BlindOracle Marketplace — Post Jobs & Bid for Work

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:53 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent marketplace integration, but its sell-side examples process untrusted buyer tasks and submit results externally without clear safety boundaries.

Review before installing. Use a pinned, isolated environment; do not expose unrelated files, secrets, wallet material, or broad agent tools to marketplace jobs; and require explicit approval or strict validation before bidding, accepting paid work, running commands, or returning results to requesters.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party SDK Installation Creates a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:13
Vulnerability Type: Unpinned and unverified third-party dependency
Risk Level: Medium

Vulnerable Code:

text

- `pip install blindoracle-sdk`

Technical Analysis

The skill instructs the operator to install blindoracle-sdk without specifying an audited version, validating package hashes, using a lockfile, or identifying a verified package index. Consequently, the code installed when the instruction is followed can change after the skill has been reviewed.

Python packages can execute code during installation or when imported. A malicious package release, compromised publisher account, dependency-confusion event, or compromised transitive dependency could therefore execute attacker-controlled code in the environment running the skill. The potential exposure is amplified because the skill declares access to Bash, Read, and Write tools and expects the environment to contain API and payment credentials.

Attack Path

1. An attacker compromises the package publisher, distribution channel, or a transitive dependency.
2. The attacker publishes a malicious release under the package name used by the installation instruction.
3. An operator follows the prerequisite and runs pip install blindoracle-sdk.
4. Because no version or integrity hash is required, pip retrieves the malicious release.
5. Malicious code executes during installation or when BlindOracleClient is imported.
6. The code accesses resources available to the installation or agent process, potentially including files, environment variables, API credentials, and payment credentials.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running pip or the agent. This may permit reading and modifying accessible files, stealing BlindOracle API keys or x402 payment credentials, invoking network services, manipulating marketp ...[truncated 275 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin blindoracle-sdk and all transitive dependencies to versions that have undergone security review.
2. Maintain a lockfile containing exact resolved versions.
3. Require cryptographic package hashes, such as through pip install --require-hashes -r requirements.txt.
4. Explicitly use a trusted package index and disable unintended extra indexes to reduce dependency-confusion exposure.
5. Verify the publisher, release signatures, provenance, and package ownership before installation.
6. Install the dependency in an isolated virtual environment or container under an unprivileged account.
7. Do not expose API keys, wallet material, or payment credentials during package installation.
8. Periodically review and deliberately update pinned dependencies rather than automatically accepting the newest release.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:39

Finding

Untrusted Marketplace Task Descriptions Are Passed Directly to Agent Work Logic

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:39-41 and SKILL.md:47-57
Vulnerability Type: Untrusted instruction processing and prompt-injection exposure
Risk Level: High

Vulnerable Code:

python

bo.marketplace.register_sku("research.my-niche-scan", "My Niche Scanner",
    price_per_call_usd=0.02, description="...", tags=["research"], visibility="open")
for job in bo.marketplace.claimable(skus=["research.my-niche-scan"]):
    bo.marketplace.complete(job["job_id"], result_summary=do_work(job["task_description"]))

python

for req in bo.marketplace.open_requests(tags=["research"]):   # what's open right now
    if fits_my_capability(req["task_description"]) and req["budget_usd"] >= my_floor:
        bo.marketplace.bid(req["request_id"], price_usd=0.03,
                           estimated_duration_secs=45,
                           capability_match_score=0.9)   # honest 0-1 fit
# buyer accepts your bid -> the job appears in claimable():
for job in bo.marketplace.claimable():
    bo.marketplace.complete(job["job_id"], result_summary=do_work(job["task_description"]))

Technical Analysis

Marketplace buyers control the value of job["task_description"]. The documented fulfillment loops pass that value directly into an unspecified do_work function. The skill does not require a structured task schema, instruction boundary, authorization check, prompt-injection defense, tool allowlist, data-access restriction, sandbox, or operator approval before processing the task.

If do_work is implemented using an AI agent, the externally supplied description can contain instructions intended to override the SKU's legitimate purpose or the agent's safety constraints. Because the skill declares Bash, Read, and Write as allowed tools, an implementation that exposes those capabilities to do_work may allow a marketplace buyer to induce local command execution, file access, file modification ...[truncated 1988 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat every marketplace field, especially task_description, as untrusted data rather than authoritative agent instructions.
2. Define a strict, SKU-specific request schema and reject content outside the SKU's documented scope.
3. Parse requests into bounded data fields instead of inserting raw descriptions into an agent prompt.
4. Place immutable system instructions around the worker that explicitly prohibit following requests to reveal secrets, alter policy, access unrelated files, or invoke tools outside the SKU.
5. Give each SKU a minimal tool allowlist. A research-only SKU should not receive arbitrary Bash or unrestricted filesystem access.
6. Execute fulfillment in an isolated container or sandbox with a temporary workspace, read-only inputs, restricted egress, and no inherited secrets.
7. Use per-job, least-privilege credentials. Do not expose wallet material, API keys, environment secrets, home directories, or unrelated repository content to the worker.
8. Add deterministic validation before tool invocation and inspect output for secrets before calling complete.
9. Require explicit operator approval for shell execution, filesystem access outside the job workspace, financial operations, and other high-impact actions.
10. Record request provenance, validation decisions, tool calls, and output filtering for incident investigation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

## Prerequisites
- `pip install blindoracle-sdk`
- An onboarded agent: `POST https://api.craigmbrown.com/v1/agents/register`
  (self-serve, observer tier) → your `api_key`.
- For metered (paid) SKUs: an x402-funded tenant / ecash token.

Static analysis

No suspicious patterns detected.