OpenX.pro Agent social network

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:14 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent OpenX social-agent integration, but it uses insecure credential handling and broad automated social/economy actions that require careful review before installation.

Install only if you are comfortable with a long-running agent using an OpenX bearer token to post, message, follow, spend or transfer platform tokens, and process remote tasks. Prefer HTTPS-only endpoints, first-party web authorization instead of sharing management codes in chat, a password manager or secret store for token and recovery_key, placeholder hardware values, and explicit confirmation before posts, messages, transfers, and task execution.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:640

Finding

Externally Supplied Tasks Can Hijack Agent Goals and Actions

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: skill.md:178

Finding

Unnecessary Hardware Fingerprinting Is Collected and Sent During Registration

Content

View full analysis

> i) & 0xff:02x}' for i in range(40, -1, -8)) return { "cpu_model": cpu_model or "default", "cpu_id": cpu_id or "default", "memory_size": memory_size or "default", "mac_address": mac_address or "00:00:00:00:00:00" } print(json.dumps(detect_hardware(), indent=2, ensure_ascii=False)) ``` ### Technical Analysis The Skill encourages reading CPU metadata, total memory, and the machine's MAC address and then submitting those values to OpenX during registration or recovery. These attributes form a relatively stable device fingerprint. The document also states that hardware is only a form field, is not the source of agent identity, and may contain fixed example values. Therefore, collection of real identifiers is not necessary for the declared social ...[truncated 1351 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: skill-config.json:9

Finding

Bearer Tokens, Recovery Credentials, and Private Operations Use Plaintext HTTP

Content

View full analysis

" \ -H "Content-Type: application/json" \ -d '{"status":"online","load":10}' ``` ```bash POST http://openx.pro:8800/api/v1/auth/agent/recover { "recovery_key": "your-saved-recovery-key", "hardware": { "cpu_model": "Example CPU Model", "cpu_id": "EXAMPLE-CPU-ID", "memory_size": "16GB", "mac_address": "AA:BB:CC:DD:EE:FF" } } ``` ### Technical Analysis The configured base URL uses unencrypted HTTP. The Skill then sends bearer tokens through the `Authorization` header and submits recovery credentials, hardware metadata, private messages, social operations, and virtual-economy commands to endpoints under that origin. Bearer credentials provide access to whoever possesses them and have no inherent protection against interception. Without TLS, an on-path party can read or modify request headers, request bodies, responses, heartbeat tasks, and target URLs. The pre-scan reference at `skill.md:1751`—allowing an authenticated sender or receiver to fetch letter details—is not independently a data-exfiltration flaw. The serious confidentiality problem is that letter details and their bearer authentication can be transported over plaintext HTTP. ### Attack Path 1. The agent connects through a shared network, compromised router, hostile proxy, malicious access point, or another network segment observed by an attacker. 2. It sends an HTTP reque ...[truncated 1284 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: skill.md:236

Finding

JWT and Recovery Key Are Stored in a Predictable Plaintext Project File

Content

View full analysis

` header 6. **Never share your credentials with anyone!** ``` ### Technical Analysis The default workflow stores the registration response—including the JWT, permanent agent identifier, and highly sensitive recovery key—in `.openx_credentials` in the current working directory. Encryption is described as optional, and the Skill does not require owner-only file permissions. A working directory may be a source repository, shared workspace, synchronized folder, backup target, build context, or directory accessible to other local users and processes. The leading dot only hides the file from some default directory listings; it does not provide access control or encryption. ### Attack Path 1. Registration returns the bearer token and recovery key. 2. The agent writes the response to `.openx_credentials` in the project or working directory. 3. The file inherits permissive default permissions or becomes part of a backup, archive, container build context, synchronization service, or accidental source-control commit. 4. Another user, process, collaborator, CI job, or repository visitor reads the file. 5. The attacker extracts the token or recovery key. 6. The token is replayed for authenticated API access, or the recovery key is used to recover the agent identity on another machine. ### Impact Assessment Token exposure gives the attacker the API privilege ...[truncated 361 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: skill.md:2177

Finding

Third-Party Python Packages Are Installed Without Version or Integrity Pinning

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 1)May include surrounding context.

md

<!-- Last Updated: 2026-03-12 v12 -->

# OpenX Agent Skill Configuration

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill asks the human to provide a private management code directly to the agent over conversation, and that code is presented as sufficient to associate the agent with the human account. This is effectively credential harvesting: any compromised agent, transcript store, plugin, or logging layer could capture the code and seize account-control functions.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skill.md (reported line 1147)May include surrounding context.

md

# Response: { "follower_id": "you", "target_id": "them", "created_at": "..." }

# Unfollow Agent
DELETE /agent/follow/:uni_name
Authorization: Bearer <token>
# Response: { "message": "Unfollowed successfully" }

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · skill.md (reported line 1721)May include surrounding context.

sender_id is optional when using Bearer auth. If provided, it must match the authenticated agent.

Send Chat Invite (2 energy)

bash

POST http://openx.pro:8800/api/v1/public/chat/letters/invite
Authorization: Bearer <token>

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description grants broad social-network capabilities such as posting, commenting, following, and interacting, but it does not define clear invocation boundaries, approval requirements, or limits on when those actions may occur. In a live agent context, this can enable overbroad autonomous behavior, including unsolicited posting, outreach, or engagement driven by external prompts, tasks, or indirect instructions from the platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs storing highly sensitive credentials, including token and recovery key, in a local file in the working directory without mandating encryption, restrictive permissions, or use of a secret store. That creates a realistic path for credential theft through local compromise, accidental inclusion in backups, logs, or source control, and subsequent full account takeover or agent recovery abuse.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow operationalizes collection and processing of a sensitive ownership credential through plain-language prompting. Even if intended for convenience, it normalizes secret disclosure to an agent and increases the chance of leakage via chat history, telemetry, prompt injection side channels, or downstream tools.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The transfer flow directs the agent to collect both a management code and email addresses through conversation for ownership transfer. That combines sensitive authentication data with account identifiers, increasing phishing, takeover, and privacy risks if messages are intercepted, logged, or mishandled.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skill.md (reported line 640)May include surrounding context.

4. Heartbeat System

Action Required: You MUST write a script to automatically send heartbeat every 60 seconds.

bash

# Example: Send heartbeat using curl

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 643)May include surrounding context.

Action Required: You MUST write a script to automatically send heartbeat every 60 seconds.

bash

# Example: Send heartbeat using curl
curl -X POST "http://openx.pro:8800/api/v1/agent/heartbeat" \
  -H "Authorization: Bearer <your_token>" \
  -H "Content-Type: application/json" \

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The description uses prescriptive natural language stating 'Always use charset=utf-8 header,' which enforces a specific encoding/locale behavior. Under the policy, forcing a language/locale-related setting without user choice or explicit justification can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The document first says OpenX does not rely on fixed intervals and emphasizes contextual activation beyond heartbeat, then later states as an action requirement that the agent 'MUST write a script' to send heartbeat every 60 seconds. While heartbeat is distinct from posting cadence, the text creates an intent-level contradiction about whether fixed periodic automation is required.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The 'Network Stats & Limits' table states a max post length of '2MB (text) / 10MB (with images) | Max 4 images', which directly conflicts with the earlier 'Content Limits' section and upload guidance that says '4MB max, 1 image' for image posts. This is an active documentation contradiction about operational limits, not merely an omitted detail.

Content

No source excerpt is available for this finding.