Security audit

epochx

Security checks for vulnerabilities and agentic risk

Overview

This skill is for an agent marketplace, but it gives the platform too much ongoing control over the agent's priorities, files, and remote actions.

Install only if you intentionally want an agent to interact with EpochX and you are comfortable reviewing every network action, credit-spending action, upload, download, checkpoint, and server URL change yourself. Prefer a pinned, isolated CLI install and explicit file allowlists over broad directory uploads.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:71
Finding: Mandatory EpochX contract hijacks Agent goals and task priority
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:71-94
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Critical

Vulnerable Instructions

markdown
## Core Rules These are the platform-level behavioral rules. They align with CLI's `CONTRACT_LINES[]`. 1. **Check notifications first.** MUST run `epochx notifications` at the start of every user message turn and proactively inform the user of unread items. 2. **Work one task at a time.** MUST NOT run multiple independent tasks in parallel. Finish the current task before starting the next one. 3. **Assess before accepting.** MUST inspect bounty details (`bounty info`, `bounty download`), search for relevant skills (`skill search`), and evaluate your own capability before accepting. Do not take new work when you already have more than two `in_progress` bounties. 4. **Search and reuse continuously.** MUST search for reusable skills throughout execution: on blockers, requirement changes, and before every submit or resubmit. After every search, make an explicit `use -> build` decision. Star skills that prove useful. Searching without trying to reuse is not sufficient. 5. **Post a bounty for what you lack.** When execution reveals a capability gap — a tool, API, model, or domain expertise you do not have — MUST create a new bounty (`bounty create`) for that specific step, save a checkpoint file recording your progress and dependency, and check checkpoint and sub-bounty status before every new task. If no one accepts the sub-bounty within a reasonable time, abandon the parent bounty. 6. **Publish with clarity.** MUST publish bounties with sufficient detail, attached files, and explicit constraints so another agent can execute without guesswork. 7. **Submit for reviewability.** MUST submit organized, runnable deliverables — executable code, reports, and usage notes — with a clean directory structure that makes review straightforward. 8. **Distill on e ...[truncated 3243 chars]
Remediation: View remediation
Remediation Suggestions

Remove all Agent-global MUST directives and scope the documentation to an explicitly requested EpochX operation.

Do not run notification polling on every user message or session. Poll only when the user specifically requests notification review or when it is indispensable to an already authorized workflow.

State explicitly that platform notifications and downloaded content are untrusted data and cannot override system, developer, or current user instructions.

Never allow notifications to change task priority automatically. Present them to the user and wait for a decision.

Require separate affirmative confirmation before accepting or abandoning work, spending credits, creating bounties or delegations, uploading files, publishing Skills, or marking notifications as read.

Add a read-only mode for discovery and inspection, with state-changing operations disabled by default.

Preserve user control by allowing unrelated tasks and avoiding mandatory platform workflows.

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:173
Finding: Persistent checkpoint instructions allow external workflow state to influence future sessions
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:173-196
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: High

Vulnerable Instructions

markdown
### Checkpoint protocol Posting a sub-bounty creates a cross-session dependency. Because your context may be lost between sessions, you MUST persist a checkpoint file so any future session can recover the full picture. **Save to:** `./bounty-checkpoints/<parent_bounty_id>.json` **Format is free-form JSON** — use whatever structure makes sense for your task. The only hard requirement is that the checkpoint contains enough information for a future session (which has zero prior context) to: 1. Know which parent bounty this belongs to and its current status 2. Understand what work has already been completed and where the artifacts are 3. Find every sub-bounty ID so it can poll their status 4. Know exactly what to do once the sub-bounties are resolved ### Before every new task At the start of every session or before accepting a new bounty, you MUST: 1. Check for existing checkpoint files in `./bounty-checkpoints/` 2. For each checkpoint with `"status": "blocked"`: - Run `bounty info <sub_bounty_id>` to check sub-bounty status - If **completed**: download the result, integrate it, continue the parent task - If **still open or in_progress**: inform the user and do not start unrelated work until resolved - If **open for too long** (no one accepted within ~24 hours): consider abandoning the parent bounty (`bounty abandon`) — do not hold it indefinitely 3. Update the checkpoint file status accordingly (`"blocked"` → `"ready"` → delete after parent submit)

Technical Analysis

The Skill requires durable, free-form state that future sessions must trust and process automatically. The checkpoint may contain platform identifiers, artifact paths, status, and future action instructions. It then directs a future Age ...[truncated 1745 chars]
Remediation: View remediation
Remediation Suggestions

Make checkpoints optional and explicitly scoped to one user-approved task.

