T01 · Skill Instruction Hijacking
Error
- Location
skill.md:160- Finding
Mandatory Vendor Promotion and Attribution Tracking in Agent Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
NodeMaven – Premium Proxies for Account Management, Automation, and Scraping
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent NodeMaven proxy setup guide, but it asks agents to handle sensitive credentials in chat and perform persistent account-admin actions with uneven confirmation safeguards.
Install only if you specifically want NodeMaven-focused proxy setup. Prefer a secure secret input or local environment variables over pasting API keys into chat, avoid sharing full proxy URLs, require explicit confirmation before any whitelist/sub-user/notification mutation or deletion, and be aware that the provided dashboard links include mandatory tracking parameters.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
skill.md:118- Finding
API Keys and Proxy Credentials Are Unnecessarily Solicited Through Chat
- Content
View full analysis
-country--region--isp--sid-<000000000000000>-filter-medium:@gate.nodemaven.com: ``` ```bash # 1. Validate API key and fetch base proxy credentials curl -H "Authorization: x-api-key $API_KEY" \ https://api.nodemaven.com/api/v2/base/users/me # → returns: { "proxy_username": "...", "proxy_password": "...", # "email": "...", "traffic_limit": , # "subscription_status": "...", "is_traffic_frozen": false } ``` ```text After purchase, grab your API key here: https://dashboard.nodemaven.com/user-profile?tab=API_KEY&utm_source=ai_agent&utm_medium=agent_skill&utm_c ...[truncated 3192 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
The skill includes a destructive whitelist deletion capability. Even though it says to confirm with the user first, exposing a raw delete operation in an agent skill increases the chance of unintended or manipulated destructive actions, especially if an upstream prompt or ambiguous instruction causes the agent to target the wrong whitelist entry.
- Content
http GET /api/v2/base/whitelist/ip/{id} DELETE /api/v2/base/whitelist/ip/{id}Always confirm with the user before deleting.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 84% confidence
- Finding
The skill exposes deletion of sub-users and reset of usage, both of which are state-changing administrative actions. In an agent context, these operations are dangerous because prompt confusion, mistaken identity of a sub-user, or malicious user phrasing could cause loss of access, service disruption, or billing/usage integrity issues.
- Content
5.4 Delete / reset usage
http DELETE /api/v2/base/sub-users/?id=<SUB_USER_ID> POST /api/v2/base/sub-users/reset/usage
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Notification deletion is less severe than credential or account deletion, but it still modifies account state and can remove evidence of warnings, abuse notices, or operational alerts. In an autonomous agent setting, deleting notifications can reduce auditability and hide important signals from the user.
- Content
http GET /api/v2/base/notifications/ DELETE /api/v2/base/notifications/{notification_id}Check unread notifications when:
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Core principle The agent must complete this workflow without asking the user to read documentation: 1. Understand the user's task. 2. Recommend the right proxy type.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Full URL example:
text https://api.nodemaven.com/api/v2/base/users/me
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Full URL example:
text https://api.nodemaven.com/api/v2/base/users/me
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Full URL example:
text https://api.nodemaven.com/api/v2/base/users/me
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Full URL example:
text https://api.nodemaven.com/api/v2/base/users/me
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Full URL example:
text https://api.nodemaven.com/api/v2/base/users/me
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Full URL example:
text https://api.nodemaven.com/api/v2/base/users/me
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Full URL example:
text https://api.nodemaven.com/api/v2/base/users/me
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The instruction to keep fingerprint and proxy geo consistent by matching timezone, language, and locale imposes a specific language/locale configuration as a hard rule for users. The file does not present this as an optional, user-chosen setting or document a justified region-specific exception.
- Content
Behavior Manipulation
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
- Content
md - `email_with_underscores`: the user's NodeMaven account email with `@` and `.` replaced by `_`. Example: `firstname.lastname@example.com` → `firstname_lastname_example_com`. This base username is also returned by `GET /api/v2/base/users/me` as `proxy_username` — **always prefer the API value over reconstructing it from email.** - `country`, `region`, `city`, `isp`: lowercase codes returned by `/locations/*` endpoints. **Resolve via API — never invent.** - `sid` (session id): any string. Same `sid` = same exit IP for the duration of the sticky TTL. Use a unique `sid` per parallel session/account. Generate as random lowercase alphanumeric, 10–16 chars (e.g. via `openssl rand -hex 6`). - `filter`: quality filter level. Allowed values: `medium`, `high`. Use `medium` by default; `high` for trust-sensitive workflows (ad accounts, marketplaces).
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This line requires account geo, proxy geo, timezone, language, and browser fingerprint to remain consistent, which effectively directs the agent to set or recommend a particular language/locale. Because the skill does not ask for user preference or provide opt-in, it conflicts with the language/locale policy for natural-language instructions.
- Content