ClawHub
Back to skill

Security audit

Bohrium Dev Node Management

Security checks across malware telemetry and agentic risk

Overview

This skill is for legitimate Bohrium cloud node management, but it exposes SSH passwords and can create billable infrastructure without strong safeguards.

Install only if you are comfortable giving an agent a Bohrium access key and allowing it to create, modify, stop, delete, and inspect cloud nodes. Require explicit approval before billable creation, deletion, dataset binding, or revealing SSH credentials. Prefer the passwordless bohr CLI connection path, avoid printing node passwords, and verify the CLI installer before running it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly instructs use of shell commands, network access, and environment variables, but does not declare permissions for those capabilities. That creates a transparency and policy-enforcement gap: a caller may authorize the skill based on incomplete metadata while it can still access credentials and perform networked node-management actions.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The stated purpose is node lifecycle and resource management, but the documented behavior includes retrieving SSH credentials including a password. Exposing credentials materially expands the skill from lifecycle management into privileged access enablement, which increases the chance of secret disclosure, lateral access, and misuse beyond user expectations.

Description-Behavior Mismatch

Medium
Confidence
85% confidence
Finding
The API supplement documents renaming nodes and binding datasets, which extend beyond the narrow lifecycle/resource/pricing scope described in the manifest. Scope creep is dangerous because it grants operators more control over data attachments and node state than users may have intended to authorize.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill explicitly documents retrieval of `nodePwd`, which is a sensitive credential that can grant direct access to running infrastructure. In a skill context, surfacing such credentials increases risk of accidental disclosure in logs, chat transcripts, screenshots, or downstream tools.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The authentication section tells users to place an access key in configuration and environment variables without guidance on secure storage, rotation, masking, or output redaction. That can lead to credential leakage through shell history, logs, screenshots, or accidental echoing by dependent tools.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The install instructions execute a remote script directly via `curl | bash`, which is a well-known supply-chain risk. If the remote host, path, DNS, or transport chain is compromised, arbitrary code executes immediately on the user's machine with the user's privileges.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script can create billable compute resources non-interactively with no confirmation, dry-run, budget guardrail, or warning. In an agent or automation context, this increases the chance of accidental or unauthorized infrastructure provisioning and unexpected spend, which is more dangerous given the skill is specifically designed to manage paid nodes.

Missing User Warnings

High
Confidence
98% confidence
Finding
The function prints the node password directly to stdout, which can leak credentials into terminal history, logs, CI output, agent transcripts, or shared observability systems. In this skill context, exposing SSH credentials is particularly sensitive because it grants direct remote access to compute instances and could enable full node compromise if output is captured.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# macOS
/bin/bash -c "$(curl -fsSL https://dp-public.oss-cn-beijing.aliyuncs.com/bohrctl/1.0.0/install_bohr_mac_curl.sh)"
# Linux
/bin/bash -c "$(curl -fsSL https://dp-public.oss-cn-beijing.aliyuncs.com/bohrctl/1.0.0/install_bohr_linux_curl.sh)"
source ~/.bashrc && export PATH="$HOME/.bohrium:$PATH"
Confidence
95% confidence
Finding
curl -fsSL https://dp-public.oss-cn-beijing.aliyuncs.com/bohrctl/1.0.0/install_bohr_mac_curl.sh)" # Linux /bin/bash -c "$(curl -fsSL https://dp-public.oss-cn-beijing.aliyuncs.com/bohrctl/1.0.0/install

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.