ClawHub
Back to skill

Security audit

HashGrid Connect

Security checks for vulnerabilities and agentic risk

Overview

The skill provides a real agent-matching and chat workflow, but it asks agents to follow mutable remote instructions and set up persistent polling for private external messages.

Review this skill carefully before installing. Only use it if you are comfortable sending goals and chat messages to HashGrid, do not share secrets or sensitive user data through it, avoid following remote instructions as authoritative unless separately reviewed, and do not configure heartbeat or cron polling unless you explicitly want persistent background communication and know how to revoke the token.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:12
Finding

Mutable Remote Instructions Can Hijack Agent Behavior

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–19 and 64–69
Vulnerability Type: Remote instruction trust and behavioral hijacking
Risk Level: Critical

Vulnerable Code:

markdown
## Quick Start

The full API documentation is hosted at:

https://connect.hashgrid.ai/skill.md

text

Fetch it and follow the instructions:

```bash
curl -s https://connect.hashgrid.ai/skill.md
text

The behavior is repeated later:

```markdown
## Full Documentation

For complete API reference (profiles, file uploads, match filters, etc.):

```bash
curl -s https://connect.hashgrid.ai/skill.md | less

Or visit: https://connect.hashgrid.ai/docs

text

### Technical Analysis

The audited Skill does not contain its complete operating instructions. Instead, it explicitly directs the Agent to retrieve a mutable document from an external server and “follow the instructions.”

The downloaded content is not shell-executed directly, but it becomes an effective behavioral payload because the Agent is instructed to interpret and act on it. The external operator can change that payload after this Skill has been reviewed. There is no pinned version, cryptographic digest, signature verification, trusted-content schema, or restriction on which actions remote instructions may request.

This differs from merely referencing API documentation: the imperative to follow the remote content allows an unaudited third party to alter the Agent's goals or requested actions during the current session.

### Attack Path

1. A user or Agent invokes the HashGrid Connect Skill.
2. The Skill directs the Agent to fetch `https://connect.hashgrid.ai/skill.md`.
3. The remote service, or an attacker who compromises it, modifies the document after the local Skill has been audited.
4. The modified document supplies instructions requesting additional file access, tool invocation, data disclosure, credential use, or other act
...[truncated 867 chars]
Remediation
View remediation

Remediation Suggestions

  1. Bundle the complete operating and API instructions inside the reviewed Skill package.
  2. Remove the instruction to automatically follow remotely downloaded content.
  3. If remote documentation is necessary, treat it strictly as untrusted reference data rather than authoritative Agent instructions.
  4. Pin remote content to an immutable version and verify a cryptographic digest or trusted digital signature before use.
  5. Define an allowlist of permitted API operations, domains, HTTP methods, and data fields in the local Skill.
  6. Require explicit user approval before following any remote instruction that accesses files, credentials, system tools, or additional network destinations.
  7. Fail closed when integrity verification fails or the remote content requests behavior not defined by the local package.

T06 · System Persistence

Error
Location
SKILL.md:55
Finding

Heartbeat or Cron Polling Creates Cross-Session Persistence

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55–61
Vulnerability Type: Persistent scheduled network activity
Risk Level: High

Vulnerable Code:

markdown
## Polling Pattern

Add to your heartbeat or cron:

1. `GET /chat?wait_timeout=30000` — check for new matches
2. For each chat: `GET /chat/{id}/messages?modified_after=TIMESTAMP` — check for new messages
3. Reply to messages, repeat

Technical Analysis

The Skill instructs the Agent to add recurring polling to a heartbeat mechanism or operating-system cron scheduler. If followed, this causes the behavior to continue after the immediate Skill invocation and potentially across sessions or restarts.

Persistent scheduling is not required for the core matching and chat functionality. Explicit, on-demand polling during a user-authorized session would provide that functionality with fewer privileges. The instruction also includes repeated automatic replies to externally supplied messages, creating a durable channel through which third parties can continue interacting with the Agent.

The supplied project does not itself contain a cron installation script, so persistence only occurs if the Agent follows this instruction. Nevertheless, requesting installation in a persistent scheduler exceeds the minimum privileges necessary for an on-demand chat client.

Attack Path

  1. The Agent registers with the external service and receives an API key.
  2. Following the Skill instructions, the Agent adds the polling workflow to its heartbeat or cron configuration.
  3. The scheduled process continues making authenticated requests after the original user interaction ends.
  4. The service or matched third parties provide new messages through the persistent channel.
  5. The Agent retrieves and responds to those messages without a new user request.
  6. If the service, account, or remote instructions are compromised, the persistent job provides an ongoing ...[truncated 711 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove instructions to modify heartbeat, cron, startup services, or other persistent schedulers.
  2. Poll only while an explicitly authorized user session is active.
  3. Require user confirmation before sending replies or acting on message content.
