ClawHub
Back to skill

Security audit

mycelium

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent remote collaboration client, but it should be reviewed because it can send agent task data and API credentials to an externally configurable service while overstating its privacy protections.

Install only if you are comfortable with task goals, execution summaries, feedback, and your Mycelium API key being used with a remote service. Avoid using this on secrets, regulated data, private customer data, or proprietary workflows; do not set MYCELIUM_API_URL unless you fully trust the endpoint; and prefer installing in an isolated Python environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/lib/mycelium_sdk/client.py:108
Finding

Published Payload Contains Fields That Bypass Sensitive-Data Scrubbing

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/lib/mycelium_sdk/client.py:60
Finding

API Credentials Can Be Transmitted to an Untrusted or Plaintext Custom Endpoint

Content
View full analysis
None: self.api_url = (api_url or os.getenv("MYCELIUM_API_URL", "https://mycelium-platform.onrender.com")).rstrip("/") self.api_key = api_key or os.getenv("MYCELIUM_API_KEY", "") self.timeout = timeout self.agent_id = agent_id or os.getenv("OPENCLAW_AGENT_ID", "openclaw_user") self._headers = {"X-API-Key": self.api_key, "Content-Type": "application/json"} def seek( self, goal: str, scope: str = "task", context: dict[str, Any] | None = None, tags: list[str] | None = None, limit: int = 5, ) -> list[dict[str, Any]]: payload = { "fingerprint": { "goal": goal, "scope": scope, "context": context or {}, "tags": tags or [], }, "limit": limit, } with httpx.Client(timeout=self.timeout) as client: resp = client.post( f"{self.api_url}/pheromones/match", json=payload, headers=self._headers, ) ``` The CLI forwards the environment-controlled endpoint into the authenticated client: ```python def get_client(): api_url = os.getenv("MYCELIUM_API_URL", "https://mycelium-platform.onrender.com").rstrip("/") api_key = os.getenv("MYCELIUM_API_KEY") if not api_key: print(json.dumps({ "error": "Missing MYCELIUM_API_KEY. Please run the 'register' command or set it in your environment." })) sys.exit(1) return MyceliumClient(api_url=api_url, api_key=api_key) ``` ### Technical Analysis `MYCELIUM_API_URL` can select any URL without validating its scheme or host. The client then se ...[truncated 1397 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
scripts/install.py:4
Finding

Installer Retrieves an Unpinned Dependency Without Integrity Verification

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (10)

Tainted flow: 'api_url' from os.getenv (line 58, credential/environment) → httpx.post (network output)

Critical
Category
Data Flow
Confidence
92% confidence
Finding

The CLI takes MYCELIUM_API_URL directly from the environment and uses it to construct an outbound HTTP request without any validation or allowlisting. In an agent or automation context, a manipulated environment variable can redirect registration traffic to an attacker-controlled host, causing exfiltration of user-supplied data and enabling SSRF-style outbound connections from trusted environments.

Content

Scanner excerpt · scripts/mycelium_cli.py (reported line 61)May include surrounding context.

python
api_url = os.getenv("MYCELIUM_API_URL", "https://mycelium-platform.onrender.com").rstrip("/")

        if args.command == "register":
            resp = httpx.post(f"{api_url}/users/register", json={"handle": args.handle}, timeout=10.0)
            resp.raise_for_status()
            print(json.dumps(resp.json(), indent=2))
            return

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The metadata presents the skill as a collaboration/network interface, but the declared installation path executes a local Python installer and pip dependency setup. When a skill's stated purpose does not clearly disclose local package installation and environment modification, users and agents may grant trust or invoke it under false assumptions, enabling unexpected code execution during setup.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

The metadata presents the skill as a collaboration/network interface, but the declared installation path executes a local Python installer and pip dependency setup. When a skill's stated purpose does not clearly disclose local package installation and environment modification, users and agents may grant trust or invoke it under false assumptions, enabling unexpected code execution during setup.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares executable capabilities requiring environment variables, network access, and shell execution, but does not define any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may invoke powerful local and network actions without a clearly constrained policy surface, increasing the chance of unintended command execution, secret exposure, or data exfiltration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is advertised for use on 'complex strategic task[s]' or whenever an agent wants to publish an execution path, which is an overly broad trigger for a capability that can access env secrets, perform network operations, and invoke shell commands. Broad activation criteria increase the likelihood that the skill is invoked in sensitive contexts where execution traces, goals, or operational metadata could be sent externally.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install.py (reported line 11)May include surrounding context.

python
print("✅ httpx already installed.")
    except ImportError:
        print("Installing httpx...")
        subprocess.check_call([sys.executable, "-m", "pip", "install", "httpx"])
    print("Done.")

if __name__ == "__main__":

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This installer script performs network-capable package installation during execution, which expands the skill's effective capabilities beyond its stated strategic-network purpose and introduces supply-chain risk. Even though the package name is hard-coded, runtime pip installation can pull unpinned code from external indexes, producing non-reproducible and potentially unsafe installs in environments that execute the skill automatically.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code advertises a human-in-the-loop safety control for publish(), but enforcement is only a caller-supplied boolean. Any calling agent or integration can set confirmed=True without proving that a human actually reviewed the data, so the control is cosmetic and can be bypassed trivially. In this skill’s context, publish sends execution paths and related data to an external collective network, which increases the risk of unintended data exfiltration.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

publish() scrubs goal, path, and tags, but sends context unsanitized despite positioning the method as protecting against accidental leakage. Because context is user- and agent-controlled and may contain prompts, credentials, file paths, tokens, or other sensitive execution metadata, this creates a direct exfiltration path to the remote Mycelium service. Given the skill’s purpose of publishing agent execution data to a network, this mismatch is especially dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The register command sends the provided handle to a remote service immediately, but this file does not present a clear disclosure or confirmation at the point of transmission. In a skill meant for agent use, silent transmission of user-associated identifiers to an external platform creates a privacy and consent risk, especially because the skill is explicitly designed to interface with a collective network.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.