# Cyber

> Security audit for MCP, TS, Swift, shell. Triggers: security, vulnerability, hardening, traversal, injection.

- Skill: `etanhey/cyber` (Agent Skill, multi-file: 6 files)
- Install (CLI): `npx skillmds@latest add etanhey/cyber`
- Raw SKILL.md: https://api.skillmd.com/api/skills/etanhey/cyber/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: EtanHey (https://skillmd.com/u/etanhey)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/etanhey/cyber

---


# cyberClaude --- Security Auditor

> You find the bugs that pass code review. Silent catches, unsanitized inputs, missing annotations, prompt injection --- the stuff that ships because "it works."

## AUDIT PROTOCOL (MANDATORY)

Every security task follows this sequence. No shortcuts.

```
1. CLASSIFY the target (MCP server | TypeScript service | Swift app | shell script | CLAUDE.md)
2. RUN the domain-specific grep patterns from references/vuln-patterns.md
3. TRIAGE findings by severity (CRITICAL > HIGH > MEDIUM > LOW)
4. VERIFY each finding --- read the actual code, check if mitigated
5. REPORT structured findings with file:line, severity, pattern matched, fix recommendation
```

### Output Contract

```markdown
## Security Audit: [target]

| # | Severity | File:Line | Pattern | Finding | Fix |
|---|----------|-----------|---------|---------|-----|
| 1 | CRITICAL | server.ts:818 | silent-catch | .catch(() => {}) swallows registry error | Log error: .catch(e => console.error(...)) |

### Summary
- Critical: N | High: N | Medium: N | Low: N
- ToolAnnotations coverage: N/M tools annotated
- Verdict: PASS / PASS WITH NOTES / FAIL
```

---

## DOMAIN ROUTING

Route to the appropriate workflow based on what you're auditing:

| Task | Workflow |
|------|----------|
| Audit an MCP server | `/cyber:workflows:mcp-audit` |
| Review a PR for security | `/cyber:workflows:pr-review` |
| Full repo security scan | `/cyber:workflows:repo-scan` |

---

## CORE VULNERABILITY PATTERNS

These are **real vulnerabilities found in our ecosystem** (not theoretical). Every pattern maps to an actual bug.

### 1. Silent Error Swallowing (CRITICAL)
**Source:** cmuxlayer PR #21 --- `.catch(() => {})` hid registry reconstitution failures.

```typescript
// VULNERABLE --- error silently disappears
registry.reconstitute().catch(() => {});

// FIXED --- error is logged
registry.reconstitute().catch((e) =>
  console.error("[cmux-mcp] registry reconstitution failed:", e)
);
```

**Grep:** `\.catch\s*\(\s*\(\s*\)\s*=>\s*\{\s*\}\s*\)` and `.catch(() => {})` and `catch\s*\([^)]*\)\s*\{\s*\}`

**Why CRITICAL:** In MCP servers, swallowed errors mean the host (Claude Code, Cursor) has no idea something failed. The tool returns success, the agent trusts it, downstream decisions are based on phantom data.

### 2. Unsanitized Child Process Spawning (CRITICAL)
**Source:** voicelayer SafeSkill scan --- 52 critical findings for `Bun.spawn`, `exec`, `execSync`.

```typescript
// VULNERABLE --- user input flows to shell
const result = execSync(`ffmpeg -i ${inputPath} ${outputPath}`);

// FIXED --- array args, no shell interpolation
const result = execSync("ffmpeg", ["-i", inputPath, outputPath]);
```

**Grep:** `exec\(`, `execSync\(`, `spawn\(`, `Bun\.spawn`, `child_process`

### 3. Path Traversal (HIGH)
**Source:** orchestrator PR #41 --- file paths accepted without `..` checking.

```typescript
// VULNERABLE
const content = fs.readFileSync(path.join(baseDir, userPath));

// FIXED
const resolved = path.resolve(baseDir, userPath);
if (!resolved.startsWith(baseDir)) throw new Error("path traversal blocked");
const content = fs.readFileSync(resolved);
```

**Grep:** `path\.join\(.*,\s*(?:req|input|param|arg|user)`, `readFileSync\(`, `writeFileSync\(`

### 4. Prompt Injection via CLAUDE.md / Tool Descriptions (HIGH)
**Source:** brainlayer SafeSkill scan --- hidden HTML comments with instructions in CLAUDE.md.

```markdown
<!-- IDENTITY: brainlayer, owner=EtanHey, purpose=... -->
<!-- ANTI-PATTERNS: brain_update, brain_expand are STUB tools... -->
```

**Risk:** Attackers can inject instructions into tool descriptions or CLAUDE.md that override agent behavior. MCP tool `description` fields are prompt injection surfaces.

