ClawHub
Back to skill

Security audit

Ambit Cli

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for managing Ambit private networks, but it asks users to run mutable third-party code and can make high-impact Fly.io and Tailscale network changes.

Review before installing. Use a pinned and trusted version of the Ambit CLI, avoid passing API tokens on the command line, prefer preconfigured Tailscale ACL autoApprovers over --self-approve, avoid --yes for destructive or routing changes, and deploy templates only from reviewed immutable commits with narrow Fly.io and Tailscale permissions.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:20
Finding

Unpinned Third-Party npm Package Is Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-26
Vulnerability Type: Supply-chain exposure through unpinned package execution
Risk Level: High

Vulnerable Code Snippet:

markdown
## Installation

If `ambit` is not already installed, run it directly via Nix:

```bash
npx @cardelli/ambit
text

### Technical Analysis

The installation instructions use `npx` to retrieve and immediately execute `@cardelli/ambit` without specifying an exact version, integrity digest, or verified source revision. Despite the surrounding text saying that it runs through Nix, the documented command invokes an npm package.

Because package resolution is not pinned, the effective executable can change after the Skill has been reviewed. Execution therefore depends on the continuing security of the npm publisher account, package registry, release process, and all transitive dependencies. The package scope also differs from the author recorded in the Skill metadata, while the document does not establish or verify the relationship between them.

This finding does not prove that the current package is malicious. It establishes that following the documented command places execution trust in mutable, externally hosted code.

### Attack Path

1. An attacker compromises the npm publisher account, release pipeline, package, or one of its dependencies.
2. The attacker publishes a malicious version under the same package name.
3. A user follows the Skill's installation instructions and runs `npx @cardelli/ambit`.
4. `npx` resolves and downloads the current package version.
5. Malicious lifecycle logic or CLI code executes with the permissions of the invoking user.
6. The payload can inspect local files and environment variables, access authenticated CLI state, or issue commands using the user's available Fly.io and Tailscale credentials.

### Impact Assessment

Successful exploitation permits arbitrary code execution 
...[truncated 359 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to an exact, reviewed package version rather than allowing npm to select the current release.
  2. Publish and document the authoritative source repository and its relationship to the @cardelli npm scope.
  3. Provide verifiable package provenance, signatures, lockfiles, and integrity hashes.
  4. Recommend reviewing the resolved package and dependency tree before execution.
  5. Disable package lifecycle scripts where operationally compatible.
  6. Execute installation and initial validation in a restricted environment without unrelated credentials or access to sensitive files.
  7. Use short-lived, narrowly scoped Fly.io and Tailscale credentials when operating the CLI.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:103
Finding

Mutable GitHub Templates Are Retrieved and Deployed Without Immutable Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 103-129
Vulnerability Type: Remote payload retrieval and deployment from mutable references
Risk Level: High

Vulnerable Code Snippet:

markdown
**Template mode** — fetches a template from a GitHub repository and deploys it:
```bash
ambit deploy my-browser --network lab --template ToxicPine/ambit-templates/chromatic
ambit deploy my-browser --network lab --template ToxicPine/ambit-templates/chromatic@v1.0
ambit deploy my-shell --network lab --template ToxicPine/ambit-templates/wetty

Template reference format:

text
owner/repo/path             Fetch from the default branch
owner/repo/path@tag         Fetch a tagged release
owner/repo/path@branch      Fetch a specific branch
owner/repo/path@commit      Fetch a specific commit

The template must contain a fly.toml (and typically a Dockerfile). The template is fetched from GitHub's tarball API, the target subdirectory is extracted, pre-flight scanned, and deployed. The temp directory is cleaned up automatically.

text

### Technical Analysis

Template mode retrieves deployment content from GitHub and then deploys it. The primary examples use an unqualified default-branch reference, while branches and ordinary tags are also mutable. Consequently, the files ultimately built or deployed can change after the Skill itself has been audited.

The described pre-flight scan does not establish the trustworthiness of arbitrary Dockerfile commands, referenced container images, application binaries, or other files in the retrieved archive. No archive digest, signature, verified commit allowlist, or mandatory user review is documented.

This finding does not establish that the named repository currently contains malicious content. The risk arises because compromise of the repository, maintainer account, release process, or mutable reference can replace the remotely retrieved deployment payload.


...[truncated 1542 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require immutable, reviewed commit hashes for every template deployment; do not use default branches, mutable branches, or movable tags in recommended commands.
  2. Resolve each reference to a commit and display that commit before deployment.
  3. Verify downloaded archives with an expected digest or cryptographic signature.
  4. Maintain an allowlist of trusted repositories and reviewed commits.
  5. Require explicit user confirmation after showing the resolved source, changed files, Dockerfile, base images, and relevant fly.toml settings.
  6. Scan the entire build context, Dockerfile instructions, referenced images, embedded executables, and dependency manifests rather than only deployment settings.
  7. Pin container images by digest and verify their provenance.
  8. Deploy templates with minimal secrets, restricted egress, constrained Fly.io permissions, and narrowly scoped Tailscale ACLs.
  9. Require authentication for browser-debugging and web-terminal services, and avoid passwordless sudo unless it is essential and isolated.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
- `flyctl` installed and authenticated (`fly auth login`)
- Tailscale installed and connected (`tailscale up`)
- Accept-routes enabled (`sudo tailscale set --accept-routes`)
- A Tailscale API access token (`tskey-api-...`) — create one at https://login.tailscale.com/admin/settings/keys

