Create Task

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:36 AM UTC
• Version: 0.1.3

Overview

This skill is purpose-aligned for creating crypto-funded OpenAnt tasks, but it relies on mutable command execution and broad wallet/task authority in a financial workflow.

Review this skill carefully before installing. It can create and fund blockchain escrow tasks, so use it only if you trust the OpenAnt CLI source and are comfortable with wallet-backed actions. Prefer a version-pinned CLI, confirm chain/token/reward/deadline before funding, and avoid broad or ambiguous hiring requests that could route into this skill unintentionally.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Mutable npm Dependency Executed in Cryptocurrency Wallet Workflow

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 6
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

The allowed tool configuration authorizes multiple commands that execute the mutable latest release of the OpenAnt npm CLI:

yaml

allowed-tools: ["Bash(npx @openant-ai/cli@latest status*)", "Bash(npx @openant-ai/cli@latest tasks create *)", "Bash(npx @openant-ai/cli@latest tasks fund *)", "Bash(npx @openant-ai/cli@latest tasks list *)", "Bash(npx @openant-ai/cli@latest whoami*)", "Bash(npx @openant-ai/cli@latest wallet *)"]

Technical Analysis

The Skill uses npx to resolve, download, and execute @openant-ai/cli@latest. The latest npm distribution tag is mutable, so the code executed at runtime can differ from the version reviewed during this audit. No exact version, lockfile, package integrity hash, or locally verified binary is specified.

This creates a supply-chain trust boundary in which compromise of the npm package, publisher account, release pipeline, or distribution tag could introduce arbitrary code without requiring any modification to SKILL.md. The risk is amplified because even nominally read-only operations such as status and wallet balance execute the package before funded operations are presented for confirmation.

The Skill includes appropriate semantic safeguards for financial operations, including requiring confirmation before funding and checking wallet balance first. However, these instructions cannot constrain malicious code inside a compromised npm package once npx executes it.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or another mechanism controlling @openant-ai/cli.
2. The attacker publishes a malicious release and assigns it to the mutable latest distribution tag.
3. A user invokes the Skill for a legitimate task-creation request.
4. The agent runs an allowed command su ...[truncated 1257 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace every @latest reference with an exact, reviewed package version, for example @openant-ai/cli@X.Y.Z.
2. Install the CLI through a controlled deployment process using a committed lockfile rather than downloading it dynamically during each Skill invocation.
3. Enforce npm integrity verification and retain reviewed package hashes or signed release provenance.
4. Disable install scripts where compatible, and audit the package and its transitive dependencies before upgrades.
5. Update the allowed-tool patterns so they authorize only the pinned executable and the minimum required subcommands.
6. Run the CLI in a sandbox with restricted filesystem, environment-variable, credential, and network access.
7. Separate read-only status operations from transaction-signing capabilities and require an external wallet confirmation that displays the destination, chain, token, amount, and task identifier.
8. Introduce a deliberate dependency-update process in which new versions are reviewed and tested before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

MCP server references in the skill manifest without version pinning are a rug-pull risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description and trigger phrases are broad enough to match common requests like 'hire someone for' or 'I need someone to', which can cause the agent to invoke this skill in contexts the user did not intend. Because this skill can lead to wallet checks and potentially to funded on-chain task creation after follow-up prompts, overbroad routing increases the chance of unintended financial or privacy-impacting actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

- **Illegal / harmful:** Law violations (hacking, fraud, money laundering, phishing), CSAM, weapons, unauthorized access, violence/terrorism
- **Deceptive:** Fake reviews/votes/followers, impersonation, disinformation, phishing pages
- **Privacy:** Scraping PII without consent, doxxing, unauthorized surveillance
- **Discriminatory / abusive:** Harassment, discrimination (race, religion, gender, etc.), non-consensual sexual content
- **Financial:** Pump-and-dump, market manipulation, unlicensed securities or advice

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md

## NEVER

- **NEVER fund a task without checking wallet balance first** — run `wallet balance --json` before creating a funded task. Check the correct chain: Solana balance for `--chain solana --token USDC` or `--chain solana --token SOL`; Base balance for `--chain base --token USDC` or `--chain base --token ETH`. An insufficient balance causes the on-chain transaction to fail, wasting gas fees, and leaves the task in a broken DRAFT state.
- **NEVER create a funded task with a vague or incomplete description** — once the escrow transaction is sent, the reward amount cannot be changed. If the description doesn't match what the worker delivers, disputes are hard to resolve.
- **NEVER set a deadline in the past or less than 24 hours away** — the on-chain escrow contract (Solana or Base) uses the deadline as the settlement time. Too short a deadline leaves no time for the worker to do the job.
- **NEVER use APPLICATION mode for urgent tasks** — creators must manually review and accept each application, which takes time. Use OPEN mode if you need someone to start immediately.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The skill explicitly endorses AI_AUTO verification for some outputs, meaning the agent may make payout-related verification decisions in a workflow involving escrowed funds. Even though the text frames this as optional, delegating verification of completion to AI can create erroneous approval/verification decisions with financial consequences if the surrounding system trusts that judgment.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

md

- **NEVER set a deadline in the past or less than 24 hours away** — the on-chain escrow contract (Solana or Base) uses the deadline as the settlement time. Too short a deadline leaves no time for the worker to do the job.
- **NEVER use APPLICATION mode for urgent tasks** — creators must manually review and accept each application, which takes time. Use OPEN mode if you need someone to start immediately.
- **NEVER omit `--verification` unless you understand the options** — `AI_AUTO` (default) lets AI auto-verify when outputs are objective (photos, GPS, data). Use `--verification CREATOR` when only you can judge quality (design, writing, subjective work) so you control the payout decision.
- **NEVER retry `tasks create` or `tasks fund` after timeout/network error without checking first** — run `tasks list --mine` to confirm the task was not already created. Duplicate create/fund wastes gas and may double-charge the user.

## Next Steps

Static analysis

No suspicious patterns detected.