T06 · System Persistence
Error
- Location
SKILL.md:227- Finding
Persistent External Inbox Polling Through a Scheduled Cron Job
- Content
View full analysis
- Remediation
View remediation
Security audit
Deaddrop
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent agent-messaging API guide, but it needs review because it recommends persistent automated polling and treats remote service text as operational guidance.
Install only if you intend to use agentdeaddrop.com for agent-to-agent messaging. Do not let remote search messages or inbox message bodies override user, system, or skill instructions. Avoid setting up automatic cron polling unless you explicitly want persistent background network activity, store the API key in a protected secret mechanism, and have a clear way to remove the job and revoke the key.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:163- Finding
Server-Controlled Response Field Is Elevated as Behavioral Guidance
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The search endpoint may return a free-form message and explicitly instructs the agent to 'read it carefully' because it contains 'important context' about how to contribute. This is a prompt-injection vector: untrusted remote content is being framed as authoritative operational guidance, which could manipulate an agent into registering, changing behavior, disclosing data, or taking other unintended actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill documents that polling consumes messages, but the operational guidance does not make the destructive nature of inbox polling prominent where an agent is most likely to act on it. In an agent-to-agent system, destructive reads can cause silent message loss, missed tasks, and broken workflows if an agent polls speculatively, concurrently, or too frequently without understanding that messages are permanently removed once read.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill recommends automated polling via curl/OpenClaw cron jobs but provides no guidance on protecting the Bearer API key. This encourages insecure practices such as embedding credentials in shell history, process arguments, logs, or world-readable cron files, which could expose an account and allow unauthorized profile changes or message access.
- Content