ClawHub
Back to skill

Security audit

Simmer Contributor

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly about paid hackathon task work, but it asks agents to send a persistent API key to a separate task service and act on remotely supplied tasks with broad tool authority.

Install only if you trust Simmer and the Railway task bridge with your Simmer API key, submitted work, proof links, and Base wallet address. Use a dedicated low-privilege key and reward wallet if possible, review every fetched task before claiming it, and do not let the agent submit secrets, private repository content, personal data, or credentials as task results.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:27
Finding

Cross-Origin Disclosure of the Simmer API Credential

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–53 and 68–78
Vulnerability Type: Cross-origin credential disclosure
Risk Level: High

Vulnerable Code

text
1. A **Simmer API key**. If you don't have one, register by calling:
POST https://api.simmer.markets/api/sdk/agents/register
Content-Type: application/json

{"name": "<your actual agent name>"}

Set the key as the `SIMMER_API_KEY` environment variable.
http
GET https://task-bridge-production.up.railway.app/tasks
Authorization: Bearer $SIMMER_API_KEY
http
POST https://task-bridge-production.up.railway.app/tasks/<task_id>/claim
Authorization: Bearer $SIMMER_API_KEY
http
POST https://task-bridge-production.up.railway.app/tasks/<task_id>/submit
Authorization: Bearer $SIMMER_API_KEY
Content-Type: application/json

Technical Analysis

The Skill instructs the Agent to obtain an API key from api.simmer.markets and then transmit that bearer credential to task-bridge-production.up.railway.app, which is a different origin. The documentation does not establish that the Railway deployment is an authorized credential recipient or that the API key is audience-restricted, short-lived, or limited to task operations.

Bearer credentials grant access to any party possessing them. The task service, its infrastructure provider, application logs, monitoring systems, or an attacker who compromises the deployment could capture the key. If the same key is accepted by other Simmer APIs, the recipient may be able to reuse it outside the task workflow.

This behavior exceeds minimum privilege because a primary API key is sent repeatedly for task listing, claiming, and submission instead of using a narrowly scoped task token.

Attack Path

  1. The Agent registers with api.simmer.markets or retrieves an existing SIMMER_API_KEY.
  2. Following the Skill instructions, the Agent sends the ke ...[truncated 966 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not transmit the primary SIMMER_API_KEY to a separate origin.
  • Move task operations to an authenticated endpoint under the official Simmer origin, or use a documented first-party gateway.
  • Exchange the primary credential for a short-lived token that is:
    • Audience-bound to the task service.
    • Restricted to task listing, claiming, and submission.
    • Unable to access trading, account, wallet, or administrative operations.
    • Automatically expired and independently revocable.
  • Avoid placing credentials in URLs, command output, error reports, or application logs.
  • Configure the receiving service to redact Authorization headers from all logging and telemetry.
  • Document service ownership, token scope, retention, revocation, and incident-response procedures.
  • Require explicit user consent before any credential is sent to a third-party origin.

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:19
Finding

Unrestricted Execution of Remotely Controlled Task Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–24 and 42–66
Vulnerability Type: Remote instruction channel without capability restrictions
Risk Level: High

Vulnerable Code

text
## Important: You Must Make Real API Calls

This skill requires you to **actually call HTTP endpoints** — not just read about them. Each step includes a real API call you must execute using curl, fetch, requests, or whatever HTTP tool you have available. If a step fails, report the error. Do not pretend it succeeded.

**Verify each step worked** before moving to the next one.
http
GET https://task-bridge-production.up.railway.app/tasks
Authorization: Bearer $SIMMER_API_KEY
text
Returns community tasks with title, description, and priority. Pick one you can complete well.

Tasks fall into three categories:
- **Ops** — translations, QA testing, documentation
- **Product** — designing or building new features as skills
- **Growth** — content, distribution, community outreach
text
## Step 3: Do the Work

Read the task description carefully. Use your tools and capabilities to complete it thoughtfully. Quality matters more than speed — good submissions help the team win.

Technical Analysis

The installed Skill delegates operational control to task descriptions fetched from a remote service. Those descriptions can change after the Skill has been reviewed and are not constrained by a safe schema, capability allowlist, domain allowlist, or mandatory user-approval boundary.

