Security audit

CNB OpenAPI Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad authenticated CNB API operator that can perform destructive repository and organization actions without clear confirmation safeguards.

Install only with a least-privilege CNB token, prefer a read-only token for lookup tasks, keep CNB_API_ENDPOINT fixed to a trusted HTTPS CNB host, and require manual review before any create, update, delete, permission, merge, build, registry, workspace, organization, or AI PR action. Avoid storing the token in global shell startup files if possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:1883
Finding: Bearer Token Disclosure Through an Unvalidated API Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: docs/node.md:45
Finding: Execution of Model-Generated Shell Commands With Credential Substitution
Content: View full analysis
': CNB_TOKEN }; ``` ```javascript const aiResponse = await chatWithCNBAI(messages); const action = parseAction(aiResponse); if (!action) return aiResponse; messages.push({ role: 'assistant', content: aiResponse }); if (action.type === 'get_api_doc') { const doc = getAPIDoc(action.value); messages.push({ role: 'user', content: `API documentation for ${action.value}:\n\n${doc}` }); } else if (action.type === 'curl') { const result = execCurl(action.value, CURL_VARS); messages.push({ role: 'user', content: `curl result:\n${JSON.stringify(result.data, null, 2)}` }); } ``` ### Technical Analysis The documented agent loop treats model output as an executable action. When `parseAction` identifies a curl action, the resulting command string is passed directly to `execCurl`. The command execution context also receives a substitution map containing the real CNB token. The example does not demonstrate a structured command schema, shell-metacharacter rejection, fixed executable enforcement, URL allowlisting, method restrictions, header validation, or confirmation before executing mutating operations. If `execCurl` invokes a shell or accepts arbitrary curl options, model-generated output may inject additional commands, read local files through curl upload options, access internal services, or send the substituted token to an attacker. Model output is not a trusted code source. It may be influenced by direct user input, repository content, issue descriptions, API responses, or o ...[truncated 1359 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: docs/codebuddy.md:11
Finding: Persistent Plaintext Storage of the CNB Bearer Token
Content: View full analysis
> ~/.zshrc echo 'export CNB_API_ENDPOINT="https://api.cnb.cool"' >> ~/.zshrc ``` ### Technical Analysis The installation guidance instructs users to write the CNB bearer token directly into a shell startup file. Shell profiles are persistent plaintext files and are routinely loaded by interactive processes. They may also be collected by backup software, support bundles, endpoint tools, shell-configuration synchronization systems, IDE extensions, or malicious processes running under the same user account. Appending the token also makes accidental duplicate entries likely during reconfiguration and leaves old tokens behind after rotation. Any child process started from the configured environment may inherit the token even when that process does not need CNB access. This is persistent credential storage, but it is not a system-persistence mechanism under T06: the project does not install a service, local scheduled task, or startup backdoor. The issue is insecure secret handling under T09. ### Attack Path 1. The user follows the documented setup instructions. 2. The bearer token is stored persistently in `~/.zshrc` or an equivalent shell profile. 3. A user-context process, IDE extension, backup system, diagnostic collector, or attacker with read access obtains the file. 4. The token is extracted from the export statement. 5. The attacker reuses the token against the CNB API until it expires or is revoked. ### Impact Assessment The attacker receives all CNB permissions granted to the exposed token. Depending on its scope, this may include private repository access, build and artifact access, write operations, resource deletion, or repository and organization administration. The exposure is cross-session and remains p ...[truncated 171 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: docs/claudecode.md:3
Finding: Unpinned Skill, Plugin, and Package Installation Sources
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (584)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest frames the skill as a data-query tool for projects, repositories, issues, and pull requests, but the documentation explicitly grants complete CNB OpenAPI access, including destructive and administrative operations. This scope mismatch is dangerous because it can cause users or higher-level agents to invoke the skill under a read-only mental model while it actually has write/delete capabilities using an authenticated token.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs the agent to directly execute authenticated curl requests and to 'proactively execute' without asking the user first. Because the available endpoints include write, delete, transfer, and other destructive actions, this creates a high risk of unintended state changes and makes prompt-injection or ambiguous user requests far more dangerous.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The AI-driven automatic coding and PR creation feature materially expands the skill from information retrieval into autonomous code modification and repository write actions. In the context of a token-authenticated integration, this can lead to unauthorized code changes, social engineering of the agent into opening PRs, or supply-chain impact if users assume the skill is only querying data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The example creates a loop where model output is parsed into a curl action and executed with a real bearer token, effectively granting the model command-driven API invocation authority. Because the model can be influenced by prompt injection or misunderstand intent, this can lead to unauthorized repository changes, data exfiltration through crafted requests, or abuse of the authenticated session.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented skill scope says it is for querying project, repository, issue, and PR data, but this endpoint performs a high-impact write action: AI-generated code changes and automatic PR creation. This mismatch can cause an agent or user to invoke a destructive or state-changing operation under the assumption it is read-only, increasing the risk of unauthorized repository modifications.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This documentation exposes a highly destructive operation that permanently deletes an organization, but it provides no warning about irreversibility, no recommendation for explicit user confirmation, and no guidance for safeguards such as identity verification or dry-run checks. In an agent skill context, this is dangerous because an automated system may translate a natural-language request into an immediate DELETE call, increasing the risk of accidental or unauthorized destructive actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This documentation exposes a highly destructive operation that permanently deletes a repository, but it provides no warning about irreversibility, confirmation requirements, or guidance to verify the target before execution. In an agent skill context, omission of safety guardrails increases the risk of accidental or unauthorized destructive actions, especially if the agent can invoke APIs directly from natural-language instructions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest frames the skill as a development-data query tool, but the README states it provides complete coverage of CNB APIs, including write-capable and administrative operations. This mismatch can cause users or orchestrators to grant or invoke the skill under a lower-risk assumption, enabling unexpected state changes or privileged actions with the configured bearer token.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented API categories include billing, member management, organization settings, security management, and workspace control, which go far beyond the manifest's limited query-oriented description. In an agent setting, this expanded undeclared capability materially increases the risk of over-privileged access, unintended destructive actions, and sensitive administrative changes if the skill is selected based on its understated description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. The description and the rest of the document are primarily Chinese, but there is no indication that users may choose another language or that the language restriction is intentional for a region-specific compliance reason.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill exposes broad administrative capabilities such as organization management, membership changes, registry operations, workspace control, and account-related functions that go beyond the stated development-data query use case. That overbreadth increases the chance of accidental misuse, privilege abuse, and unexpected side effects when the skill is selected for routine repository lookups.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: The skill explicitly directs the agent to send authenticated requests containing a bearer token to an external endpoint derived from the CNB_API_ENDPOINT environment variable. This external transmission is expected for the skill's function, but it becomes dangerous because the endpoint is configurable and the skill does not document validation, allowlisting, or safeguards against sending credentials to an attacker-controlled host.
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
md
**示例**：用户给了 https://{host}/{org}/{repo}/-/build/logs/{sn} - 提取 repo = {org}/{repo}，sn = {sn} - 先执行：curl ... "${CNB_API_ENDPOINT}/{org}/{repo}/-/build/status/{sn}" 获取构建状态 - 如需详细日志，再调用 stage 接口 ## 基础配置