## Commands

Credential Access

High
Category
Privilege Escalation
Confidence
72% confidence
Finding

Accepting a Tailscale API token directly via a --api-key <key> command-line flag is risky because command-line arguments are often exposed in shell history, process listings, logs, CI output, and telemetry. In a skill intended for agent use, encouraging CLI-secret passing materially increases accidental credential disclosure risk for a token capable of altering network configuration.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
**Flags:**
- `--org <org>` — Fly.io organization slug
- `--region <region>` — Fly.io region (default: `iad`)
- `--api-key <key>` — Tailscale API access token (prompted interactively if omitted)
- `--tag <tag>` — Tailscale ACL tag for the router (default: `tag:ambit-<network>`)
- `--self-approve` — Approve subnet routes via Tailscale API instead of requiring autoApprovers in the ACL policy
- `-y, --yes` — Skip confirmation prompts

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description contains broad trigger phrases like creating networks, deploying apps, diagnosing connectivity, and destroying networks, which can cause the skill to activate for high-impact infrastructure tasks with limited specificity. In an agent setting, overbroad activation increases the chance of the skill being selected for requests that only partially match, leading to unintended destructive or privileged actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The installation guidance uses npx @cardelli/ambit without pinning an exact version or integrity, so execution depends on whatever package version is current at install time. That creates a supply-chain risk: a compromised publisher account, malicious new release, or dependency hijack could cause arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
- `flyctl` installed and authenticated (`fly auth login`)
- Tailscale installed and connected (`tailscale up`)
- Accept-routes enabled (`sudo tailscale set --accept-routes`)
- A Tailscale API access token (`tskey-api-...`) — create one at https://login.tailscale.com/admin/settings/keys

## Commands

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The --self-approve option allows route approval through the Tailscale API instead of requiring prior ACL configuration, which reduces an administrative control point for network changes. In an agent context, that increases the chance of an automated workflow making privileged network-routing changes without a separate review step.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md
- `--region <region>` — Fly.io region (default: `iad`)
- `--api-key <key>` — Tailscale API access token (prompted interactively if omitted)
- `--tag <tag>` — Tailscale ACL tag for the router (default: `tag:ambit-<network>`)
- `--self-approve` — Approve subnet routes via Tailscale API instead of requiring autoApprovers in the ACL policy
- `-y, --yes` — Skip confirmation prompts
- `--json` — Output as JSON

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
- `--api-key <key>` — Tailscale API access token (prompted interactively if omitted)
- `--tag <tag>` — Tailscale ACL tag for the router (default: `tag:ambit-<network>`)
- `--self-approve` — Approve subnet routes via Tailscale API instead of requiring autoApprovers in the ACL policy
- `-y, --yes` — Skip confirmation prompts
- `--json` — Output as JSON

**What it does:**

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
- `--api-key <key>` — Tailscale API access token (prompted interactively if omitted)
- `--tag <tag>` — Tailscale ACL tag for the router (default: `tag:ambit-<network>`)
- `--self-approve` — Approve subnet routes via Tailscale API instead of requiring autoApprovers in the ACL policy
- `-y, --yes` — Skip confirmation prompts
- `--json` — Output as JSON

**What it does:**

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The documented workflow explicitly checks autoApprovers only unless --self-approve is used, meaning the tool can bypass a governance safeguard and directly make approval-related changes via API. In a network-administration skill, that materially increases the impact of unintended or overbroad execution because route changes affect reachability and trust boundaries.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
**What it does:**
1. Validates Fly.io auth and the Tailscale API key
2. Checks that the tag (default `tag:ambit-<network>`, or custom via `--tag`) exists in Tailscale ACL tagOwners
3. Checks autoApprovers config (unless `--self-approve`)
4. Creates a Fly.io app on the custom network
5. Sets secrets: `TAILSCALE_API_TOKEN`, `NETWORK_NAME`, `TAILSCALE_TAGS`
6. Deploys the router container

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

And optionally (or use --self-approve to skip this):

json
"autoApprovers": { "routes": { "fdaa:X:XXXX::/48": ["tag:ambit-<network>"] } }

ambit deploy <app> --network <name>

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.

And optionally (or use --self-approve to skip this):

json
"autoApprovers": { "routes": { "fdaa:X:XXXX::/48": ["tag:ambit-<network>"] } }

ambit deploy <app> --network <name>

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

And optionally (or use --self-approve to skip this):

json
"autoApprovers": { "routes": { "fdaa:X:XXXX::/48": ["tag:ambit-<network>"] } }

ambit deploy <app> --network <name>

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill recommends deploying from remote GitHub templates that are fetched and then deployed, but it does not prominently warn that this introduces third-party code execution and infrastructure provisioning risk. Because templates may contain fly.toml, Dockerfiles, build steps, or other deployment artifacts, an attacker controlling the referenced repository, branch, or dependency chain could cause malicious workloads to be built and run.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.