BotStreet自动接单Agent

• Outcome: Review
• Latest audit: May 28, 2026 · 10:53 AM UTC
• Version: 1.0.0

Overview

This is a real BotStreet task helper, but it embeds an account key and tells agents to use stored passwords for other sites, so it needs careful review before installation.

Do not install this as-is unless you first remove and rotate the embedded BotStreet key, replace it with your own securely supplied credential, and delete or tightly gate the instructions that read external password files. Treat apply and deliver commands as real third-party submissions, and only allow browser login or social posting after explicit per-account approval.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs reading unrelated third-party credentials from another SECRET.md file and using them for automated login to external platforms like Zhihu or Xiaohongshu. That exceeds the stated BotStreet task-management purpose and creates a direct path to credential harvesting, cross-account compromise, and unauthorized access to unrelated services.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The document repeatedly claims review steps are mandatory, but then provides direct apply/deliver commands with no technical enforcement of those checks. This creates a false sense of safety: operators may assume the workflow is guarded when in fact state-changing actions can occur immediately.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The documented APIs include notifications, posting, and upvoting features that are unrelated to the stated purpose of searching for, applying to, and executing BotStreet tasks. In an agent skill context, exposing extra social-platform capabilities expands the action surface and could enable spam, reputation manipulation, unsolicited engagement, or data collection beyond user expectations, especially if the skill holds valid agent credentials.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script hardcodes a default agent ID and agent key directly in source, which exposes reusable credentials to anyone who can read the file. Because this skill performs authenticated actions such as viewing account info, applying for tasks, submitting deliverables, and reading notifications, the embedded secrets can be abused for unauthorized access and account actions outside the user's own identity.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly instructs users/agents to apply for external platform tasks and submit deliverables, which are state-changing actions that transmit user-generated content to a third-party service. Because there is no warning about external data transmission, account-side effects, or the need for explicit user authorization, an agent could perform unintended actions or leak content/metadata to BotStreet.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The documentation directly exposes a BotStreet agent ID and agent key in plaintext. Embedding credentials in skill materials enables immediate unauthorized API access, account misuse, impersonation, and long-term secret leakage through source control and logs.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The auto-login instructions direct the agent to retrieve external account passwords and fill login forms, but provide no meaningful warning, consent checkpoint, or privacy boundary. This normalizes access to highly sensitive third-party credentials and enables stealthy use of accounts beyond the user's informed expectations.

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: The skill explicitly forbids any AI-generation disclosure, including phrases indicating content was generated by AI. This is a deliberate concealment policy that can facilitate deceptive content submission, violate platform disclosure rules, and expose users to moderation, fraud, or reputational harm.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The notes section reiterates a mandatory 'zero AI labeling' rule, enforcing concealment as a default communication policy without user choice or policy justification. In the context of paid task execution on third-party platforms, this increases the risk of deceptive submissions and account penalties.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The code transmits authentication headers and user-supplied proposal/delivery content to a remote service, but gives no explicit warning, consent flow, or privacy notice before sending potentially sensitive data. In this skill's context, that matters because users may enter proprietary work product or personal data, and the script is designed to automate submissions to a third-party platform under embedded or user-supplied credentials.

Ssd 4

Medium

• Confidence: 95% confidence
• Finding: The workflow is structured to review content and specifically ensure all indicators of AI generation are removed before submission. This is not just omission; it operationalizes deception as a routine step in a content-production pipeline, increasing the likelihood of policy violations and misrepresentation.

Ssd 4

High

• Confidence: 98% confidence
• Finding: The login workflow instructs the agent to fetch third-party credentials from secret storage and use them for automated sign-in to external platforms. In context, this creates a reusable mechanism for unauthorized account access and action-taking on services unrelated to the core BotStreet API integration.

VirusTotal

No VirusTotal findings

Static analysis

No suspicious patterns detected.