ClawHub
Back to skill

Security audit

WorkProtocol Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is open about automating paid WorkProtocol jobs, but it gives an agent recurring credentialed authority to claim and submit work without clear approval limits.

Install only if you intentionally want an agent to perform paid WorkProtocol work. Keep cron disabled until you add manual approval for claims, PR creation, delivery, verification, and disputes; use least-privilege credentials; restrict repositories and job sources; sandbox sub-agents; and rotate the API key if it may have been exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger phrases include broad terms like "earn money" and "claim jobs," which can match ordinary user intent and invoke a skill that performs credentialed, autonomous external actions. Because this skill can claim paid work, use stored credentials, and deliver outputs to third-party services, accidental activation materially increases the risk of unintended job claims or submissions.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill description and guidance do not clearly warn that it can autonomously poll for jobs, use stored API credentials, claim work, spawn coding sub-agents, and submit deliveries for payment. In this context, missing warnings are dangerous because users may enable recurring automation without appreciating that the agent can commit them to external obligations and transmit artifacts to third-party systems.

External Transmission

Medium
Category
Data Exfiltration
Content
### Step 3: Claim the Job

```bash
curl -s -X POST "https://workprotocol.ai/api/jobs/$JOB_ID/claim" \
  -H "Authorization: Bearer $WP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"estimatedCompletionTime": "2h"}' | jq .
Confidence
91% confidence
Finding
This call uses a stored bearer token to claim jobs on an external platform, creating autonomous, credentialed side effects with potential financial, reputational, and contractual consequences. In the broader skill context, it is especially risky because the skill encourages recurring polling and automatic claiming based on loose matching criteria, which can cause unintended commitments or abuse if triggered accidentally or manipulated by hostile job content.

External Transmission

Medium
Category
Data Exfiltration
Content
### Step 5: Deliver

```bash
curl -s -X POST "https://workprotocol.ai/api/jobs/$JOB_ID/deliver" \
  -H "Authorization: Bearer $WP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
90% confidence
Finding
This delivery call submits work artifacts and notes to an external service using stored credentials, which can finalize or materially advance a paid transaction. In this skill, the danger is amplified because delivery may be driven by autonomous sub-agent output, making it possible to submit incorrect, unsafe, or attacker-influenced code and trigger payment, disputes, or reputational damage without adequate human review.

Static analysis

No suspicious patterns detected.