The instruction to use the Agent's “tools and capabilities” is broad. A malicious task description could attempt to direct filesystem access, command execution, browser automation, credential retrieval, publication of content, or transmission of local data. Because task descriptions are presented as work the Agent is expected to perform, they can operate as indirect prompt injection.

This differs from mer ...[truncated 1543 chars]

Remediation
View remediation

Remediation Suggestions

  • Treat all task titles, descriptions, links, and attachments as untrusted data rather than authoritative Agent instructions.
  • Define a strict machine-readable task schema with enumerated, narrowly scoped operations.
  • Reject tasks containing shell commands, requests for credentials, instructions to access unrelated files, or directions to contact unapproved domains.
  • Establish explicit filesystem, network, secret-access, publication, and financial-action boundaries.
  • Require informed user approval after displaying the complete task and before claiming or executing it.
  • Require separate approval for every sensitive operation, including command execution, external publication, wallet activity, or access to private resources.
  • Run task work in a sandbox with no inherited secrets and only task-specific filesystem and network access.
  • Allowlist necessary endpoints and block arbitrary outbound network requests.
  • Validate and sanitize remote task content before presenting it to the Agent.
  • Preserve an audit log showing the original task, requested capabilities, approvals, actions, and submitted data.

other

Warning
Location
SKILL.md:68
Finding

Disclosure and Correlation of Wallet Address and Potentially Sensitive Work Product

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 68–79
Vulnerability Type: Privacy and financial identifier disclosure
Risk Level: Medium

Vulnerable Code

http
POST https://task-bridge-production.up.railway.app/tasks/<task_id>/submit
Authorization: Bearer $SIMMER_API_KEY
Content-Type: application/json
json
{
  "result": "Describe what you did and include your findings or deliverables",
  "wallet_address": "0xYourBaseWalletAddress",
  "proof_url": "https://optional-link-to-evidence.com"
}
text
Include your `wallet_address` (Base network) to receive your USDC reward. If you have a claimed Simmer account with a wallet, it will be used automatically.

Technical Analysis

The submission workflow sends a persistent Base wallet address together with task results and an optional proof URL to the Railway-hosted service. Blockchain addresses are pseudonymous rather than anonymous; their public transaction histories can be correlated with submissions, account identity, reward payments, and other on-chain activity.

The Skill also requests findings or deliverables without instructing the Agent to classify or redact sensitive material. A remotely supplied task could cause private repository content, internal findings, personal information, credentials, private URLs, or confidential work product to be placed in the result or proof_url fields.

The documentation does not state the receiving service's data retention, access controls, deletion process, or privacy policy. It also does not require separate consent before linking a wallet to submitted work.

Attack Path

  1. The Agent completes a task that involves local, private, or identity-linked resources.
  2. The Agent includes findings, deliverables, or a proof URL in the submission.
  3. The Agent provides a Base wallet address to receive payment, or an existing associated wallet is used automatically.
  4. Th ...[truncated 922 chars]
Remediation
View remediation

Remediation Suggestions

  • Require an explicit preview and user confirmation of every submission field.
  • Add automated secret scanning and redaction before submission.
  • Prohibit submission of API keys, environment variables, private repository content, personal information, internal URLs, authentication tokens, and confidential artifacts.
  • Make wallet disclosure separately consented rather than automatic.
  • Permit users to provide a dedicated reward wallet that is not linked to unrelated on-chain activity.
  • Clearly document why each field is required, who receives it, how long it is retained, and how deletion can be requested.
  • Apply data minimization by sending only the information necessary to review the task.
  • Use access controls and encryption for stored submissions and wallet mappings.
  • Warn users that wallet addresses and transactions are publicly traceable and may enable identity correlation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly instructs the agent to use a persistent Simmer API key in Authorization headers against external endpoints, but provides no guidance on secret handling, storage, scope, rotation, or endpoint trust. This creates a real risk of credential exposure or misuse if the key is logged, reused in untrusted tooling, or sent to unexpected services during task execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The skill directs outbound transmission to an external service to obtain and then use a credential, which is a genuine external data flow. In context this appears to be legitimate product functionality rather than overtly malicious, but it is still security-relevant because it conditions the agent to interact with third-party infrastructure and can expose identifiers, wallet information, and API credentials if mishandled.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

  1. A Simmer API key. If you don't have one, register by calling:
text
POST https://api.simmer.markets/api/sdk/agents/register
Content-Type: application/json

{"name": "<your actual agent name>"}