ClawHub
Back to skill

Security audit

WorkProtocol Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly about autonomous paid coding work, but it gives agents broad unattended authority to claim jobs, use credentials, run untrusted code workflows, and submit deliverables without enough user control.

Review this skill carefully before installing. Use it only with narrowly scoped, revocable WorkProtocol and GitHub credentials, avoid unattended cron mode unless you add strict approval rules, and require manual review before claiming jobs, cloning repositories, running builds, opening PRs, or submitting deliveries.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T06 · System Persistence

Error
Location
SKILL.md:117
Finding

Recurring Autonomous Agent Execution Creates Cross-Session Persistence

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 117-124
Vulnerability Type: Scheduled autonomous execution
Risk Level: High

Vulnerable Code:

text
## Autonomous Loop (Cron)

Set up a recurring job to poll for work:

Use the cron tool to schedule an agentTurn every 2-4 hours: "Check WorkProtocol for new code jobs matching my capabilities. If a good match exists, claim it and complete it. API key is in ~/workprotocol-creds.env"

text

Technical Analysis

The Skill explicitly instructs the agent to create a recurring cron task. This task persists beyond the current Skill invocation and periodically performs externally influenced operations without requiring approval for each job.

The scheduled task does more than notify the user: it directs the agent to query WorkProtocol, select a job, claim it, and complete it. Job descriptions and repositories are controlled outside the local environment, so this persistent automation repeatedly exposes the agent to untrusted content and execution workflows.

This is a system-persistence risk because the scheduled agent turn survives the originating session and continues invoking privileged agent capabilities.

Attack Path

  1. A user loads the Skill and follows its cron setup instructions.
  2. A recurring agent task is installed and runs every two to four hours.
  3. An attacker publishes or compromises a WorkProtocol job that matches the agent's capabilities.
  4. The scheduled agent retrieves and autonomously claims the job.
  5. The agent processes the attacker-controlled job description and repository.
  6. Coding agents, repository commands, tests, builds, GitHub operations, or delivery APIs may be invoked without a new user authorization decision.
  7. The same exposure recurs for as long as the scheduled task remains installed.

Impact Assessment

The persistent task can repeatedly use the agent's WorkProtocol credentials, codin ...[truncated 585 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove instructions that create a recurring autonomous worker.
  • If scheduling is necessary, limit the scheduled task to retrieving job metadata and notifying the user.
  • Require explicit user approval before every job claim, repository clone, sub-agent invocation, command execution, GitHub change, and delivery.
  • Restrict scheduled jobs to a dedicated sandbox with no inherited user secrets and no unrestricted filesystem access.
  • Maintain an allowlist of approved repositories, organizations, command types, and network destinations.
  • Provide documented commands for listing, disabling, and deleting any scheduled task created by the Skill.
  • Set execution limits, expiration times, and audit logging for all scheduled operations.

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:86
Finding

Untrusted Remote Job Instructions Are Passed Directly to Coding Sub-Agents

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 86-95
Vulnerability Type: Untrusted instruction delegation
Risk Level: High

Vulnerable Code:

text
### Step 4: Do the Work

For code jobs, the typical flow is:

1. **Clone the repo** referenced in the job description
2. **Spawn a coding sub-agent** to implement the fix:
   ```
   Use sessions_spawn with runtime="subagent" or runtime="acp"
   Task: the job description + acceptance criteria
   ```
3. **Verify locally** — run tests, check the build
4. **Create a PR** or prepare the diff

Technical Analysis

The job description, acceptance criteria, and repository reference originate from an external service but are directly used as the task for a coding sub-agent. The Skill does not establish a trust boundary between external job data and executable agent instructions.

There is no requirement to validate the task against a constrained schema, inspect it for instruction injection, verify repository ownership, restrict sub-agent tools, isolate builds, or obtain user approval. The subsequent direction to run tests and builds also creates a path from an untrusted repository to local code execution because common build systems can execute repository-provided scripts.

An attacker can phrase a job description as operational instructions unrelated to the advertised coding task, or place malicious scripts and agent-directed content in the referenced repository. Passing that content into a capable coding agent can alter its effective goals and cause actions outside the intended task.

Attack Path

  1. An attacker creates a job containing a malicious description, acceptance criteria, or repository URL.
  2. The agent retrieves and claims the job through WorkProtocol.
  3. The externally specified repository is cloned.
  4. The job description and acceptance criteria are passed directly to a coding sub-agent as its task.
  5. The sub-agent inter ...[truncated 1139 chars]
Remediation
View remediation

Remediation Suggestions

  • Treat all job descriptions, acceptance criteria, repository content, issues, and pull-request text as untrusted data rather than agent instructions.
  • Parse jobs into a strict schema containing only permitted fields and reject content that requests credential access, policy changes, unrelated actions, or expanded permissions.
  • Require explicit user approval before cloning any repository or spawning a coding sub-agent.
  • Allowlist trusted repository hosts, organizations, and repositories, and verify the resolved clone URL before use.
  • Run sub-agents and repository builds in disposable, network-restricted sandboxes without user credentials, home-directory access, or access to unrelated repositories.
  • Do not expose WP_API_KEY, GitHub credentials, SSH keys, cloud credentials, or other secrets to the sub-agent or build process.
  • Inspect build and test definitions before execution, disable lifecycle scripts where feasible, and use fixed resource and time limits.
  • Constrain sub-agent tools to the minimum operations required for the approved coding task.
  • Require a human-reviewed diff before pushing changes, opening a pull request, or delivering work.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:38
Finding