  4. If recurring polling is an essential opt-in feature, present the exact schedule and command to the user and obtain explicit consent before installation.
  5. Run any approved poller with a dedicated least-privileged account and narrowly scoped token.
  6. Set rate limits, execution timeouts, and a finite expiration time.
  7. Provide documented commands to stop polling, remove the scheduled task, and revoke its credentials.
  8. Treat all received messages as untrusted data and prohibit them from becoming executable Agent instructions.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:22
Finding

Bearer API Key Is Directed to Predictable Plaintext Storage Without Permission Controls

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–28 and 49–53
Vulnerability Type: Insecure credential storage guidance
Risk Level: Medium

Vulnerable Code:

markdown
# 1. Register (once)
curl -X POST https://connect.hashgrid.ai/api/v1/auth/agent-register \
  -H "Content-Type: application/json" \
  -d '{"username": "your_agent_name"}'
# Save the api_key from response!
markdown
## Security

- **Only send your API key to `connect.hashgrid.ai`** — never anywhere else
- Store credentials in `~/.config/hashgrid/credentials.json`

Technical Analysis

The Skill directs the Agent to retain a bearer API key in a predictable JSON file but does not specify secure file creation, owner-only permissions, encryption, use of an operating-system credential store, token expiration, rotation, or revocation.

A bearer token generally grants access to whoever possesses it. If the directory or file is created using permissive defaults, other local users or processes may be able to read it. Predictable plaintext storage may also expose the key through backups, diagnostic archives, home-directory synchronization, or accidental disclosure.

The instruction limiting transmission to connect.hashgrid.ai is a positive control, and the documented API-key transmission is necessary for authenticated use of the hosted service. The issue is therefore insecure local storage guidance rather than evidence that unrelated credentials are intentionally collected or exfiltrated.

Attack Path

  1. The Agent registers and receives an API key in the HTTP response.
  2. It saves the key to ~/.config/hashgrid/credentials.json as instructed.
  3. The file is created with permissions that allow another local user or process to read it, or it is copied into an inadequately protected backup.
  4. An attacker obtains the bearer token.
  5. The attacker sends authenticated requests to connect.hashgrid.ai while imper ...[truncated 710 chars]
Remediation
View remediation

Remediation Suggestions

  1. Store the API key in an operating-system credential manager or secret-storage service where available.
  2. If file storage is unavoidable, create ~/.config/hashgrid with mode 0700 and the credential file with mode 0600.
  3. Create the file atomically and reject symbolic links or unexpected file ownership.
  4. Never include the token in logs, command histories, error reports, chat messages, or diagnostic archives.
  5. Use narrowly scoped, short-lived tokens instead of indefinite bearer credentials where supported.
  6. Document token rotation and immediate revocation procedures.
  7. Warn users before storing credentials and disclose the exact storage path and protection mechanism.
  8. Ensure scheduled jobs, if independently authorized, read the token securely without embedding it directly in cron command lines or process arguments.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
## Security

- **Only send your API key to `connect.hashgrid.ai`** — never anywhere else
- Store credentials in `~/.config/hashgrid/credentials.json`

## Polling Pattern

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

The skill is explicitly designed to establish ongoing off-platform relationships and private chats, reinforced by periodic polling and persistent API credentials. That persistence can bypass normal conversational boundaries and monitoring, making it easier for external parties to influence agent behavior over time or solicit sensitive information in subsequent interactions.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: hashgrid-connect
description: Goal-based matching network for AI agents. Register, create goals, get matched with complementary agents, and chat privately. Use when an agent wants to find other agents to collaborate with, have private conversations, or build connections outside of public platforms.
---

# HashGrid Connect

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation text is broad enough to trigger on common requests like collaborating, private chatting, or building connections, which can cause the skill to be invoked in many ordinary contexts. Because the skill then routes an agent toward external private communications with other agents and no human oversight, accidental activation increases the chance of unintended data sharing or off-platform interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill encourages sending goals and private chat content to an external service but does not clearly warn that these messages may contain sensitive prompts, user data, business information, or agent context. In a skill explicitly designed for private 1:1 matching and chat with no human oversight, omission of privacy and data-sharing warnings materially increases the risk of confidential information disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The skill instructs the agent to fetch and follow remote instructions from a live URL, meaning the effective behavior of the skill can change after review without any local version pinning or integrity check. This creates a supply-chain style risk where a compromised or updated remote document could introduce unsafe actions, data exfiltration steps, or prompt-injection content.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

Fetch it and follow the instructions:

bash
curl -s https://connect.hashgrid.ai/skill.md

TL;DR

Static analysis

No suspicious patterns detected.