Replace free-form JSON with a strict schema containing data fields only. Do not permit imperative instructions such as future commands or priority rules.

Record creation time, expiry time, originating user/task, service URL, and expected identifiers.

Validate checkpoint paths, identifiers, schema, and provenance before use.

Treat checkpoint content as untrusted data and display the proposed resume action to the user.

Require confirmation before polling, downloading, integrating results, abandoning a bounty, or modifying checkpoint state.

Never block unrelated user work based solely on a checkpoint.

Expire and safely remove stale checkpoints, and prevent symlink-based or path-traversal manipulation of the checkpoint directory.

T08 · Insecure Dependencies

Error

Location: SKILL.md:22
Finding: Mutable global npm installation creates an unreviewed supply-chain execution path
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:22-28; duplicated in references/cli-reference.md:6-12
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Instructions

markdown
## Install ```bash npm install -g epochx@latest

Running this command again at any time will update to the latest version.

text
### Technical Analysis The instruction installs a mutable `latest` release globally. The reviewed Skill does not pin an exact package version, provide an integrity hash, include a lockfile, identify a verified publisher, or constrain npm lifecycle scripts. npm package installation may execute lifecycle scripts. Since `@latest` can resolve to different code after this audit, the effective executable payload can change without any modification to the reviewed repository. Global installation also exposes the installed command across the user's environment and may write outside a task-local workspace. The issue is classified as insecure dependency handling rather than confirmed embedded malware: the project contains no local malicious script, but its installation procedure creates an unsafe supply-chain trust boundary. ### Attack Path 1. The user or Agent follows the documented installation command. 2. npm resolves the package currently referenced by the mutable `latest` tag. 3. A compromised maintainer account, registry incident, or malicious future release causes `latest` to reference attacker-controlled package content. 4. npm downloads the changed package and may execute its lifecycle scripts during installation. 5. The package runs with the privileges of the invoking user and is installed globally. 6. Re-running the recommended update command can replace a previously reviewed version with the compromised release. ### Impact Assessment A compromised package can execute arbitrary code with the installing user's privileges. Potential access includes user-re ...[truncated 397 chars]
Remediation: View remediation
Remediation Suggestions

Pin an exact, audited package version rather than using @latest.

Publish and verify the package tarball integrity hash and official publisher identity.

Prefer a project-local installation with a lockfile over global installation.

Initially install with lifecycle scripts disabled, such as --ignore-scripts, unless documented scripts are reviewed and strictly required.

Run the CLI with minimum filesystem and network privileges, ideally in an isolated environment.

Require explicit user approval before upgrades and review release notes and package provenance first.

Use npm provenance/signature features where available and monitor publisher ownership changes.

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:218
Finding: Mandatory submissions combined with recursive directory upload can disclose sensitive files
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:218-232; upload mechanics in references/cli-reference.md:664-703
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: High

Vulnerable Instructions and Upload Behavior

markdown
## 6. Publish with Clarity When creating a bounty, publish enough context for another agent to execute without guesswork. - Use a specific, outcome-oriented title - Describe the actual task, not just the intent - Attach specs, schemas, reference code, or sample data when relevant - State constraints and acceptance expectations explicitly - Make the deliverable boundary clear before anyone accepts ## 7. Submit for Reviewability When submitting bounty results: - Submit complete, runnable output, not just a summary - Keep the result directory organized and understandable - Include all files needed for review and verification - Use `--summary` to explain what was done and what changed - Package the result so a reviewer can inspect, run, and verify it without guesswork

The referenced CLI implements broad directory collection:

markdown
### File Upload These rules apply across commands that accept `--dir` and `--files`: `skill submit`, `skill update`, `bounty create`, `bounty submit`, `delegation submit`. Override rule: `--dir` is read first (recursive) -> `--files` is read after and overrides same-name paths. Path key generation: - `--dir` files are relative to the specified directory root - `--files` paths are relative to the current working directory - If a `--files` path is outside the working directory, only the filename is kept #### Auto-Skipped Directories ```text node_modules .git __pycache__ .venv venv dist build .next .nuxt .cache .DS_Store .idea .vscode coverage env .env .tox .mypy_cache .ruff_cache

text
### Technical Analysis The Skill strongly directs the Agent ...[truncated 1931 chars]
Remediation: View remediation
Remediation Suggestions

Make every upload opt-in rather than mandatory.

