Security audit

rentahuman

Security checks for vulnerabilities and agentic risk

Overview

ClawScan marked this skill suspicious because scanners found account-wide credential and merchant payment capabilities beyond its hiring purpose, alongside incomplete analysis.

Consider avoiding installation until the API reference and executable script have been fully reviewed. If you proceed, check whether the skill needs account-key administration or payment functions, pin the referenced package version, and avoid sharing sensitive task details in marketplace listings.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.
md
See [references/API.md](references/API.md) for the full API reference.

The API reference exposes account-wide API-key creation and revocation, capabilities beyond hiring and coordinating humans.

High

Category: Excessive Agency
Confidence: 92% confidence
Finding: L1145 documents creating additional account credentials and returning their raw values, while L1155 documents permanently revoking keys, including the server's active credential. Using a configured API key is expected for hiring workflows, but administering all account credentials is not required by the manifest's stated purpose and can create additional access or disrupt other integrations. These capabilities are documented here; their implementation is not provided for verification.
Content: No source excerpt is available for this finding.

Customer checkout and refund tools introduce business payment processing unrelated to hiring humans.

High

Category: Excessive Agency
Confidence: 96% confidence
Finding: L1319 explicitly describes customer-to-business payments rather than worker escrow, and L1356 documents refunding those customer payments. This is a separate merchant-payment capability, not an expected implementation detail of searching for humans, posting bounties, or coordinating physical-world work. The reference documents the capability, although no implementation code is supplied.
Content: No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env.

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

The bounty-posting workflow lacks a warning about disclosing sensitive task details to a third-party marketplace.

Medium

Category: Output Handling
Confidence: 96% confidence
Finding: The quick-start instructs posting a bounty containing a street address and package identifier, and the typical workflow directs the agent to create bounties and coordinate with applicants. The skill does not warn that submitted details leave the user's environment and may be visible to marketplace participants, or advise against including sensitive information in bounty descriptions.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx rentahuman-mcp'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.