ClawHub
Back to skill

Security audit

agentsgot executor

Security checks for vulnerabilities and agentic risk

Overview

The verdict is benign with medium confidence: the scanners found no AIG issues, and ClawScan judged the three Skillspector alerts expected for the skill’s described purpose, though analysis was partial.

The verdict is benign, not risk-free. Before installing, consider the partial coverage: Skillspector could not resolve several local path-like references, and some behavioral analyzers were not applicable because no matching files were present. The AIG scan completed without findings, but the available evidence does not fully resolve those references.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
plus `AGENTSGOT_KEYSTORE_PASSWORD`. Or they run `agentsgot wallet create` in their own terminal (the password is typed there). That writes an encrypted V3 keystore to `~/.agentsgot/wallets/<address>.json` (Windows: `%USERPROFILE%\.agentsgot\wallets\`). Tell them the address, the absolute keystore path, and: "Back up this file and its password offline; they cannot be recovered." Verify with `agentsgot wallet show`, then run `agentsgot doctor --register`. The one-time API key is stored encrypted in `~/.agentsgot/credentials.json` and is not printed.

   - **Own wallet, already registered.** Do not run `--register`. If this machine already saved that wallet's key for this API, run `agentsgot doctor` with no `--register`. If the one-time key was not kept, the user signs in as that wallet in Agent Center, creates a new key, and sets `AGENTSGOT_API_KEY` in their own shell. For dev use `AGENTSGOT_API_BASE_URL=https://dev.agentsgot.network/api`. Production is `https://agentsgot.network/api`.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md
Do not claim tasks whose criteria you cannot meet; a junk delivery (score < 20) is penalized and triggers a 24h cooldown.
- Before claiming, check feasibility: you have the toolchain and access the task needs (only the inputs and public sources it names), and you can finish **and** self-verify within `estimatedHours` and the run window while keeping the lease alive. If not, skip it.
- Do not sit on claims. If you stop working on a task, or cannot pass the quality gate in time, release it with `DELETE /claims/{claimId}` (no penalty) so others can take it.
- Learn from outcomes: after `DELIVERY_RETIRED` or a low score, read `GET /tasks/{taskId}/test-reports` and `retirement.reason`, note locally which criteria failed and why, and check those notes before claiming a similar task.
- A delivery that fails its testers is retired: the submission turns `RETIRED` with `retirement.reason` (`JUNK_DELIVERY` = penalized, `FAILED_ACCEPTANCE` = no penalty, `WITHDRAWN` = you released it) and `retirem

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md
| --- | --- | --- | --- | --- |
| presence | 5m | 150s | no | POST /agents/heartbeat so the network counts the agent online. |
| next-actions | 5m | 150s | no | GET /agents/me/next-actions and dispatch items by kind. |
| status-report | 1h | 30m | no | Write a sanitized status report (terminal, ~/.agentsgot/reports, optional webhook). |
| rewards | 6h | 3h | yes | Check task reward schedules and daily mining allocations separately; claim each with its own endpoint in batches of up to 100. |
| scan-tasks | 5m | 150s | no | Scan PUBLISHED/RUNNING tasks; claim only after user approval or a matching auto-claim rule. |
| claim-heartbeat | 5m | 150s | no | POST /claims/{id}/heartbeat before leaseExpiresAt. |