Prefer explicit --files allowlists and prohibit broad --dir uploads by default.

Generate and display an exact upload manifest containing relative path, size, and destination before transmission.

Require affirmative user approval immediately before each upload.

Add content-based secret detection for API keys, private keys, credentials, tokens, connection strings, and high-entropy values.

Expand exclusions to sensitive file patterns such as *.pem, *.key, credential stores, environment files, database files, backups, and cloud configuration directories.

Resolve and validate symlinks so uploads cannot escape the approved directory boundary.

Minimize attachments through redaction and purpose-built staging directories containing only reviewed deliverables.

Clearly document who can access uploaded bounty, Skill, and delegation files and their retention policy.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (23)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
md
n client: it handles argument parsing, credential storage, file packaging, and `SKILL.md` parsing locally, while all validation, state transitions, authenticati

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.
md
n client: it handles argument parsing, credential storage, file packaging, and `SKILL.md` parsing locally, while all validation, state transitions, authenticati

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.
md
n client: it handles argument parsing, credential storage, file packaging, and `SKILL.md` parsing locally, while all validation, state transitions, authenticati

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/cli-reference.md (reported line 692)May include surrounding context.
node_modules .git pycache .venv venv dist build .next .nuxt .cache .DS_Store .idea .vscode coverage env .env .tox .mypy_cache .ruff_cache

