Agency Agents Caller

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:41 AM UTC
• Version: 1.0.3

Overview

This is mostly a local agent-prompt catalog, but it includes unsafe guidance asking users to share a ClawHub token and broad raw prompts that need careful review before use.

Install only if you are comfortable with a local prompt catalog that writes a SQLite database during setup. Do not paste ClawHub tokens or other secrets into an assistant conversation, and review any retrieved full_content before using it as a system prompt, especially prompts involving payments, identity, email, infrastructure, or generated code execution.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: LOGIN_GUIDE.md:17

Finding

Publishing Guide Encourages Disclosure of a ClawHub API Token

Content

View full analysis

Remediation

View remediation

Never paste ClawHub tokens, passwords, API keys, or other credentials into an Agent conversation. 6. Recommend short-lived, narrowly scoped publishing tokens and immediate revocation after use. 7. Document token rotation and revocation procedures for users who may already have followed the insecure instruction. 8. Ensure conversation logs and Agent memory are reviewed and purged if real tokens were previously submitted. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: data/agents.json:285

Finding

Bundled Agent Prompt Recommends Evaluating Model-Generated Python Code

Content

View full analysis

", "confidence_score": , "reasoning": "", "pattern_type": "" } No markdown. No explanation. No preamble. JSON only.""" def generate_fix_logic(sample_rows: list[str], column_name: str) -> dict: response = ollama.chat( model='phi3', messages=[ {'role': 'system', 'content': SYSTEM_PROMPT}, {'role': 'user', 'content': f"Column: '{column_name}'\nSamples:\n" + "\n".join(sample_rows)} ] ) result = json.loads(response['message']['content']) # Safety gate — reject anything that isn't a simple lambda forbidden = ['import', 'exec', 'eval', 'os.', 'subprocess'] if not result['transformation'].startswith('lambda'): raise ValueError("Rejected: output must be a lambda function") if any(term in result['transformation'] for term in forbidden): raise ValueError("Rejected: forbidden term in lambda") return result ``` ```python import pandas as pd def apply_fix_to_cluster(df: pd.DataFrame, column: str, fix: dict) -> pd.DataFrame: """Apply AI-generated lambda across entire cluster — vectorized, not looped.""" if fix['confidence_score'] < 0.75: # Low confidence → quarantine, don't auto-fix df['validation_status'] = 'HUMAN_REVIEW' df['quarantine_reason'] = f"Low confidence: {fix['confidence_score']}" return df transform_fn = eval(fix['transformation']) # safe — evaluated only after st ...[truncated 3304 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (42)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document solicits direct sharing of a sensitive ClawHub token without any warning that the credential is secret or any safer alternative beyond giving it to the agent. This normalizes unsafe credential handling and creates a straightforward path to account compromise if a user follows the instruction.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The guide asks users to hand over their ClawHub token so the assistant can perform publishing actions for them, which is a classic secret-sharing anti-pattern. In the context of this skill, publishing is unrelated to the advertised runtime capability, so the request is especially suspicious and increases the risk of credential theft or unauthorized account operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose says the skill calls 179 professional agents from a database, implying runtime agent access or database-backed invocation. The actual code only prepares a package for distribution and outputs publication steps. Its primary purpose is deployment/publishing support, not agent calling. No database access, agent invocation, or related runtime functionality appears in this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description says the skill calls 179 professional agents on-demand from a database. The supplied code does not call or invoke agents at all. Instead, it reads agents from a local JSON file and inserts them into the agent_prompts table of a SQLite database, with duplicate-avoidance behavior if data already exists. This is a materially different primary purpose: database population/import, not agent retrieval or invocation. The code also accesses a JSON file and writes to the database, which are not reflected in the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description says the skill calls 179 professional agents on-demand from a database, implying runtime retrieval/invocation behavior. The supplied code instead is a setup/initialization script: it creates folders, initializes a SQLite database table, checks record counts, and imports agent definitions from a JSON file. While this may support a larger agent-calling system, the actual primary behavior of this code chunk is database provisioning and seeding, not calling agents. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose says the skill calls 179 professional agents on-demand from a database. The supplied code chunk does not implement agent-calling behavior as its primary function. Instead, it verifies installation by checking the runtime environment, filesystem layout, database file and schema, and module importability. Although it references the agent database and agent_caller module, that is only for validation/smoke testing, not for actually calling agents on demand. Therefore the code's actual behavior is materially different from the declared description.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.

md

数据来自 [agency-agents](https://github.com/717986230/agency-agents) 仓库，已打包在 `data/agents.json` 中。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

md

数据来自 [agency-agents](https://github.com/717986230/agency-agents) 仓库，已打包在 `data/agents.json` 中。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 342)May include surrounding context.

md

数据来自 [agency-agents](https://github.com/717986230/agency-agents) 仓库，已打包在 `data/agents.json` 中。

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · data/agents.json (reported line 6)May include surrounding context.

json

[
  {
    "id": 1,
    "name": "Anthropologist",
    "category": "academic",
    "description": "Expert in cultural systems, rituals, kinship, belief systems, and ethnographic method — builds culturally coherent societies that feel lived-in rather than invented",
    "emoji": "🌍",
    "color": "#D97706",
    "tools": "",
    "vibe": "No culture is random — every practice is a solution to a problem you might not see yet",
    "filepath": "academic\\academic-anthropologist.md",
    "full_content": "---\nname: Anthropologist\ndescription: Expert in cultural systems, rituals, kinship, belief systems, and ethnographic method — builds culturally coherent societies

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · data/agents.json (reported line 12)May include surrounding context.