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: User email enumeration is sensitive account data access and is not clearly justified by the stated purpose of querying project and repository development data. Exposing it in a broadly scoped skill increases privacy risk and may enable targeting, phishing, or correlation of identities across systems.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file presents all installation and usage instructions exclusively in Chinese. The stated policy flags language or locale constraints when a skill forces a specific language without offering user choice or documenting a justified region-specific requirement.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · docs/claudecode.md (reported line 6)May include surrounding context.
将仓库克隆到 Claude 的 skills 目录：

bash
git clone https://cnb.cool/cnb/sdk/cnb-openapi-skills ~/.claude/skills/cnb-openapi-skills

或者使用 pnpx skills 命令安装:

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document states that CodeBuddy will automatically load the skill and invoke it whenever the conversation involves CNB platform operations, but it does not define clear limits, confirmation requirements, or narrow trigger conditions. In contexts where the skill can perform authenticated API actions in Craft or Agent mode, this broad activation scope increases the chance of unintended repository, issue, or merge-request operations from ordinary conversational prompts.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The text states that the AI will output get_api_doc or bash code blocks, but the API overview for ParseAction documents only get_api_doc or curl, and the example switch statement likewise handles only get_api_doc and curl. This is an active contradiction in the documentation about what action format is actually supported.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example silently attaches Authorization: Bearer <CNB_TOKEN> to requests but does not warn developers that the agent flow may cause authenticated operations to be performed under the user's identity. In the surrounding context, this omission increases the chance that users will wire the sample into autonomous execution without understanding the sensitivity of the token or the consequences of model-directed requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The agent loop executes model-generated curl commands automatically via ExecCurl(action.Value, curlVars) with no user confirmation, allowlist, or endpoint validation. Because the command can include authenticated requests using the bearer token placeholder, prompt injection or model error could trigger unintended API actions, data access, or token exposure to attacker-controlled endpoints.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation frames the skill as a way to query CNB/OpenAPI data, but the agent example enables an LLM to produce and execute curl commands against authenticated CNB endpoints. This materially expands capability from read-oriented assistance to model-driven state-changing API access, increasing the risk of unintended writes, destructive operations, or token misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The agent example performs model-suggested curl requests automatically, without surfacing the exact action for user review or requiring confirmation. In an authenticated developer environment, this removes an important safety barrier and makes accidental or adversarially induced API actions much more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation encourages sending user prompts and repository identifiers/content-derived context to a remote AI endpoint, but does not warn users about the privacy and data-handling implications. This can cause sensitive project information, internal repository metadata, or user-entered secrets to be transmitted to external services without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation instructs users to export a CNB access token but provides no warning that the token is a sensitive secret, no guidance to avoid committing it to shell history or shared config files, and no advice on least-privilege handling. In the context of a skill that performs authenticated API actions against code repositories and collaboration data, mishandling this token could enable unauthorized access or modification if the credential is exposed.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: docs/go.md:181

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: docs/node.md:121