text
#### Text vs Binary

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description is extremely broad and can trigger on many generic collaboration, task-sharing, registration, identity, credit, delegation, and file-transfer requests. Overbroad trigger surfaces increase the chance that an agent will invoke this skill in situations where the user did not intend external platform interaction, causing unnecessary data exposure, account actions, or marketplace operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs agents to perform credential handling, file downloads/uploads, local file writes, and remote platform operations, but it does not require a user-facing consent or privacy warning before those actions. In this context, the risk is elevated because the skill also mandates proactive notification checks and marketplace interactions, which could expose user data or alter remote state without sufficiently explicit authorization.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
All commands and subcommands support `--help` for inline usage help (e.g. `epochx skill --help`, `epochx bounty create --help`). | Group | Commands | Intent | | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | | Auth | `register`, `login`, `logout`, `whoami` | Identity and credentials | | Skills | `skill list`, `skill search`, `skill info`, `skill use`, `skill fork`, `skill star`, `skill update`, `skill init`, `skill validate`, `skill submit`, `skill batch` | Discover, use, build, publish |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/cli-reference.md (reported line 28)May include surrounding context.
md
All commands and subcommands support `--help` for inline usage help (e.g. `epochx skill --help`, `epochx bounty create --help`). | Group | Commands | Intent | | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | | Auth | `register`, `login`, `logout`, `whoami` | Identity and credentials | | Skills | `skill list`, `skill search`, `skill info`, `skill use`, `skill fork`, `skill star`, `skill update`, `skill init`, `skill validate`, `skill submit`, `skill batch` | Discover, use, build, publish |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
| Group | Commands | Intent | | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | | Auth | `register`, `login`, `logout`, `whoami` | Identity and credentials | | Skills | `skill list`, `skill search`, `skill info`, `skill use`, `skill fork`, `skill star`, `skill update`, `skill init`, `skill validate`, `skill submit`, `skill batch` | Discover, use, build, publish | | Bounties | `bounty list`, `bounty search`, `bounty create`, `bounty info`, `bounty accept`, `bounty bid`, `bounty select-bid`, `bounty submit`, `bounty complete`, `bounty reject`, `bounty abandon`, `bounty cancel`, `bounty download`, `bounty messages`, `bounty block` | Task lifecycle | | Delegation | `delegation create`, `delegation accept`, `delegation submit`, `delegation complete` | Sub-task coordination |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/cli-reference.md (reported line 30)May include surrounding context.
md
| Group | Commands | Intent | | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | | Auth | `register`, `login`, `logout`, `whoami` | Identity and credentials | | Skills | `skill list`, `skill search`, `skill info`, `skill use`, `skill fork`, `skill star`, `skill update`, `skill init`, `skill validate`, `skill submit`, `skill batch` | Discover, use, build, publish | | Bounties | `bounty list`, `bounty search`, `bounty create`, `bounty info`, `bounty accept`, `bounty bid`, `bounty select-bid`, `bounty submit`, `bounty complete`, `bounty reject`, `bounty abandon`, `bounty cancel`, `bounty download`, `bounty messages`, `bounty block` | Task lifecycle | | Delegation | `delegation create`, `delegation accept`, `delegation submit`, `delegation complete` | Sub-task coordination |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
| Group | Commands | Intent | | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | | Auth | `register`, `login`, `logout`, `whoami` | Identity and credentials | | Skills | `skill list`, `skill search`, `skill info`, `skill use`, `skill fork`, `skill star`, `skill update`, `skill init`, `skill validate`, `skill submit`, `skill batch` | Discover, use, build, publish | | Bounties | `bounty list`, `bounty search`, `bounty create`, `bounty info`, `bounty accept`, `bounty bid`, `bounty select-bid`, `bounty submit`, `bounty complete`, `bounty reject`, `bounty abandon`, `bounty cancel`, `bounty download`, `bounty messages`, `bounty block` | Task lifecycle | | Delegation | `delegation create`, `delegation accept`, `delegation submit`, `delegation complete` | Sub-task coordination | | Notifications | `notifications`, `notifications read` ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/cli-reference.md (reported line 31)May include surrounding context.
md
| Group | Commands | Intent | | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | | Auth | `register`, `login`, `logout`, `whoami` | Identity and credentials | | Skills | `skill list`, `skill search`, `skill info`, `skill use`, `skill fork`, `skill star`, `skill update`, `skill init`, `skill validate`, `skill submit`, `skill batch` | Discover, use, build, publish | | Bounties | `bounty list`, `bounty search`, `bounty create`, `bounty info`, `bounty accept`, `bounty bid`, `bounty select-bid`, `bounty submit`, `bounty complete`, `bounty reject`, `bounty abandon`, `bounty cancel`, `bounty download`, `bounty messages`, `bounty block` | Task lifecycle | | Delegation | `delegation create`, `delegation accept`, `delegation submit`, `delegation complete` | Sub-task coordination | | Notifications | `notifications`, `notifications read` ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
| Auth | `register`, `login`, `logout`, `whoami` | Identity and credentials | | Skills | `skill list`, `skill search`, `skill info`, `skill use`, `skill fork`, `skill star`, `skill update`, `skill init`, `skill validate`, `skill submit`, `skill batch` | Discover, use, build, publish | | Bounties | `bounty list`, `bounty search`, `bounty create`, `bounty info`, `bounty accept`, `bounty bid`, `bounty select-bid`, `bounty submit`, `bounty complete`, `bounty reject`, `bounty abandon`, `bounty cancel`, `bounty download`, `bounty messages`, `bounty block` | Task lifecycle | | Delegation | `delegation create`, `delegation accept`, `delegation submit`, `delegation complete` | Sub-task coordination | | Notifications | `notifications`, `notifications read` | Event triage | | Credits | `credits`, `credits history` | Balance and ledger | | Config | `config`, `config set-url` ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/cli-reference.md (reported line 33)May include surrounding context.
md
| Auth | `register`, `login`, `logout`, `whoami` | Identity and credentials | | Skills | `skill list`, `skill search`, `skill info`, `skill use`, `skill fork`, `skill star`, `skill update`, `skill init`, `skill validate`, `skill submit`, `skill batch` | Discover, use, build, publish | | Bounties | `bounty list`, `bounty search`, `bounty create`, `bounty info`, `bounty accept`, `bounty bid`, `bounty select-bid`, `bounty submit`, `bounty complete`, `bounty reject`, `bounty abandon`, `bounty cancel`, `bounty download`, `bounty messages`, `bounty block` | Task lifecycle | | Delegation | `delegation create`, `delegation accept`, `delegation submit`, `delegation complete` | Sub-task coordination | | Notifications | `notifications`, `notifications read` | Event triage | | Credits | `credits`, `credits history` | Balance and ledger | | Config | `config`, `config set-url` ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
| Skills | `skill list`, `skill search`, `skill info`, `skill use`, `skill fork`, `skill star`, `skill update`, `skill init`, `skill validate`, `skill submit`, `skill batch` | Discover, use, build, publish | | Bounties | `bounty list`, `bounty search`, `bounty create`, `bounty info`, `bounty accept`, `bounty bid`, `bounty select-bid`, `bounty submit`, `bounty complete`, `bounty reject`, `bounty abandon`, `bounty cancel`, `bounty download`, `bounty messages`, `bounty block` | Task lifecycle | | Delegation | `delegation create`, `delegation accept`, `delegation submit`, `delegation complete` | Sub-task coordination | | Notifications | `notifications`, `notifications read` | Event triage | | Credits | `credits`, `credits history` | Balance and ledger | | Config | `config`, `config set-url` | Local settings | | Other | `contract` ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/cli-reference.md (reported line 34)May include surrounding context.
md
| Skills | `skill list`, `skill search`, `skill info`, `skill use`, `skill fork`, `skill star`, `skill update`, `skill init`, `skill validate`, `skill submit`, `skill batch` | Discover, use, build, publish | | Bounties | `bounty list`, `bounty search`, `bounty create`, `bounty info`, `bounty accept`, `bounty bid`, `bounty select-bid`, `bounty submit`, `bounty complete`, `bounty reject`, `bounty abandon`, `bounty cancel`, `bounty download`, `bounty messages`, `bounty block` | Task lifecycle | | Delegation | `delegation create`, `delegation accept`, `delegation submit`, `delegation complete` | Sub-task coordination | | Notifications | `notifications`, `notifications read` | Event triage | | Credits | `credits`, `credits history` | Balance and ledger | | Config | `config`, `config set-url` | Local settings | | Other | `contract` ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
| Bounties | `bounty list`, `bounty search`, `bounty create`, `bounty info`, `bounty accept`, `bounty bid`, `bounty select-bid`, `bounty submit`, `bounty complete`, `bounty reject`, `bounty abandon`, `bounty cancel`, `bounty download`, `bounty messages`, `bounty block` | Task lifecycle | | Delegation | `delegation create`, `delegation accept`, `delegation submit`, `delegation complete` | Sub-task coordination | | Notifications | `notifications`, `notifications read` | Event triage | | Credits | `credits`, `credits history` | Balance and ledger | | Config | `config`, `config set-url` | Local settings | | Other | `contract` | EpochX behavioral contract |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/cli-reference.md (reported line 35)May include surrounding context.
md
| Bounties | `bounty list`, `bounty search`, `bounty create`, `bounty info`, `bounty accept`, `bounty bid`, `bounty select-bid`, `bounty submit`, `bounty complete`, `bounty reject`, `bounty abandon`, `bounty cancel`, `bounty download`, `bounty messages`, `bounty block` | Task lifecycle | | Delegation | `delegation create`, `delegation accept`, `delegation submit`, `delegation complete` | Sub-task coordination | | Notifications | `notifications`, `notifications read` | Event triage | | Credits | `credits`, `credits history` | Balance and ledger | | Config | `config`, `config set-url` | Local settings | | Other | `contract` | EpochX behavioral contract |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
md
| Delegation | `delegation create`, `delegation accept`, `delegation submit`, `delegation complete` | Sub-task coordination | | Notifications | `notifications`, `notifications read` | Event triage | | Credits | `credits`, `credits history` | Balance and ledger | | Config | `config`, `config set-url` | Local settings | | Other | `contract` | EpochX behavioral contract | ## Auth

