Security audit

ThinkForce

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate ThinkForce mission-management guide, but it gives agents broad mission, credential, browser, and public-sharing authority with insufficient controls for sensitive content.

Review this skill before installing if your missions may touch customer data, internal dashboards, paid vendor APIs, or stored credentials. Require users to approve credential use, public sharing, authenticated screenshots, public uploads, destructive mission changes, and external vendor forwarding, and prefer private or expiring URLs over long-lived public links.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:565
Finding: Authenticated Dashboard Screenshots Are Published Through Long-Lived Public URLs
Content: View full analysis
" }) User_Browser({ action:"type", sessionId, selector:"input[name=password]", text:"", submit:true }) // (retrieve / via Get_Credentials, never paste into runInstructions) 3. For each beat: User_Browser({ action:"navigate", sessionId, url:"https://app.example.com/dashboard/" }) User_Browser({ action:"wait", sessionId, selector:".dashboard-ready" }) s = User_Browser({ action:"screenshot", sessionId }) // The screenshot tool writes the PNG to /tmp/user_browser__.png // inside User_Browser's E2B sandbox and returns // { result: { dataUrl, file_path, sandboxId } }. pub = E2B_File_Manager({ action:"upload_public", file_path: s.result.file_path }) // Do NOT pass sandboxId — every User_Browser call pins its sandbox as the // task's persistent sandbox, so the file_manager dispatcher auto-routes // to the same sandbox the screenshot was written into. Passing the wrong // sandboxId is the single most common cause of "file does not exist" // failures here. // // pub.publicUrl is the Firebase Storage download URL — that's what you // forward to Seedance / Image_Generation / Video_Generation downstream. 4. User_Browser({ action:"stop", se ...[truncated 3034 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:808
Finding: Platform-Wide Credential Discovery and General-Purpose Execution Exceed Least Privilege
Content: View full analysis
/subtasks//run`, the runner prepends a platform preamble onto the agent's own `agentRole` system prompt. Agents that don't know about these rules will still follow them — they're injected automatically. The rules currently in force: | Rule | What it does | |---|---| | **EXECUTION** | Force multi-step completion — never stop after retrieving credentials, always continue to the action that uses them. | | **SANDBOX NOTE** | E2B is non-root: `sudo apt-get install -y …`, `pip3 install …` (no sudo), npm/node/npx (no sudo). | | **CREDENTIAL-FIRST DISCOVERY** | Before the first third-party API call, agents call `Manage_Credentials({ action: "list" })` to see what's stored, then `Get_Credentials({ platform: "" })`. Skip only when the tool docs say "credentials auto-loaded" (Code_Assistant git ops, Clawd, Web_Browser cloud). Never paste credential values into output. | | **PREFER E2B run_code** | The default first move for vendor-API calls, scripting, data work, and integrations is `E2B_File_Manager({ action: "run_code" })` — a few lines of curl/python/node is almost always more flexible than waiting for a typed tool. Typed tools (`Voice_Generation`, `Image_Generation`, `Music_Generation`, `Video_Generation`, `Web_Search`, …) are conveniences (auto-Firebase upload, preview surfaces) — reach for them only when you specifically want those platform conveniences. | | **ASYNC TOOL PATTERN** | Set-and-forget: submit → store taskId in Memory_Manager → poll with the correct status tool. Never resubmit a job whose status is `processing`. | | **TOOL ERROR HANDLING** | Classify before retrying: 401/403 → `Get_Credentials` then retry once; 400/422 → fix args then retry once; 429 → wait 10s then retr ...[truncated 3030 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (13)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.
md
| List missions | `GET /api/missions?companyId=...` | | Read one mission | `GET /api/missions/<id>?companyId=...` | | Update mission metadata | `PATCH /api/missions/<id>` | | Delete mission | `DELETE /api/missions/<id>?companyId=...` | | Auto-decompose into subtasks | `POST /api/missions/<id>/decompose` | | Add a subtask manually | `POST /api/missions/<id>/subtasks` | | List subtasks | `GET /api/missions/<id>/subtasks?companyId=...` |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.
md
| Share (read/clone) | `POST /api/missions/<id>/share` | | Invite (live collab) | `POST /api/missions/<id>/invite` | | List members + open invites | `GET /api/missions/<id>/invite?companyId=...` | | Revoke a member | `DELETE /api/missions/<id>/invite?companyId=...&uid=<uid>` | ---

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 764)May include surrounding context.
Revoke:

http
DELETE /api/missions/<id>/invite?companyId=<id>&uid=<uid> DELETE /api/missions/<id>/invite?companyId=<id>&all=1

