related package installation instructions in SKILL.md:17,73:

bash
pip install bonito-cli

Related recommendations in scripts/verify_deploy.py:69,108:

python
check("bonito-cli", False, "not found — run: pip install bonito-cli")
python
print("   Clone with: git clone https://github.com/ShabariRepo/atlas.git")

Technical Analysis

The onboarding instructions install bonito-cli without pinning an exact reviewed version or verifying a package hash or signature. The Atlas demonstration is similarly cloned from a mutable Git repository reference rather than a verified commit.

The workflow subsequently executes repository-controlled content through:

  • docker compose, which processes the remotely retrieved Compose configuration and may build or run images with host mounts, environment variables, and network access.
  • bonito deploy, which processes the remotely retrieved bonito.yaml and ...[truncated 2680 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin bonito-cli to an exact reviewed version rather than installing the latest available release:

    bash
    python3 -m pip install "bonito-cli==REVIEWED_VERSION"

  2. Publish and verify cryptographic hashes for the package and all locked dependencies. Use a requirements file with hashes, for example:

    bash
    python3 -m pip install --require-hashes -r requirements.lock

  3. Clone Atlas and explicitly check out a reviewed immutable commit:

    bash
    git clone https://github.com/ShabariRepo/atlas.git
cd atlas
git checkout --detach REVIEWED_COMMIT_SHA

  4. Document the expected commit identifier and, where available, verify a signed commit or signed release tag before executing repository content.

  5. Require inspection of docker-compose.mcp.yml, bonito.yaml, Dockerfiles, referenced images, and scripts/test-agents.sh before execution. Container images should be pinned by immutable digest rather than mutable tags.

  6. Make bonito deploy --dry-run -f bonito.yaml a mandatory validation step, require review of the generated plan, and request explicit confirmation before performing the real deployment.

  7. Run the demonstration in an isolated virtual environment or disposable virtual machine. Avoid installing the CLI globally or as a privileged account.

  8. Use dedicated, short-lived, least-privilege Bonito and provider credentials. Do not reuse production credentials, and revoke or rotate demonstration credentials after use.

  9. Restrict Docker permissions and avoid exposing the host Docker socket or sensitive host paths to demonstration containers.

  10. Add clear warnings that the Atlas repository is external, its contents are not part of the audited skill package, and users must verify the pinned revision before execution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description presents a broad onboarding and operational skill for the Bonito AI platform, covering setup, deployment, agent orchestration, routing, and managed inference workflows. The actual code does none of those things; it only checks connectivity/health of the Bonito API endpoint and reports the result. While a health check could be a minor supporting utility for the platform, it is not sufficient to represent the skill's primary declared purpose. This is a material description-behavior mismatch because the implemented behavior is much narrower and different from the described onboarding/deployment functionality.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/atlas-guide.md (reported line 16)May include surrounding context.

bash
git clone https://github.com/ShabariRepo/atlas.git
cd atlas
cp .env.example .env
# Edit .env with your Bonito credentials + at least one provider key
# (or use managed inference — just set BONITO_EMAIL/PASSWORD/API_URL)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/atlas-guide.md (reported line 17)May include surrounding context.

md
git clone https://github.com/ShabariRepo/atlas.git
cd atlas
cp .env.example .env
# Edit .env with your Bonito credentials + at least one provider key
# (or use managed inference — just set BONITO_EMAIL/PASSWORD/API_URL)

# Start 4 mock MCP servers (GitHub, PagerDuty, Slack, Jira on ports 3100-3103)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/verify_deploy.py (reported line 84)May include surrounding context.

python
git clone https://github.com/ShabariRepo/atlas.git
cd atlas
cp .env.example .env
# Edit .env with your Bonito credentials + at least one provider key
# (or use managed inference — just set BONITO_EMAIL/PASSWORD/API_URL)

# Start 4 mock MCP servers (GitHub, PagerDuty, Slack, Jira on ports 3100-3103)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/verify_deploy.py (reported line 87)May include surrounding context.

python
git clone https://github.com/ShabariRepo/atlas.git
cd atlas
cp .env.example .env
# Edit .env with your Bonito credentials + at least one provider key
# (or use managed inference — just set BONITO_EMAIL/PASSWORD/API_URL)

# Start 4 mock MCP servers (GitHub, PagerDuty, Slack, Jira on ports 3100-3103)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/verify_deploy.py (reported line 89)May include surrounding context.

python
git clone https://github.com/ShabariRepo/atlas.git
cd atlas
cp .env.example .env
# Edit .env with your Bonito credentials + at least one provider key
# (or use managed inference — just set BONITO_EMAIL/PASSWORD/API_URL)

# Start 4 mock MCP servers (GitHub, PagerDuty, Slack, Jira on ports 3100-3103)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/verify_deploy.py (reported line 85)May include surrounding context.

python
check("Atlas repo", True, f"found at {atlas_dir}")

        # Check .env
        env_file = os.path.join(atlas_dir, ".env")
        if os.path.isfile(env_file):
            check(".env file", True, "exists")
        else:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/verify_deploy.py (reported line 89)May include surrounding context.

python
check("Atlas repo", True, f"found at {atlas_dir}")

        # Check .env
        env_file = os.path.join(atlas_dir, ".env")
        if os.path.isfile(env_file):
            check(".env file", True, "exists")
        else:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill references executable shell and Python commands (python3 scripts/health_check.py, python3 scripts/verify_deploy.py, pip install, bonito auth login, curl) but declares no tool restrictions or permissions. In an agent environment, that can cause the model to invoke shell/network capabilities without explicit scoping, increasing the chance of unintended command execution or outbound requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation text is broad enough to match generic requests about AI setup, agent deployment, inference, orchestration, and onboarding. Overbroad triggering can cause this skill to activate in unrelated contexts, steering users toward external services, commands, or workflows they did not intend, which increases the attack surface for social-engineering-style misuse.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill instructs sending data and credentials to an external endpoint via curl, including a bearer gateway key in the Authorization header. In agent contexts, examples like this can become operational behavior, leading to outbound transmission of prompts, metadata, or secrets to a third-party API without sufficient consent checks or data-handling guarantees.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

Docs: https://getbonito.com/docs#gateway

Step 4: Test with curl or Python

bash
# Simple test against the gateway

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
import json
import ssl

API_URL = "https://api.getbonito.com/health"
TIMEOUT_SECONDS = 10

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/health_check.py (reported line 14)May include surrounding context.

python
import json
import ssl

API_URL = "https://api.getbonito.com/health"
TIMEOUT_SECONDS = 10

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/verify_deploy.py (reported line 27)May include surrounding context.

python
def run_cmd(cmd):
    """Run a command and return (success, stdout)."""
    try:
        result = subprocess.run(
            cmd, capture_output=True, text=True, timeout=15
        )
        return result.returncode == 0, result.stdout.strip()