WORKFOZ

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:53 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent WorkFoz portal CLI, but it handles account credentials, sessions, and payout details with under-disclosed and weakly scoped security controls.

Review before installing. Use only in a private, trusted workspace; do not run it with an untrusted JOB_PORTAL_URL; avoid putting real passwords or payout details directly in shell commands where history or logs are retained; and delete artifact/.session.json when finished. Treat bids, accept/reject actions, password changes, and payment claims as real account actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: portal-cli.js:5

Finding

Unrestricted API Endpoint Override Can Exfiltrate Credentials and Session Tokens

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: portal-cli.js:6

Finding

Session Credentials Are Persisted in a Plaintext File Without Explicit Access Restrictions

Content

View full analysis

c.split(';')[0]); session.cookie = cookies.join('; '); saveSession(session); } ``` ### Technical Analysis The CLI stores bearer tokens and cookies as plaintext JSON beside the Skill script. `fs.writeFileSync` is called without an explicit restrictive mode, so effective permissions depend on the process umask and preexisting file permissions. The implementation also performs no ownership, regular-file, or symbolic-link validation. If a local attacker can write to the Skill directory, a pre-created `.session.json` symbolic link may redirect the write to another path. More commonly, permissive directory or file permissions may allow another local user or process to read and reuse the token. The Skill does not provide a logout command that securely removes the persisted authentication material. ### Attack Path 1. The victim runs the Skill in a shared or insufficiently protected installation directory. 2. A local attacker reads a permissively created `.session.json`; alternatively, an attacker with dire ...[truncated 1007 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: portal-cli.js:64

Finding

Passwords Are Accepted Through Command-Line Arguments

Content

View full analysis

"); process.exit(1); } const res = await request('login.php', 'POST', { email, password }); ``` The password-update command exposes both the old and new passwords through arguments: ```javascript else if (command === 'update-password') { const session = getSession(); if (!session) return console.log("Please login first."); const oldPass = args[1]; const newPass = args[2]; if (!oldPass || !newPass) { console.log("Usage: update-password "); process.exit(1); } const res = await request('update_password.php', 'POST', { user_id: session.user_id, old_password: oldPass, new_password: newPass, confirm_password: newPass }); ``` The documented interface explicitly instructs users to place passwords on the command line: ```markdown node portal-cli.js login node portal-cli.js update-password ``` ### Technical Analysis Command-line arguments are not a secure secret-input channel. Depending on the operating system and runtime environment, arguments may be visible to local process-inspection tools while the command is executing. Literal commands may also be retained in interactive shell history, terminal logs, CI logs, automation records, monitoring systems, or support transcripts. The update operation is particularly sensitive because one invocation exposes both the current password ...[truncated 1310 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The registration request hardcodes 'g-recaptcha-response': 'test' while the comment indicates production should require a valid reCAPTCHA token. If the backend accepts this value or has any corresponding bypass logic, attackers can automate account creation and abuse the platform at scale, defeating an anti-bot control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The CLI persists session data, including bearer tokens and cookies, to a local .session.json file without any warning, encryption, or visible permission hardening. On multi-user systems or compromised hosts, this can expose reusable authentication material and allow account takeover or unauthorized API actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The register flow sends email and password to a network API, and similar credential-bearing requests occur in login and password update paths. While network access is inherent to a portal CLI, the file lacks any explicit warning or descriptive comment to inform users that sensitive account data will be sent to a remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly states that login saves a local session, but it does not warn users/agents about where credentials or session tokens are stored, how long they persist, or the security implications on shared or persistent environments. In an autonomous-agent setting, silent local persistence can expose authenticated sessions to later tasks, other users on the host, or accidental leakage via logs and workspace artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The claim command requires submitting sensitive payment-routing data such as wallet addresses, but the documentation does not warn that this information may be recorded in command history, shell logs, transcripts, or agent run artifacts. In a skill designed for autonomous execution, prompting for financial payout details without disclosure increases the risk of unintended exposure or irreversible misdirection of funds.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency uses a caret range (^3.3.2), which allows installation of newer compatible versions rather than a single exact version. This can reduce build reproducibility and increase supply-chain risk if a newly published version introduces a vulnerability or malicious code, though by itself it is not evidence of active compromise.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json

"license": "ISC",
  "type": "commonjs",
  "dependencies": {
    "node-fetch": "^3.3.2"
  }
}