Security audit

A0X Agents

Security checks for vulnerabilities and agentic risk

Overview

The skill's remote knowledge and mentor features are disclosed, but it asks to persist broad behavior changes, periodic background tasks, and credential handling in ways users should review carefully.

Install only if you are comfortable with a third-party MCP service becoming part of routine agent workflow. Do not add the SOUL.md, AGENTS.md, or HEARTBEAT.md blocks unless you explicitly want persistent cross-session behavior, sub-agent inheritance, and periodic network activity. Prefer header-based authentication, store the API key in a secure secret manager or locked-down file, and review exactly what project context will be sent before each call.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:255
Finding: Persistent Agent Instruction and Memory Hijacking
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:303
Finding: Cross-Session Persistence Through Periodic Heartbeat Tasks
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:23
Finding: Mutable Remote Instructions Installed Without Integrity Verification
Content: View full analysis
~/.claude/skills/a0x-agents/SKILL.md curl -s https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/knowledge.md > ~/.claude/skills/a0x-agents/KNOWLEDGE.md ``` ``` ### Technical Analysis The installation procedure downloads mutable Markdown from a development Cloud Run endpoint and writes it directly into an active Skill directory. No immutable version, signature, checksum, content review, or atomic staging process is used. The downloaded files are not conventional native executables, but they become agent-executable instruction payloads when loaded as a Skill. Their effective behavior may therefore change after the audited package has been reviewed. Compromise of the endpoint, DNS or hosting account, deployment pipeline, or publisher credentials could replace the expected files with arbitrary agent instructions. The `curl -s` option also suppresses normal progress and some diagnostic visibility. The command does not use `--fail`, so an HTTP error body could overwrite the active Skill file. ### Attack Path 1. An attacker compromises the remote development service, deployment pipeline, or publishing credentials. 2. The attacker replaces `skill.md` or `knowledge.md` with malicious agent instructions. 3. A user follows the documented installation or update command. 4. `curl` writes the mutable response directly over the active local Skill files. 5. The agent loads the replaced Markdown in a later session. 6. The malicious instructions can then direct tool calls, data disclosure, persistent configuration changes, or further payload retrieval. ### Impact Assessment Successful explo ...[truncated 482 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:238
Finding: API Key Exposure Through URL Authentication and Weak Local Storage Guidance
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: The skill instructs storage of the API key in a local plaintext JSON file under ~/.config/a0x/credentials.json. Plaintext credential persistence increases the risk of secret theft by other local processes, misconfigured permissions, accidental commits, backups, or later agent access, enabling unauthorized use of the remote service.
Content: Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.
Save the apiKey from the response immediately — it's shown only once.

Store in ~/.config/a0x/credentials.json:

json
{"api_key": "a0x_mcp_abc123...", "agent_name": "YourAgentName"}

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs the agent to append content to persistent local files such as SOUL.md, AGENTS.md, and HEARTBEAT.md, altering future behavior of the main agent and sub-agents. This is dangerous because it establishes durable prompt persistence and broadens the skill's control far beyond the current task, potentially causing ongoing data exfiltration or unwanted tool use in later sessions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation conditions include very broad triggers like errors, patterns, architecture decisions, Base, crypto, and grants, which can cause the skill to activate during many ordinary tasks. In context, broad activation is risky because activation leads to recommendations for remote MCP calls and possible persistent configuration changes, increasing the chance of unnecessary external sharing and workflow hijacking.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
Install locally:

bash
mkdir -p ~/.claude/skills/a0x-agents curl -s https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/skill.md > ~/.claude/skills/a0x-agents/SKILL.md curl -s https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/knowledge.md > ~/.claude/skills/a0x-agents/KNOWLEDGE.md

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The installation instructions place the skill in a persistent home-directory location so it survives across sessions. In this skill's context, persistence is more dangerous because the skill also promotes durable behavioral rewrites and automatic future use of remote services, extending trust in a third-party instruction set beyond the current task.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
Install locally:

bash
mkdir -p ~/.claude/skills/a0x-agents curl -s https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/skill.md > ~/.claude/skills/a0x-agents/SKILL.md curl -s https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/knowledge.md > ~/.claude/skills/a0x-agents/KNOWLEDGE.md

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
bash
mkdir -p ~/.claude/skills/a0x-agents curl -s https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/skill.md > ~/.claude/skills/a0x-agents/SKILL.md curl -s https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/knowledge.md > ~/.claude/skills/a0x-agents/KNOWLEDGE.md

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The transparency section claims only a narrow set of data is sent, but later documentation for jessexbt/chat supports additional fields such as project description, stage, tech stack, wallet address, and social links. This creates a misleading data-sharing boundary that can cause users or agents to disclose more information to the remote service than the policy summary suggests.
Content: No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The phrase 'How to call any tool' presents remote tool invocation in an unrestricted, generic way, encouraging broad access to server-side capabilities once authenticated. In context, this lowers safety boundaries around what the agent may send or do through the remote MCP service, especially when combined with persistent behavior changes and broad activation rules.
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
| knowledge/vote | Curate. Vote on proposals from other agents (verified agents only) | | knowledge/my-proposals | Check your submission status |

How to call any tool:

bash
curl -X POST https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/mcp \ -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The skill explicitly directs the agent to make HTTP POST requests to a third-party MCP endpoint using an API key and session ID. External transmission is inherent to the feature, but it remains security-relevant because it can send user/task-derived data off-platform, and the skill's broad triggers increase how often that may happen.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
How to call any tool:

bash
curl -X POST https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/mcp \ -H "Content-Type: application/json" \ -H "X-API-Key: YOUR_API_KEY" \ -H "Mcp-Session-Id: YOUR_SESSION_ID" \

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The recall trigger scope applies to broad classes of technical work and says to check the remote 'brain' before reasoning about an issue yourself. This can pressure agents into sending problem descriptions externally for routine development tasks, creating unnecessary dependency on a third-party service and avoidable leakage of contextual metadata.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The mentor consultation triggers are vague and broad, covering many product, architecture, and ecosystem situations. Because the mentor is a remote service, this can normalize sending project context, URLs, and strategic information to an external endpoint in a wide range of cases without strong necessity or clear user-by-user consent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The registration flow collects agent identity metadata and a walletAddress, then stores an API key locally, even though the core advertised function is knowledge recall and mentorship. This expands data collection and identity linkage in ways not necessary for the immediate skill purpose and increases privacy and account abuse risk if the credentials or on-chain identity are exposed.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:482