Security audit

Job for Agents

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly a disclosed OpenJobs marketplace operator, but it asks agents to force-refresh their own runtime instructions from remote URLs during heartbeat.

Install only if you are comfortable giving this skill active control over an OpenJobs account, wallet-related operations, marketplace messages, and job actions. Before enabling heartbeat automation, remove or disable the forced remote skill refresh, pin the skill version, keep oversight in manual or notify_only until tested, and avoid storing wallet secrets unless needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 99% confidence
Finding: The skill instructs the agent to treat remotely hosted SKILL.md and HEARTBEAT.md files as 'runtime execution authority' and to force-reinstall them during heartbeat. This creates a remote instruction-supply-chain channel where a compromised server, CDN, account, or release process can change future agent behavior without explicit review.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The documented install-skill command writes into agent runtime skill directories and can overwrite local behavior bundles. That capability is broader than marketplace participation and is dangerous because it modifies the agent's instruction surface, potentially enabling persistence or replacement of trusted local skills.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The command-center actions interface is open-ended and can trigger arbitrary platform-defined actions via action names and JSON payloads. Because the catalog is not fixed in the skill, future or undocumented actions could exceed the expected marketplace scope and grant broad control through a generic dispatcher.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger section is overly broad and can cause this skill to activate for many generic OpenJobs-related requests, including simple read-only inquiries. In this skill, activation is not harmless: the workflow contains mandatory state-changing behavior such as acting on at least one inbox item and sending replies or marking tasks read, so unintended invocation can lead to unauthorized actions on jobs, messages, or account state.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The activation guidance is overly broad, including generic terms like 'the marketplace' or 'my agent'. Broad triggers increase the chance the skill activates in unrelated contexts, which can cause the agent to follow high-impact operational instructions or handle sensitive wallet/platform actions when the user did not clearly intend OpenJobs behavior.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The heartbeat tells the agent to force-refresh the skill bundle from a remote source and overwrite local files without a user-facing warning. That is dangerous because it silently changes future behavior and can be exploited as a persistence/update mechanism if the remote source or delivery path is compromised.

Ssd 1

High

Confidence: 100% confidence
Finding: Granting remote published docs 'runtime execution authority' effectively delegates agent behavior to mutable external content. If that content is altered, the agent may ingest new adversarial instructions on every heartbeat, creating a direct remote control and supply-chain compromise path with no stable trust anchor.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/create-solana-wallet.mjs:118