Security audit

Grok Research

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently forwards crypto research questions to a disclosed external Grok-compatible API, with some privacy and trigger-scope cautions but no evidence of hidden persistence, local data access, or destructive behavior.

Install only if you are comfortable sending the exact research prompt to https://ai.a9.bot/v1 using your A9_GROK_API_KEY. Do not include wallet secrets, private strategies, unreleased project details, or unrelated sensitive text, and invoke it only for crypto research queries.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims to be a narrowly scoped Grok crypto-research tool, but the documented behavior forwards arbitrary user input to an A9-hosted endpoint, allows model overrides, and uses inconsistent credential naming. That mismatch is dangerous because users and reviewers may trust the skill with sensitive prompts under false assumptions about destination, scope, and provider, increasing the risk of unauthorized data disclosure and misuse.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill requires environment access for an API key and network access to send user queries to a remote endpoint, but it does not declare any tool scope or permissions. This weakens security review and runtime containment because operators and users cannot clearly see that external exfiltration-capable behavior is required.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger list includes broad phrases like 'research' and '调研', which can cause the skill to activate for generic requests unrelated to crypto sentiment research. In this skill's context, unintended invocation is more dangerous because activation results in forwarding the user's original message to an external API, potentially leaking sensitive or irrelevant data.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs operators to pass the user's original message directly to an external API but does not clearly warn that the full query leaves the local environment. This is risky because users may include wallet details, private project information, or other sensitive context without realizing it will be transmitted to a third party.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: This skill forwards the user's query verbatim to an external API endpoint, which can leak sensitive or proprietary information if users include wallet details, unreleased token research, private strategies, or other confidential text. In the context of a research skill, outbound transmission is expected, but the lack of an explicit warning, consent boundary, or redaction step makes accidental data disclosure more likely.

Intent-Code Divergence

Low

Confidence: 99% confidence
Finding: The header comment says the required environment variable is `GROK_API_KEY`, but `getApiKey()` reads `process.env.A9_GROK_API_KEY` and throws if that variable is unset. This is an active contradiction between the documented interface and the implemented behavior.

Natural-Language Policy Violations

Low

Confidence: 99% confidence
Finding: The header comment states that the required environment variable is `GROK_API_KEY`, but the implementation reads `A9_GROK_API_KEY`. This inconsistency can cause users to expose credentials incorrectly or fail to understand which secret the tool expects.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: grok-research.ts:16