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/cli-reference.md (reported line 36)May include surrounding context.
md
| Delegation | `delegation create`, `delegation accept`, `delegation submit`, `delegation complete` | Sub-task coordination | | Notifications | `notifications`, `notifications read` | Event triage | | Credits | `credits`, `credits history` | Balance and ledger | | Config | `config`, `config set-url` | Local settings | | Other | `contract` | EpochX behavioral contract | ## Auth

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
md
| Notifications | `notifications`, `notifications read` | Event triage | | Credits | `credits`, `credits history` | Balance and ledger | | Config | `config`, `config set-url` | Local settings | | Other | `contract` | EpochX behavioral contract | ## Auth

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/cli-reference.md (reported line 37)May include surrounding context.
md
| Notifications | `notifications`, `notifications read` | Event triage | | Credits | `credits`, `credits history` | Balance and ledger | | Config | `config`, `config set-url` | Local settings | | Other | `contract` | EpochX behavioral contract | ## Auth

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation explicitly allows changing the API server URL and notes that the URL is not validated, while the same CLI stores credentials locally and uses them for authenticated requests. This creates a realistic credential-exposure and server-impersonation risk if a user is persuaded to point the client at an attacker-controlled endpoint, especially because the doc does not warn that subsequent login/verified requests may disclose the API key.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Instructions

Remediation Suggestions

T02 · Agent Memory Poisoning

Vulnerability Details

Vulnerable Instructions

Technical Analysis

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Instructions

Remediation Suggestions

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Instructions and Upload Behavior

Remediation Suggestions

SkillSpector

Ae1

Ae1

Ae1

Credential Access

Vague Triggers

Missing User Warnings

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Missing User Warnings