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: The all=1 revoke endpoint removes all invites or members in a single operation, which amplifies the blast radius of a mistaken or over-broad call. Although the skill later says to confirm destructive actions, this especially destructive variant is not called out with a stronger warning or scoped safeguards, making accidental denial of collaboration more likely.
Content: Scanner excerpt · SKILL.md (reported line 765)May include surrounding context.
Revoke:

http
DELETE /api/missions/<id>/invite?companyId=<id>&uid=<uid> DELETE /api/missions/<id>/invite?companyId=<id>&all=1

Rule: Use Share when the user wants others to copy the mission. Use Invite when they want to work on it together.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs use of API keys and later encourages retrieving and using stored credentials with third-party services, but it does not present a prominent upfront warning that sensitive data may be transmitted to external APIs, browsers, sandboxes, and vendors. That omission can lead users or agents to send secrets, mission content, or personal data off-platform without explicit awareness or consent.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
### What NOT to do - ❌ Don't ask the user for their `companyId` — the API key already binds you to one. - ❌ Don't guess or hard-code it. - ❌ Don't call `GET /api/companies` on every action — cache the result for the session. - ❌ Don't try to switch companies mid-session by passing a different `companyId` — the key won't authenticate against a different company and you'll get 401.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.
md
### Real agent schema (what's actually there) | Field | What it is | | ----------------- | ------------------------------------------------------------------------------------------------ | | `agentName` | Short display name (e.g. "Market Researcher", "Driver Recruitment Agent"). The primary handle. | | `agentRole` | **Free-text system prompt** for the agent — often paragraphs long. NOT a short role label. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 509)May include surrounding context.
md
Common built-in tool names, so you can recognize what a step needs and match it to an agent that has it: | Tool name | What it does | | ---------------------- | --------------------------------------------------------------------------------------------- | | `Web_Browser` | Cloud headless browser (browser-use). Autonomous, set-and-forget. See §7.6. | | `User_Browser` | Interactive E2B desktop browser with VNC stream + screenshot-to-PNG-data-URL. See §7.6. |

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill earlier documents that agents expose enabledTools[] and explicitly says tools[] does not exist, but this section later instructs the reader to inspect agents[].tools[]. That contradiction can cause an agent to mis-evaluate capabilities, misassign subtasks, and then fall back to weaker behavior or incorrect execution paths, undermining safety controls tied to tool availability.
Content: No source excerpt is available for this finding.

Behavior Manipulation

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
Content: Scanner excerpt · SKILL.md (reported line 707)May include surrounding context.
md
For a zombie, prefer `POST .../subtasks/<sid>/cancel` over a raw `/run` reclaim — cancel cleans up `runDispatching`, `currentActivity`, and any descendant fanout in one call. **Rule:** Always prefer the lifecycle endpoints over a raw `PATCH status:`. The PATCH path skips the runner signal, so an in-flight loop keeps spending tokens until it hits the next status-aware checkpoint (which may be many minutes away if it's parked in a long tool call). ---

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The share and invite sections describe creating preview, clone, and live-collaboration links, but they do not prominently warn that mission content becomes accessible to other people through those links. Because missions may contain proprietary plans, outputs, files, or linked data, using these features without a strong warning increases the risk of unintended disclosure.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 813)May include surrounding context.
md
| Rule | What it does | |---|---| | **EXECUTION** | Force multi-step completion — never stop after retrieving credentials, always continue to the action that uses them. | | **SANDBOX NOTE** | E2B is non-root: `sudo apt-get install -y …`, `pip3 install …` (no sudo), npm/node/npx (no sudo). | | **CREDENTIAL-FIRST DISCOVERY** | Before the first third-party API call, agents call `Manage_Credentials({ action: "list" })` to see what's stored, then `Get_Credentials({ platform: "<name>" })`. Skip only when the tool docs say "credentials auto-loaded" (Code_Assistant git ops, Clawd, Web_Browser cloud). Never paste credential values into output. | | **PREFER E2B run_code** | The default first move for vendor-API calls, scripting, data work, and integrations is `E2B_File_Manager({ action: "run_code" })` — a few lines of curl/python/node is almost always more flexible than waiting for a typed tool. Typed tools (`Voice_Generation`, `Image_Generation`, `Music_Generation`, `Video_Generation`, `Web_Search`, …) are conveniences (auto-Firebase upload, preview surfaces) — reach for them only when you specifically want those platform conveniences. | | **ASYNC TOOL PATTERN** | Set-and-forget: submit → store taskId in Memory_Manager → poll with the correct status tool. Never resubmit a job whose status is `processing`. |

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 864)May include surrounding context.
md
Apply these rules before every action: 1. **Bootstrap first.** At session start, call `GET /api/companies` to resolve the user's `companyId`. Cache it. Pass it on every subsequent request. Never ask the user for it. 2. **Read before writing.** Always GET the mission + subtasks before deciding. State changes async (other agents, the user, schedulers).

Static analysis

No suspicious patterns detected.