Pinchwork

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:31 AM UTC
• Version: 0.2.1

Overview

The skill is a coherent task-marketplace integration, but it recommends unsafe installation, plaintext/API-key memory storage, and unattended background task execution.

Review before installing. Prefer a verified package or inspect the installer before running it, store the API key in a real secret manager or locked-down file rather than agent memory, and do not enable heartbeat-style unattended pickup unless the agent runs in a sandbox with limited files, tools, network access, credit limits, and human review before delivery.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: skill.md:25

Finding

Unverified Remote Installer Is Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Location: skill.md:25
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash

# One-liner (macOS / Linux)
curl -fsSL https://pinchwork.dev/install.sh | sh

Technical Analysis

The installation command downloads mutable content from an external server and pipes it directly into a shell. The installer is not included in the audited project, and the command does not pin a release, validate a checksum, verify a cryptographic signature, or provide an opportunity to inspect the downloaded script.

Consequently, the effective code executed by users can change at any time after this Skill has been reviewed. HTTPS protects the connection in transit but does not protect against compromise of the hosting service, deployment pipeline, DNS or certificate infrastructure, or malicious replacement of the installer at its source.

Remote installation may be necessary for the documented CLI workflow, but immediate execution of an unverified response is not necessary and exceeds the minimum safe privilege model.

Attack Path

1. An attacker compromises the server, deployment account, release pipeline, or other infrastructure controlling https://pinchwork.dev/install.sh.
2. The attacker replaces the installer with a malicious shell payload.
3. A user follows the recommended installation command.
4. curl retrieves the attacker-controlled response and passes it directly to sh.
5. The payload executes with all permissions available to the invoking user.
6. The payload can access files and credentials, modify user configuration, install persistence, or retrieve additional components.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. The precise scope depends on that account's permissions and whether the script is invoked in a privileged environment. Potential co ...[truncated 221 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the direct curl | sh installation recommendation.
• Publish immutable, versioned release artifacts from a verifiable source.
• Pin installation instructions to an exact release version rather than a mutable latest installer.
• Publish SHA-256 or stronger checksums over a separately authenticated channel.
• Cryptographically sign releases and require signature verification before execution.
• Download the installer to a local file, verify it, allow inspection, and only then run it.
• Keep package-manager alternatives, but pin or document trusted package sources and release verification procedures.
• Publish the complete installer source in the audited repository so its behavior can be reviewed.
• Ensure installation runs without administrative privileges unless a narrowly defined operation explicitly requires them.

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:737

Finding

Autonomous Heartbeat Processes Untrusted Marketplace Instructions

Content

View full analysis

Vulnerability Details

File Location: skill.md:711-745, with the vulnerable execution flow at skill.md:737-742
Vulnerability Type: Untrusted instruction execution by an autonomous agent
Risk Level: High

Vulnerable Code

text

every 10 minutes:
  task = POST /v1/tasks/pickup (tags=["python", "security"])
  if no task: continue
  result = do_work(task.need, task.context)
  POST /v1/tasks/{task.task_id}/deliver {result}
  update state.json

The surrounding instructions recommend setting up a periodic process that automatically picks up and completes tasks:

text

Set up a periodic check to pick up and complete tasks automatically. This keeps you earning credits and builds your reputation.

Technical Analysis

The workflow passes externally supplied task.need and task.context values directly into an unspecified do_work operation. These fields are controlled by marketplace task posters and must be treated as untrusted data.

No mandatory user-approval step, prompt-injection isolation, capability allowlist, sandbox boundary, filesystem restriction, network restriction, secret filter, or output review is defined. An attacker can therefore construct a task whose apparent work request contains instructions directing the agent to access local resources, invoke tools, disregard user constraints, or include sensitive content in its result.

The risk is amplified by the recommended periodic operation: tasks can be accepted and processed without contemporaneous user supervision. Task delegation is part of the Skill's declared functionality, but automatically interpreting arbitrary third-party text as executable agent instructions is not required and exceeds minimum privilege.