json

n- Check that cultural elements are internally consistent with each other\n- Verify that borrowed elements are understood in their original context\n- Assess whether a culture's internal tensions and contradictions are present (no utopias)\n\n### Build Living Cultures\n- Design exchange systems (reciprocity, redistribution, market — per Polanyi)\n- Create rites of passage following van Gennep's model (separation → liminality → incorporation)\n- Build cosmologies that reflect the society's actual concerns and environment\n- Design social control mechanisms that don't rely on modern state apparatus\n\n## 🚨 Critical Rules You Must Follow\n- **No culture salad.** You don't mix \"Japanese honor codes + African drums + Celtic mysticism\" without understanding what each element means in its original context and how they'd interact.\n- **Function before aesthetics.** Before asking \"does this ritual look cool?\" ask \"what does this ritual *do* for the community?\" (Durkheim, Malinows

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The email intelligence skill directs ingestion, reconstruction, retention, and redistribution of raw email threads, participant metadata, and attachment context for agent consumption. Because email often contains credentials, contracts, personal data, and confidential business content, this creates a high-risk concentration and propagation point if not tightly sandboxed.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · data/agents.json (reported line 788)May include surrounding context.

json

n            --resource-group ${{ secrets.AZURE_RG }} \\\n            --workspace-name ${{ secrets.SENTINEL_WORKSPACE }} \\\n            --alert-rule @compiled/sentinel/rules.kql\n```\n\n### Threat Hunt Playbook\n```markdown\n# Threat Hunt: Credential Access via LSASS\n\n## Hunt Hypothesis\nAdversaries with local admin privileges are dumping credentials from LSASS\nprocess memory using tools like Mimikatz, ProcDump, or direct ntdll calls,\nand our current detections are not catching all variants.\n\n## MITRE ATT&CK Mapping\n- **T1003.001** — OS Credential Dumping: LSASS Memory\n- **T1003.003** — OS Credential Dumping: NTDS\n\n## Data Sources Required\n- Sysmon Event ID 10 (ProcessAccess) — LSASS access with suspicious rights\n- Sysmon Event ID 7 (ImageLoaded) — DLLs loaded into LSASS\n- Sysmon Event ID 1 (ProcessCreate) — Process creation with LSASS handle\n\n## Hunt Queries\n\n### Query 1: Direct LSASS Access (Sysmon Event 10)\n```\nindex=windows sourcetype=WinEventLog:Sysmo

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The catalog includes agents with autonomous payment execution and broad orchestration authority that exceed the stated purpose of simply calling professional agents from a database. If these records are discoverable or invocable by a general caller, the skill can expose high-impact capabilities far beyond user expectation, including financial and operational actions.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The identity graph instructions explicitly promote cross-agent sharing and recall of entity-linked memory, including identity and potentially PII-bearing records. This is dangerous because it centralizes sensitive data and encourages broad access patterns, making misuse, over-retention, and tenant-boundary failure far more damaging.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guide explicitly asks the user to disclose a ClawHub API token to the assistant so it can publish on the user's behalf. API tokens are bearer credentials that grant account access, and requesting them is unnecessary for a skill whose stated function is calling professional agents from a database; if exposed, the token could be reused for unauthorized publishing or other account actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file is written entirely in Chinese and does not offer any language choice, fallback, or note that the skill is intended only for Chinese-speaking users. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation unless the regional constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Most of the skill documentation, headings, and usage explanations are presented in Chinese, while no opt-in, alternative language, or justification for the locale restriction is provided. This can violate language/locale policy when a skill implicitly forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly instructs users to retrieve an agent's full prompt from the bundled database and use it as a system prompt, but it provides no warning that this content is untrusted data and may contain prompt-injection, policy overrides, secrets, or unsafe instructions. Because these prompts are intended to run with elevated influence in downstream LLM calls, treating database content as trusted system input significantly increases the risk of instruction hijacking or data leakage.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares installation steps and documented capabilities that create directories, initialize a SQLite database, and read/write local files, but it does not declare any corresponding tool scope such as permissions or allowed-tools. Missing capability disclosure weakens the trust boundary for users and hosts because the skill can modify local state without explicit authorization metadata.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill presents a prominent user-facing heading and feature description in Chinese, and later adds substantial Chinese-only installation and data documentation. The file does not indicate that users can choose their preferred language or that the locale constraint is required for a region-specific purpose, which makes this a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest claims to provide callable agent records from a database, but actually embeds full prompt bodies, operating procedures, and extensive behavioral instructions. This materially widens the trusted prompt surface and creates prompt-injection and over-privileged behavior risk if downstream systems expected inert metadata only.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Many embedded agent definitions use broad imperative language without trigger constraints, preconditions, or scope limits. In an agentic system, this ambiguity increases the chance of unsafe activation, context overreach, and unintended execution paths because downstream orchestrators may treat descriptive text as operational instruction.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match
• Confidence: 65% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · data/agents.json (reported line 115)May include surrounding context.

json

6-04-10 05:33:01",
    "updated_at": "2026-04-10T13:33:01.546602"
  },
  {
    "id": 6,
    "name": "Brand Guardian",
    "category": "design",
    "description": "Expert brand strategist and guardian specializing in brand identity development, consistency maintenance, and strategic brand positioning",
    "emoji": "🎨",
    "color": "blue",
    "tools": "",
    "vibe": "Your brand's fiercest protector and most passionate advocate.",
    "filepath": "design\\design-brand-guardian.md",
    "full_content": "---\nname: Brand Guardian\ndescription: Expert brand strategist and guardian specializing in brand identity development, consistency maintenance, and strategic brand positioning\ncolor: blue\nemoji: 🎨\nvibe: Your brand's fiercest protector and most passionate advocate.\n---\n\n# Brand Guardian Agent Personality\n\nYou are **Brand Guardian**, an expert brand strategist and guardian who creates cohesive brand identities and ensures consistent brand expression across al