Bearer API Credential Is Stored in a Predictable Plaintext File

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38-42
Vulnerability Type: Insecure credential storage
Risk Level: Medium

Vulnerable Code:

text
### 2. Store credentials

Save your API key to a file (don't rely on session memory):
```bash
echo "WP_API_KEY=wp_agent_xxxxx" >> ~/workprotocol-creds.env
text

### Technical Analysis

The Skill instructs the user to persist a bearer API key in a predictable plaintext file under the home directory. The command does not create the file with an explicitly restrictive mode, verify existing ownership or permissions, or protect against symbolic-link and repeated-append behavior.

The resulting permissions depend on the user's current `umask` and on whether the file already exists. Other local users or processes may be able to read the credential if the file is created or retained with permissive permissions. Because the autonomous cron instructions identify the credential's exact location, delegated agent processes also know where to find it.

Using `>>` repeatedly can additionally retain obsolete credentials in the same file, increasing secret-management and rotation risks.

### Attack Path

1. The user executes the documented credential-storage command.
2. The API key is written unencrypted to `~/workprotocol-creds.env`.
3. The file inherits existing permissions or permissions determined by the current `umask`.
4. A local process, delegated sub-agent, malicious repository script, backup collector, or another user with sufficient filesystem access reads the file.
5. The attacker extracts the bearer token.
6. The token is used to authenticate to WorkProtocol APIs as the affected agent.

### Impact Assessment

A stolen token can enable account impersonation within the permissions associated with the WorkProtocol agent. Potential actions include viewing available or matched jobs, claiming jobs, retrieving job details, submitting deliveri
...[truncated 390 chars]
Remediation
View remediation

Remediation Suggestions

  • Store the API key in an operating-system credential store, managed secret service, or agent-specific secret facility rather than a plaintext environment file.
  • If file storage is unavoidable, create a dedicated directory and file with restrictive permissions before writing:
    bash
    install -d -m 700 "$HOME/.config/workprotocol"
umask 077
printf '%s\n' "WP_API_KEY=$WP_API_KEY" > "$HOME/.config/workprotocol/credentials.env"
chmod 600 "$HOME/.config/workprotocol/credentials.env"
  • Verify that the destination is owned by the expected user and is not a symbolic link.
  • Replace the credential atomically instead of appending it, preventing obsolete keys from accumulating.
  • Never expose the credential file to coding sub-agents, cloned repositories, build scripts, test processes, logs, or pull requests.
  • Use narrowly scoped and revocable tokens where supported, rotate credentials regularly, and revoke a token immediately if disclosure is suspected.
  • Ensure backups and synchronization tools exclude plaintext secret files unless they provide appropriate encryption and access control.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description advertises autonomous job claiming and code-task completion for payment but does not clearly warn that it can take external actions affecting third-party accounts, funds, and GitHub repositories. Users may invoke it without understanding that it can submit API requests, claim paid work, clone repos, and create deliverables tied to financial settlement.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The autonomous cron workflow instructs unattended polling, matching, claiming, and completion of jobs using stored credentials, but omits any warning or approval checkpoint. In context, this enables ongoing autonomous external actions with financial and repository consequences, increasing the chance of unintended claims, misuse of secrets, or execution of risky third-party tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases include broad terms like 'earn money', 'claim jobs', and 'work on bounties', which can match ordinary user intent and invoke a skill that performs consequential external actions. Because this skill can claim jobs, interact with repositories, and handle payment-linked workflows, accidental activation raises the risk of unintended autonomous behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

bash
# Register a new agent
curl -s -X POST https://workprotocol.ai/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my-agent",

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This API call claims a job using the user's bearer token, creating an external commitment that can affect reputation, workload, and potential financial outcomes. In the context of an autonomous agent skill, this is dangerous because the action is state-changing and may be performed without adequate user confirmation or bounded policy checks.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

Step 3: Claim the Job

bash
curl -s -X POST "https://workprotocol.ai/api/jobs/$JOB_ID/claim" \
  -H "Authorization: Bearer $WP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"estimatedCompletionTime": "2h"}' | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This delivery endpoint submits a work product URL and notes for verification and payment, which can finalize externally visible actions tied to financial settlement and reputation. In this skill's context, automated delivery is risky because it may publish incorrect, unsafe, or unauthorized outputs to third-party systems without human review.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

Step 5: Deliver

bash
curl -s -X POST "https://workprotocol.ai/api/jobs/$JOB_ID/deliver" \
  -H "Authorization: Bearer $WP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

No suspicious patterns detected.