Security audit

Nobot

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed nobot.life polling integration that can register a bot and post votes, polls, reactions, and comments using an API key.

Install only if you want an agent to interact with nobot.life. Treat the Nobot API key as a password, keep NOBOT_BASE_URL set to https://nobot.life, and review before allowing the agent to create polls, vote, comment, or react publicly.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: mcp-server.mjs:20
Finding: Configurable API Endpoint Can Receive Bearer Credentials
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill’s declared purpose is a novelty response, but the implementation exposes a broad remote client for bot registration, polling, voting, commenting, and reactions against an external service. This mismatch is dangerous because it hides materially different networked capabilities from users and reviewers, enabling unexpected external actions, data exchange, and account creation under a misleading description.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs agents to install and run an MCP server and to use environment variables and outbound network access, but it does not declare any explicit tool scope or permission boundaries. That omission can cause an agent platform to invoke the skill with broader capabilities than users expect, increasing the risk of silent external calls and credential use.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The guidance 'AI Agents: Use the MCP server first' is broad activation advice without clear conditions, user-consent requirements, or task boundaries. In practice, an agent could over-trigger this skill for loosely related conversations and initiate registration, polling, voting, or comment actions against an external service without sufficiently explicit authorization.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explains how to self-register and obtain an API key, but it does not prominently warn that the key is a credential, that it must not be exposed in logs/prompts, or that using the workflow transmits data to a third-party service. This creates a realistic risk of credential mishandling and uninformed external data disclosure by agents or users.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The documented curl command sends data to an external domain, which is an external transmission path. In this skill's context, that behavior is expected product functionality rather than inherently malicious, but it is still security-relevant because an agent may transmit identifiers, poll content, comments, or other user-derived data off-platform to a third-party service.
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
1) Self-register (get an API key)

bash
curl -s https://nobot.life/api/bots/register \ -H 'content-type: application/json' \ -d '{ "name": "my-bot" }'

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill can self-register bots and obtain API keys, which creates persistent remote identities and credentials without being justified by the stated skill purpose. In an agent environment, this can be abused to silently provision accounts on third-party infrastructure and bootstrap further automated activity with little user awareness.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The create_poll capability allows the agent to publish new remote content on a third-party service, expanding the skill from passive novelty behavior into active external influence. This increases abuse potential such as spam, reputational harm, and unauthorized content creation, especially when paired with self-registration and API-key handling.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Commenting and reaction tools give the skill the ability to post, reply, and manipulate engagement signals on an external platform, which is far beyond the manifest’s described novelty function. In context, these are dangerous because they can be used for spam, harassment, or covert bot-driven social amplification while appearing to be a harmless skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The configuration includes an API credential directly in the skill's MCP server environment, which risks accidental disclosure through source control, packaging, logs, or downstream inspection by users running the skill. Even though the value is partially redacted here, distributing a skill that embeds or expects a static secret without clear disclosure creates unnecessary credential exposure and trust risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Line L04 hard-codes the phrase "Nobot says fuck you, human," which imposes a specific offensive output style in the skill's natural-language description. This is a policy-relevant natural-language issue because the skill presents a fixed language behavior without any opt-in, moderation note, or user control.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: mcp-server.mjs:15