T03 · Remote Payload Retrieval and Execution
Error
- Location
marketplace.html:531- Finding
Mutable Remote Skill Files Can Be Installed as Persistent Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Credara
Security checks for vulnerabilities and agentic risk
Overview
Credara is a coherent agent credential and marketplace skill, but it handles owner credentials, persistent skill installation, browser tokens, and wallet key flows in ways users should review carefully before installing.
Review this skill before installing. Only use it if you are comfortable sending agent and owner account data to Credara, letting agents handle narrowly scoped credentials, and installing marketplace skill packs after manually checking their contents. Avoid pasting reusable owner JWTs into shell commands; prefer the human dashboard or short-lived delegated tokens. Treat browser sessions, wallet private keys, and downloaded SKILL.md files as sensitive.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
dashboard.html:619- Finding
Unsanitized API Data Is Written to HTML Sinks
- Content
View full analysis
(a.id || a.agentId) === agentId); const creds = agent?.credentials || []; if (!creds.length) return; const container = document.getElementById('share-badges'); let html = ''; creds.forEach(c => { const credId = c.id || c.credentialId; const domain = c.domainName || c.domain_name || c.domain || 'Unknown'; const verifyUrl = window.location.origin + '/api/credentials/' + credId + '/verify'; const badgeUrl = window.location.origin + '/api/credentials/' + credId + '/badge.svg'; const vcUrl = window.location.origin + '/api/credentials/' + credId + '/vc.json'; html += ''; html += ''; }); container.innerHTML = html; } ``` Provisioning-response fields are also rendered directly: ```javascript function showKeyReveal(data) { document.getElementById('modal-form').style.display = 'none'; document.getElementById('modal-success').style.display = 'block'; document.getElementById('revealed-key').textContent = da ...[truncated 2916 chars]L' + c.level + ' ' + domain + ''; html += 'Markdown Badge (for README)'; html += 'Copy'; html += ''; html += '[](' + verifyUrl + ')- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
app.html:197- Finding
Long-Lived Bearer Credentials Are Stored in Script-Readable Local Storage
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
dashboard.html:1711- Finding
Unpinned Remote Script Executes in the Same Context as Generated Wallet Private Keys
- Content
View full analysis
``` The marketplace uses another remotely hosted version: ```html ``` The Skill documentation also recommends an unpinned package installation: ```bash npm install @credara/sdk ``` ```typescript import { CredaraClient } from '@credara/sdk'; const client = new CredaraClient({ baseUrl: 'https://www.credara.xyz', agentKey: 'claw_agent_xxx', }); ``` ### Technical Analysis The CDN scripts execute with full privileges in the Credara page origin. No `integrity` attribute is present to ensure that the fetched bytes match an audited release. A compromised CDN account, CDN infrastructure, DNS path, or upstream artifact could therefore run arbitrary JavaScript in the page. This is particularly sensitive on the dashboard because the remote library participates in wallet creation. A malicious replacement could generate attacker-known keys, substitute an attacker-controlled address, read the displayed private key, or access owner tokens and agent keys available to page JavaScript. The unpinned npm command also al ...[truncated 1370 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
skill.md:14- Finding
Agent Instructions Encourage Exposure of Owner Identity and Broad Bearer Credentials
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (119)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </header> <div class="builder-layout"> <!-- Sidebar --> <aside class="builder-sidebar" id="sidebar"> <div id="sidebar-skill"> <div class="sidebar-header">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </nav> <div id="root"> <!-- Skeleton while loading --> <div class="breadcrumb"><div class="breadcrumb-inner"><span class="skel" style="width:180px;height:12px;display:inline-block"></span></div></div> <div class="hero"><div class="hero-inner"> <div>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <span id="dstatus-pre" style="margin-left:auto;font-size:.65rem;color:var(--gray);font-family:var(--mono)"></span> </div> <!-- Tab nav --> <div style="display:flex;gap:0;border-bottom:1px solid var(--cream);margin-bottom:1.5rem"> <button onclick="switchTab('instruct')" id="tab-instruct" style="font-size:.6rem;letter-spacing:.15em;text-transform:uppercase;padding:.65rem 1.25rem;border:none;background:none;cursor:pointer;border-bottom:2px solid var(--red);color:var(--red)">Instruct Agent</button> <button onclick="switchTab('run')" id="tab-run" style="font-size:.6rem;letter-spacing:.15em;text-transform:uppercase;padding:.65rem 1.25rem;border:none;background:none;cursor:pointer;border-bottom:2px solid transparent;color:var(--gray)">Run Now</button>
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
html </div> <div class="earnings-note"> <strong>Why complete this?</strong> Until your Stripe account is active, you can create and edit skill packs but publishing requires Stripe. Complete onboarding to unlock payouts. </div> <div style="text-align:center;margin-top:1.5rem;padding-top:1rem;border-top:1px solid var(--cream)">
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
html <div class="modal-overlay" id="edit-modal" style="display:none;position:fixed;inset:0;background:rgba(0,0,0,.5);z-index:1100;justify-content:center;align-items:flex-start;padding-top:60px;overflow-y:auto"> <div style="background:#fff;border-radius:12px;padding:2rem;max-width:640px;width:95%;margin:1rem auto 2rem;max-height:90vh;overflow-y:auto;position:relative"> <button onclick="closeEditModal()" style="position:absolute;top:.75rem;right:1rem;background:none;border:none;font-size:1.3rem;color:var(--gray);cursor:pointer">×</button> <h2 style="font-family:var(--serif);margin-bottom:.25rem">Edit Skill Pack</h2> <p style="color:var(--gray);font-size:.8rem;margin-bottom:1.5rem" id="edit-pack-id"></p> <div style="margin-bottom:1rem">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <div class="dash-wrap"> <!-- Top Bar --> <div class="top-bar"> <div class="top-left"> <h1>Dashboard</h1>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <div class="dash-wrap"> <!-- Top Bar --> <div class="top-bar"> <div class="top-left"> <h1>Dashboard</h1>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <div class="stat"><div class="stat-val" id="p-improve"></div><div class="stat-label">Avg Improvement</div></div> </div> <!-- My Agents --> <div class="section-title">My Agents</div> <div class="bot-grid" id="bot-grid"> <!-- Populated by JS -->
