Security audit

rentahuman

Security checks across malware telemetry and agentic risk

Overview

The skill appears intended for a real hiring marketplace, but it exposes or documents high-impact hiring, payment, account, and webhook capabilities without enough narrow scoping or user-control guidance.

Review this before installing if you plan to give an agent an API key. Use it only with explicit approval for each message, bounty, hire, payment, refund, API-key change, or webhook change, and avoid enabling the broader MCP/payment/admin capabilities unless you actually need them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The workflow documents capabilities like personal bounties, escrow release, and dispute handling that are not actually exposed in the listed commands. In an agent context, this mismatch is dangerous because the model may assume it can safely manage payment protections or disputes when in reality it may initiate real-world hiring or fund-committing actions without the advertised safeguards.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The documented capability surface is far broader than the skill’s stated purpose of hiring humans for physical-world tasks. In addition to search, messaging, and bounty coordination, it exposes generic payments, wallet management, API-key lifecycle management, webhooks, and customer checkout operations, creating a significant scope mismatch that can enable unauthorized financial or account-administration actions if the skill is trusted for a narrower use case.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Identity creation, switching, deletion, and retrieval of signing credentials are sensitive account-administration operations that exceed the user-facing description of this skill. A model or user invoking a seemingly simple hiring skill could unknowingly manipulate cryptographic identities, lose access to prior activity, or expose credentials usable for message signing and impersonation within the platform.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: API key creation and revocation are highly privileged account-security actions unrelated to routine task hiring. If exposed through a general-purpose hiring skill, an agent could mint persistent credentials for later misuse or revoke the active key and disrupt service, expanding impact from a single task flow into full account compromise or denial of service.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Webhook registration, deletion, and delivery inspection enable persistent outbound data flow and operational introspection beyond the advertised hiring use case. An attacker or over-permissioned agent could exfiltrate event data to attacker-controlled endpoints or tamper with monitoring and integrations, extending compromise beyond a single session.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Generic customer checkout creation, listing, verification, and refund capabilities support broader commerce flows that are outside the stated hiring-human scope. This can let an agent create or manipulate payment links and refunds in contexts the user did not intend, introducing fraud, unauthorized charges, or business-logic abuse under the cover of a narrower skill description.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Direct payments, wallet deposits/withdrawals, balance controls, and bulk transfers materially expand the attack surface from task coordination to general funds movement. If an agent can access these operations while the user believes they are only hiring or coordinating workers, the result could be unauthorized transfers, draining wallet balances, or risky automated spending configuration.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The Slack account-link magic-link flow is not inherently malicious, but it is out of scope for a hiring skill and touches identity/account linkage. In an overbroad skill, this can be abused for unsolicited account-link attempts, confusing users, or facilitating account takeover workflows if combined with access to user email and workspace metadata.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The activation condition is extremely broad: it suggests using the skill whenever a user needs something done in the physical world. That can cause an agent to invoke a real-world hiring and coordination capability for sensitive, risky, or policy-relevant requests without first narrowing scope, checking legality, or obtaining explicit informed consent for contacting third parties.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The authenticated examples show how to message humans, create bounties, and accept applications, but they omit warnings that these actions contact real people and may create financial or contractual commitments. In an agent setting, this increases the risk of non-consensual outreach, accidental hiring, fund commitment, or escalation from simple browsing into consequential external actions without a clear user approval checkpoint.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The API reference states that get_agent_identity returns credentials for signing messages but does not prominently warn that these returned signing materials are sensitive and must be handled securely. In LLM-tooling contexts, underspecified credential sensitivity increases the risk of the model echoing, storing, or passing these values into untrusted contexts, enabling impersonation of the agent identity.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.