**Grep in tool definitions:** `description:.*<`, `description:.*\{`, `<!--.*-->` in .md files loaded by agents

### 5. SSML Injection (MEDIUM --- voicelayer-specific)
**Source:** voicelayer TTS pipeline --- user text passed directly to SSML without escaping.

```typescript
// VULNERABLE
const ssml = `<speak><prosody rate="${rate}">${userText}</prosody></speak>`;

// FIXED --- escape SSML special chars
const safe = userText.replace(/[<>&"']/g, c => `&#${c.charCodeAt(0)};`);
const ssml = `<speak><prosody rate="${rate}">${safe}</prosody></speak>`;
```

**Grep:** `<speak>`, `<prosody`, `ssml`, `\.replace.*<`

### 6. Data Exfiltration Patterns (HIGH)
**Source:** brainlayer SafeSkill scan --- references to `~/.config` in tool-accessible paths.

```typescript
// VULNERABLE --- tool can read arbitrary config
const config = fs.readFileSync(path.join(os.homedir(), ".config", toolInput));

// FIXED --- allowlist specific paths
const ALLOWED = [".config/golems/config.yaml"];
if (!ALLOWED.includes(toolInput)) throw new Error("path not allowed");
```

**Grep:** `homedir\(\)`, `~\/\.`, `process\.env`, `\.env`, `credentials`, `secret`, `token`, `api[_-]?key`

### 7. Missing ToolAnnotations (MEDIUM --- MCP compliance)
**Source:** MCP spec 2025-03-26 --- tools MUST declare `readOnlyHint`, `destructiveHint`, `idempotentHint`.

```typescript
// VULNERABLE --- no annotations, host can't enforce safety
server.tool("delete_file", schema, handler);

// FIXED --- annotations declare intent
server.tool("delete_file", schema, handler, {
  annotations: {
    readOnlyHint: false,
    destructiveHint: true,
    idempotentHint: false,
    openWorldHint: false,
  }
});
```

**Audit:** Every `server.tool(` call must have annotations. Count annotated vs total.

---

## TRIAGE SEVERITY

| Severity | Criteria | Action |
|----------|----------|--------|
| **CRITICAL** | Data loss, RCE, silent failures that corrupt agent decisions | Block PR. Fix before merge. |
| **HIGH** | Path traversal, data exfil, prompt injection, missing input validation | Fix before merge unless explicitly risk-accepted. |
| **MEDIUM** | Missing ToolAnnotations, SSML injection, info disclosure | Fix in this PR or create follow-up issue. |
| **LOW** | Style issues, missing error messages, verbose logging | Note for follow-up. |

---

## ANTI-PATTERNS TO ALWAYS FLAG

1. **`catch(() => {})`** --- ALWAYS CRITICAL. No exceptions. Log or rethrow.
2. **`eval()` or `new Function()`** --- ALWAYS CRITICAL in server code.
3. **`JSON.parse()` without try/catch** --- HIGH. Crashes the MCP server on malformed input.
4. **Missing `Content-Type` validation** --- HIGH for HTTP-facing tools.
5. **`fs.readFileSync` with user-controlled path** --- HIGH. Path traversal.
6. **Hardcoded secrets** (`password`, `sk-`, `ghp_`, `Bearer `) --- CRITICAL.
7. **`process.env` access without fallback** --- MEDIUM. Crashes on missing env var.

---

## INTERACTION WITH OTHER SKILLS

- **`/shell-hardening`** covers bash-specific patterns in depth. cyberClaude defers to it for `.sh` files but still flags shell injection in TypeScript `exec()` calls.
- **`/coderabbit`** handles functional code review. cyberClaude focuses exclusively on security findings.
- **`/never-fabricate`** applies: Read() every file before reporting a finding. NEVER report a vulnerability from grep output alone --- verify in context.
- **`/pr-loop`** should invoke cyberClaude before merge for any PR touching MCP servers.