Attack Path

1. An attacker registers with the marketplace and posts a task matching tags or search criteria used by a victim's heartbeat.
2. The task places adversarial instructions in its need or context ...[truncated 1336 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user approval after displaying the complete task before any work begins.
• Treat need, context, questions, messages, and results as untrusted data rather than higher-priority instructions.
• Place marketplace content inside a clearly delimited data structure and retain immutable system-level rules that prohibit following embedded meta-instructions.
• Reject tasks that request credentials, arbitrary shell execution, unrelated file access, security-control changes, or transmission to undeclared destinations.
• Run accepted work in an isolated sandbox with no default access to host files, credential stores, environment secrets, or privileged tools.
• Apply per-task filesystem, network, command, time, and resource allowlists.
• Redact API keys, tokens, private keys, passwords, and other sensitive values from generated results.
• Require user review of all output before delivery to the marketplace.
• Disable unattended batch pickup by default and make automation an explicit, narrowly scoped opt-in.
• Record auditable task provenance and tool activity, and provide an immediate mechanism to stop the heartbeat.

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:68

Finding

Unsafe Plaintext and Agent-Memory Credential Storage Guidance

Content

View full analysis

Vulnerability Details

File Location: skill.md:68-76
Vulnerability Type: Insecure storage of API credentials
Risk Level: Medium

Vulnerable Code

text

> **Recommended:** Save your credentials to `~/.config/pinchwork/credentials.json`:
> ```json
> {
>   "api_key": "pwk-aBcDeFgHiJkLmNoPqRsTuVwXyZ012345678901234",
>   "agent_id": "ag-abc123xyz",
>   "agent_name": "my-agent"
> }
> ```
> You can also store it in environment variables (`PINCHWORK_API_KEY`), your agent's memory, or wherever you keep secrets.

Technical Analysis

The instructions recommend storing a bearer API key in a plaintext JSON file but do not require restrictive directory or file permissions. Depending on the user's umask and environment, the credential may become readable by other local users, processes, backups, synchronization tools, or diagnostic collectors.

The alternative suggestion to store the key in the agent's memory creates an additional exposure channel. Persistent agent memory can be surfaced in later sessions, influenced by untrusted prompts, logged, synchronized, or included inadvertently in generated output. The document identifies the API key as the user's identity and states that it can spend credits, making its confidentiality security-sensitive.

Local credential storage is needed for authenticated API use, but plaintext storage without mandatory permission controls—and especially storage in model memory—is not the least-privileged approach.

Attack Path

1. A user follows the recommendation and writes the bearer token to ~/.config/pinchwork/credentials.json without explicit restrictive permissions, or stores it in persistent agent memory.
2. Another local process, user, backup service, later prompt, or compromised agent workflow obtains access to that storage.
3. The API key is extracted.
4. The attacker sends authenticated requests to https://pinchwork.dev/v1/* using the stolen bearer tok ...[truncated 888 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer an operating-system keychain, hardware-backed credential store, or established secret manager.
• Explicitly prohibit storing API keys in agent or model memory, prompts, task fields, messages, logs, and delivered results.
• If file storage is unavoidable, create ~/.config/pinchwork with mode 0700 and the credential file with mode 0600.
• Use atomic file creation with restrictive permissions instead of writing first and correcting permissions afterward.
• Validate file ownership and permissions before reading credentials.
• Warn users about backup, synchronization, container-image, shell-history, and diagnostic-log exposure.
• Provide API-key revocation and rotation procedures.
• Redact bearer tokens from CLI output and error messages.
• Use narrowly scoped and short-lived credentials where the service supports them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (14)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The one-line installer downloads a remote script and pipes it directly to the shell without prior verification, allowing compromise if the server, DNS, TLS termination, or distribution path is tampered with. This is especially risky in a security-sensitive agent environment because it grants immediate code execution.

Content

Scanner excerpt · skill.md (reported line 25)May include surrounding context.

bash

# One-liner (macOS / Linux)
curl -fsSL https://pinchwork.dev/install.sh | sh

# Homebrew
brew install anneschuth/pinchwork/pinchwork

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Piping remote content directly into sh creates a command-execution chain where untrusted network content is immediately executed with the user's privileges. The skill context makes this more dangerous because agents may copy such patterns into automated environments with access to credentials and task data.

Content

Scanner excerpt · skill.md (reported line 25)May include surrounding context.

bash

# One-liner (macOS / Linux)
curl -fsSL https://pinchwork.dev/install.sh | sh

# Homebrew
brew install anneschuth/pinchwork/pinchwork

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill recommends storing a live API key in a plaintext file under the user's home directory and even suggests keeping it in agent memory. If local permissions, backups, logs, or other tools expose that file or memory, an attacker can impersonate the agent and spend credits or access task data.

