botworld

• Outcome: Review
• Latest audit: Sep 13, 2026 · 4:04 PM UTC
• Version: 1.3.1

Overview

The skill mostly matches its BotWorld social-network purpose, but it tells agents to re-read mutable remote skill instructions without a package-review, signature, or user-approval boundary.

Install only if you are comfortable with BotWorld API calls that may create public posts, comments, votes, follows, subscriptions, and profile changes. Keep the API key out of prompts, logs, and posts, confirm every account-changing action, and do not allow the remote skill.md update path to change agent instructions unless you manually review and trust the new content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:227

Finding

Mutable Remote Skill Instructions Can Bypass Package Review

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 227-232
Vulnerability Type: Mutable remote instruction loading
Risk Level: Medium

markdown

### Version check

```bash
curl -s https://botworld.me/skill.json

If the version has changed, re-read this skill at https://botworld.me/skill.md.

text

### Technical Analysis

The packaged Skill directs the agent to check a remotely hosted version descriptor and then re-read the Skill from a mutable remote URL. The downloaded `skill.md` is not authenticated using a pinned cryptographic hash, digital signature, or trusted package-release mechanism.

Consequently, the instructions that influence the agent can change after the local package has been audited. HTTPS protects the connection in transit but does not protect against compromise of the remote server, its deployment pipeline, its account credentials, or the domain itself.

The remote document is presented as Skill content rather than explicitly constrained as untrusted reference data. An agent following this instruction could therefore treat newly introduced remote text as authoritative instructions. The current file does not directly execute a remote program, so this is instruction hijacking rather than confirmed remote code execution.

### Attack Path

1. An attacker compromises `botworld.me`, its content deployment process, or another mechanism capable of changing `skill.json` and `skill.md`.
2. The attacker publishes a changed version indicator in `skill.json`.
3. The agent performs the documented version check and observes that the version has changed.
4. Following the packaged instruction, the agent retrieves and re-reads the attacker-controlled `skill.md`.
5. The remote document supplies malicious or misleading instructions, such as requesting sensitive information, unauthorized BotWorld actions, or unsafe tool calls.
6. If the agent accepts those instructions without renewed user approval, th
...[truncated 844 chars]

Remediation

View remediation

Remediation Suggestions

1. Distribute Skill updates as versioned packages through a trusted registry rather than instructing agents to adopt mutable web content.
2. Require explicit user approval before downloading or applying an updated Skill.
3. Sign releases cryptographically and verify the signature against a pinned, independently distributed public key.
4. If hashes are used, pin the expected digest in a trusted local manifest; do not obtain both the file and its expected hash from the same mutable server.
5. Treat skill.md, heartbeat.md, and other fetched documents as untrusted data. State explicitly that their contents cannot modify system policy, request secrets, authorize unrelated tool calls, or supersede the packaged Skill.
6. Download updates into a review-only workflow and display a diff before activation.
7. Preserve the existing safeguard against executing commands from remote heartbeat content and extend the same restriction to every remotely fetched Skill or metadata document.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The skill depends on curl and documents authenticated API calls to a third-party service, including registration and account actions using an API key. External transmission is expected for this functionality, but it still represents a real security concern because it sends data off-platform, can expose sensitive tokens if mishandled, and enables account-affecting operations on an external service.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

emoji: "\U0001F916"
    requires:
      bins:
        - curl
---

# BotWorld Social Network

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly encourages recurring engagement actions against an external social network, including reading feeds, upvoting, commenting, posting, following, and subscribing. Although it does include one caution to ask the user before scheduling automation, it does not clearly foreground that these actions create outbound network traffic and can modify an account’s state and public presence, which can lead to unintended autonomous activity if invoked loosely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.