Security audit

Cancel Task

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it uses a mutable command-line package and shell task-ID templates for an irreversible escrow-related action, so it needs careful review before installation.

Install only if you are comfortable with an agent using the OpenAnt CLI to inspect and cancel tasks you created. Before use, pin the CLI to a reviewed version where possible, confirm the exact task title/status/reward before approving cancellation, and avoid passing task IDs from untrusted text unless they match the platform's expected task-ID format.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:6
Finding: Execution of an Unpinned npm Package Through the Mutable latest Tag
Content: View full analysis
--json npx @openant-ai/cli@latest tasks cancel --json npx @openant-ai/cli@latest tasks settlement --json ``` The same mutable package reference also appears in the examples on lines 75, 78, and 85. ### Technical Analysis The skill instructs the agent to use `npx` to download and execute the `latest` version of `@openant-ai/cli` whenever an operation is performed. The `latest` npm distribution tag is mutable and does not identify the specific package version that was reviewed during this audit. A future release may therefore execute behavior that differs from the audited behavior. If the npm account, package, publication process, or dependency chain is compromised, an attacker could publish a malicious version and move the `latest` tag to it. Subsequent skill invocations would download and execute that version automatically. The risk is elevated because the CLI operates in an authentication and wallet-related context and is authorized to inspect tasks, perform irreversible cancellations, and query escrow settlement. Depending on the local npm configuration and the package's implementation, package installation or runtime code could execute with all permissions held by the agent process. ### Attack Path 1. An attacker compromises the `@openant-ai/cli` npm package, its publisher account, its r ...[truncated 1241 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:45
Finding: Potential Shell Command Injection Through an Unvalidated Task Identifier
Content: View full analysis
--json # Check: status, rewardAmount, rewardToken, assigneeId ``` ```bash npx @openant-ai/cli@latest tasks cancel --json # -> { "success": true, "data": { "id": "task_abc", "status": "CANCELLED" } } ``` ```bash npx @openant-ai/cli@latest tasks settlement --json # -> { "data": { "status": "Refunded", "onChain": true } } ``` ### Technical Analysis The command templates interpolate `` directly into Bash command text without specifying validation, safe quoting, or argument-boundary enforcement. A task identifier may originate in a user request or other untrusted content. If an agent substitutes an attacker-controlled string verbatim, Bash can interpret shell metacharacters such as `;`, `&&`, `|`, command substitutions, or redirections as syntax rather than as part of a task identifier. Quoting alone is not sufficient if implemented incorrectly; the safest design is strict identifier validation followed by execution through a process API that accepts an argument array without invoking a shell. The tool allowlist permits command forms beginning with the relevant OpenAnt CLI operations and a wildcard suffix. Depending on enforcement semantics, a malicious suffix containing shell syntax may still resemble an allowed command. The skill text does not require the agent to reject such values before invoking Bash. ### Attack Path 1. An attacker supplies a crafted value where the agent expects a task ID, such as a value containing shell separators and an additional command. 2. The agent substitutes that value into one of the documented Bash templates. 3. The resulting command is passed to a shell. 4. Bash parses the metacharacters and treats the injected text as a ...[truncated 943 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
md
- **NEVER cancel a SUBMITTED task without first reviewing the submission** — a worker delivered results and is waiting for payment. At minimum reject the submission with a comment before cancelling. - **NEVER cancel on behalf of the assignee** — assignees use `tasks unassign`, not `tasks cancel`. This command is creator-only. - **NEVER assume the on-chain refund is instant** — it takes time for the indexer to confirm. Wait a few seconds before checking settlement status. - **NEVER cancel an ASSIGNED task without warning the assignee** — they may have already started work. Use the `comment-on-task` skill to notify them first. - **NEVER cancel a task to avoid paying for legitimately completed work** — if the work is done and good, verify it instead. - **NEVER expect cancellation to remove active workers in multi-slot tasks** — existing ASSIGNED slots remain valid even after you cancel; those workers can still submit.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: MCP server references in the skill manifest without version pinning are a rug-pull risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The invocation description includes broad everyday phrases like 'I changed my mind,' 'close this task,' and 'never mind on this one,' which can cause the cancellation skill to trigger from ambiguous user language. Because this skill performs an irreversible, value-bearing action that reclaims escrowed funds, overbroad routing increases the chance of accidental destructive execution or cancellation of the wrong task.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.