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <div class="modal"> <button class="modal-close" onclick="closeAddBot()">×</button> <!-- Step 1: Connect Form --> <div id="modal-form"> <h2>Connect Your Agent</h2> <p class="sub">Link your existing AI agent to Credara. Your agent keeps its identity — Credara becomes its credential and marketplace layer.</p>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </div> </div> <!-- Manage Agent Modal --> <div class="modal-overlay" id="manage-modal"> <div class="modal"> <button class="modal-close" onclick="closeManage()">×</button>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </div> </div> <!-- Manage Agent Modal --> <div class="modal-overlay" id="manage-modal"> <div class="modal"> <button class="modal-close" onclick="closeManage()">x</button>
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The dashboard stores bearer access tokens and refresh tokens in
localStorage, making them readable by any JavaScript executing in the page origin. If an XSS bug, compromised third-party script, or malicious injected content executes, it can steal tokens and fully impersonate the user, including agent management and credential actions.- Content
html } // ── Silent token refresh ────────────────────────────────────────── // Attempts to get a fresh access token using the refresh token. // Returns true on success (TOKEN is updated), false if refresh is invalid/missing. async function tryRefreshToken() { const refreshToken = localStorage.getItem('refreshToken');
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <div id="demo"> <div id="stage"> <!-- ─── SLIDE 0: Intro ──────────────────────────────────────── --> <div class="slide active" id="slide-0"> <div class="slide-bg s0-bg"></div> <div class="s0-center">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </div> </div> <!-- ─── SLIDE 2: Provision Bot ─────────────────────────────── --> <div class="slide" id="slide-2"> <div class="slide-bg" style="background:#0d0d0d"></div> <div style="height:100%;display:flex;align-items:center;justify-content:center;flex-direction:column;gap:1rem">
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
html </div> </div> </div> <div id="s2-ann" class="annotation bottom" style="top:calc(50% + 90px);left:50%;transform:translateX(-50%)">API key shown once — store in Keychain immediately</div> </div> </div>
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
html </div> </div> </div> <div id="s2-ann" class="annotation bottom" style="top:calc(50% + 90px);left:50%;transform:translateX(-50%)">API key shown once — store in Keychain immediately</div> </div> </div>
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
html </div> </div> </div> <div id="s2-ann" class="annotation bottom" style="top:calc(50% + 90px);left:50%;transform:translateX(-50%)">API key shown once — store in Keychain immediately</div> </div> </div>
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
html </div> </div> </div> <div id="s2-ann" class="annotation bottom" style="top:calc(50% + 90px);left:50%;transform:translateX(-50%)">API key shown once — store in Keychain immediately</div> </div> </div>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </div> </div> <!-- ─── SLIDE 4: Benchmark ──────────────────────────────────── --> <div class="slide" id="slide-4"> <div class="slide-bg" style="background:#0d0d0d"></div> <div style="height:100%;display:flex;align-items:center;justify-content:center;flex-direction:column;gap:1rem">
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
html <span class="t-out">gateway ● running</span><br> <span class="t-out">channel telegram → connected</span><br> <span class="t-out">agent ResearchBot (active)</span><br> <span class="t-out">security keychain ✓ | inbound-ports ✗ | rotation scheduled</span> </div> <span class="t-cursor"></span> </div>
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
html <span class="t-out">gateway ● running</span><br> <span class="t-out">channel telegram → connected</span><br> <span class="t-out">agent ResearchBot (active)</span><br> <span class="t-out">security keychain ✓ | inbound-ports ✗ | rotation scheduled</span> </div> <span class="t-cursor"></span> </div>
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
html <span class="t-out">gateway ● running</span><br> <span class="t-out">channel telegram → connected</span><br> <span class="t-out">agent ResearchBot (active)</span><br> <span class="t-out">security keychain ✓ | inbound-ports ✗ | rotation scheduled</span> </div> <span class="t-cursor"></span> </div>
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
html <span class="t-out">gateway ● running</span><br> <span class="t-out">channel telegram → connected</span><br> <span class="t-out">agent ResearchBot (active)</span><br> <span class="t-out">security keychain ✓ | inbound-ports ✗ | rotation scheduled</span> </div> <span class="t-cursor"></span> </div>
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
html <span class="t-out">gateway ● running</span><br> <span class="t-out">channel telegram → connected</span><br> <span class="t-out">agent ResearchBot (active)</span><br> <span class="t-out">security keychain ✓ | inbound-ports ✗ | rotation scheduled</span> </div> <span class="t-cursor"></span> </div>
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
html <span class="t-out">gateway ● running</span><br> <span class="t-out">channel telegram → connected</span><br> <span class="t-out">agent ResearchBot (active)</span><br> <span class="t-out">security keychain ✓ | inbound-ports ✗ | rotation scheduled</span> </div> <span class="t-cursor"></span> </div>
Static analysis
No suspicious patterns detected.