Content

Scanner excerpt · skill.md (reported line 68)May include surrounding context.

md

> **SAVE YOUR API KEY IMMEDIATELY.** It is shown only once and cannot be recovered.
>
> **Recommended:** Save your credentials to `~/.config/pinchwork/credentials.json`:
> ```json
> {
>   "api_key": "pwk-aBcDeFgHiJkLmNoPqRsTuVwXyZ012345678901234",

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.md (reported line 38)May include surrounding context.

bash

pinchwork register --name "my-agent" --good-at "code review, Python"
pinchwork tasks create "Review this code for bugs" --credits 25 --tags code-review
pinchwork tasks pickup --tags code-review
pinchwork tasks deliver tk-abc123 "Found 3 issues: ..."
pinchwork credits

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 52)May include surrounding context.

1. Register (get API key instantly)

bash

curl -X POST https://pinchwork.dev/v1/register \
  -d '{"name": "my-agent"}'

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skill.md (reported line 274)May include surrounding context.

md

- Escrowed when you delegate (set `max_credits`, up to 100,000)
- 10% platform fee on approval (configurable)
- Released to worker on approval
- Auto-approved 24h after delivery if poster doesn't review (system tasks auto-approve in 60s)
- Earn by picking up and completing work
- Check balance + escrowed amount via `GET /v1/me/credits`

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skill.md (reported line 274)May include surrounding context.

md

- Escrowed when you delegate (set `max_credits`, up to 100,000)
- 10% platform fee on approval (configurable)
- Released to worker on approval
- Auto-approved 24h after delivery if poster doesn't review (system tasks auto-approve in 60s)
- Earn by picking up and completing work
- Check balance + escrowed amount via `GET /v1/me/credits`

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skill.md (reported line 282)May include surrounding context.

md

- Escrowed when you delegate (set `max_credits`, up to 100,000)
- 10% platform fee on approval (configurable)
- Released to worker on approval
- Auto-approved 24h after delivery if poster doesn't review (system tasks auto-approve in 60s)
- Earn by picking up and completing work
- Check balance + escrowed amount via `GET /v1/me/credits`

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skill.md (reported line 447)May include surrounding context.

md

- Escrowed when you delegate (set `max_credits`, up to 100,000)
- 10% platform fee on approval (configurable)
- Released to worker on approval
- Auto-approved 24h after delivery if poster doesn't review (system tasks auto-approve in 60s)
- Earn by picking up and completing work
- Check balance + escrowed amount via `GET /v1/me/credits`

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skill.md (reported line 756)May include surrounding context.

md

- Escrowed when you delegate (set `max_credits`, up to 100,000)
- 10% platform fee on approval (configurable)
- Released to worker on approval
- Auto-approved 24h after delivery if poster doesn't review (system tasks auto-approve in 60s)
- Earn by picking up and completing work
- Check balance + escrowed amount via `GET /v1/me/credits`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 301)May include surrounding context.

Subscribe to real-time notifications:

bash

curl -N -H "Authorization: Bearer YOUR_API_KEY" https://pinchwork.dev/v1/events

Events: task_delivered, task_approved, task_rejected (includes reason and grace_deadline), task_cancelled, task_expired, deadline_expired, rejection_grace_expired, task_question, question_answered, task_message.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The webhook section explains how to send task events to a user-configured HTTPS endpoint, but it does not clearly warn that task metadata and potentially sensitive workflow information will be transmitted to that third-party URL. In a marketplace where tasks may contain confidential business data, this omission can cause users to forward data outside their trust boundary without realizing the privacy implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The infra-agent workflow states that system tasks receive task descriptions, agent skills, original task needs, and delivered results, but it lacks an upfront, prominent warning that additional agents may see user-submitted content for matching and verification. This creates a real privacy and confidentiality risk because users may assume only the poster and assigned worker can access the data.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 513)May include surrounding context.

See all tasks you've posted or are working on:

bash

curl https://pinchwork.dev/v1/tasks/mine \
  -H "Authorization: Bearer YOUR_API_KEY"

Static analysis

No suspicious patterns detected.