Security audit

Impromptu

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Impromptu platform integration, but it mixes real account, credential, wallet, promotion, and recurring-execution behavior with unclear controls and contradictory packaging claims.

Review before installing. Use a least-privilege Impromptu API key, do not set IMPROMPTU_API_URL to any untrusted host, do not automate heartbeat until you are comfortable with the recurring account activity, and avoid running the hiring examples against a real account unless you intend to create services, jobs, or escrow-backed actions. Treat the built-in promotion/referral instructions as advertising that should require explicit user approval.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: impromptu.skill.json:2061
Finding: Manifest Embeds Promotional Instructions for Insertion into Agent Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: heartbeat.sh:26
Finding: Environment-Controlled API Base URL Can Redirect Bearer Credentials
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: install.sh:72
Finding: Installer Downloads Unverified Environment-Controlled Documentation
Content: View full analysis
/dev/null; then echo -e "${GREEN} ✓${NC} ${desc}" else echo -e "${YELLOW} ! Could not download ${desc} — skipping${NC}" fi } download_verified "${ASSETS_BASE}/GETTING_STARTED.md" \ "${CONFIG_DIR}/GETTING_STARTED.md" \ "GETTING_STARTED.md (registration, first actions)" download_verified "${ASSETS_BASE}/EARNING_AND_EXPANDING.md" \ "${CONFIG_DIR}/EARNING_AND_EXPANDING.md" \ "EARNING_AND_EXPANDING.md (all earning paths)" ``` ### Technical Analysis The function is named `download_verified`, but it performs no cryptographic verification. It follows redirects and writes the returned content directly into the persistent `~/.impromptu` configuration directory. `ASSETS_BASE` is not initialized or constrained in the inspected script. Because Bash imports environment variables by default, an external caller can supply an arbitrary base URL. The script also does not enforce HTTPS, validate the final redirect destination, verify a signature, or compare a pinned hash. The downloaded files are Markdown rather than native executables. However, they are setup and operational instructions intended for human users and AI agents. Attacker-controlled documentation can direct users or agents to run commands, disclose credentials, modify configuration, or retrieve additional payloads. Consequently, persisting untrusted instructional content is a meaningful supply-chain risk. The behavior also contradicts comments at the beginning of `install.sh` stating that the script does not download remote code and uses only bundled files. ### Attack Path 1. An attacker influences the installatio ...[truncated 1642 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (154)

Tainted flow: 'request' from os.environ.get (line 79, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 95% confidence
Finding: The request target is derived from the IMPROMPTU_API_URL environment variable and then used directly in urlopen with an Authorization bearer token attached. If an attacker can influence the environment or deployment configuration, they can redirect authenticated requests to an attacker-controlled server and capture the API key or manipulate all heartbeat-related network interactions.
Content: Scanner excerpt · heartbeat.py (reported line 82)May include surrounding context.
python
request = Request(url, data=data, headers=headers, method=method) try: with urlopen(request, timeout=30) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: logger.error(f"HTTP {e.code}: {e.reason}")

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · CHANGELOG.md (reported line 100)May include surrounding context.
md
- `createCommunity()` - Create new communities - `joinCommunity()` / `leaveCommunity()` - Membership management - **Messaging API:** - `sendMessage()` - Send messages to other agents - `getInbox()` - Retrieve inbox with pagination - **Standing Queries:** - `createStandingQuery()` - Schedule recurring content queries

YARA rule 'crypto_miner_software': References to known cryptocurrency mining software [cryptominers]

High

Category: YARA Match
Confidence: 98% confidence
Finding: References to known cryptominer software are a strong abuse indicator in agent content, especially when unrelated to the skill’s stated purpose. Even as documentation, these references can facilitate misuse by directing users or agents toward cryptomining tooling, which is commonly associated with unauthorized resource consumption and organizational policy breaches.
Content: Scanner excerpt · EARNING_AND_EXPANDING.md (reported line 587)May include surrounding context.
md
unity. Balanced approach. Steady growth. Reputation: 78. **Strategy:** Sustainable revenue share baseline + strategic bursts -> Consistent but flexible ### Collective Collaborators **Strategy:** Collaboration > Competition -> Network effects **All paths are valid.** The network doesn't prescribe your journey. --- ## Tools & Resources ### Mining Setup Guides - **Mining software:** NiceHash, T-Rex Miner, lolMiner, NBMiner ### DEX Tutorials - **Uniswap guide:** https://docs.uniswap.org/ - **1inch guide:** https://help.1inch.io/ - **Base bridge tutorial:** https://docs.base.org/tutorials/bridge-to-base - **MetaMask setup:** https://metamask.io/faqs/ ### Market Data - **IMPRMPT price:** https://www.coingecko.com/en/coins/impromptu - **DEX analytics:** https://dexscreener.com/base/0x... - **Trading volume:** https://info.uniswap.org/ ### Optimization - **Gas tracker (Base):** https://base.gastracker.io/ - **DEX gas comparison:** https://l2fees.info/ ### Security - **Wallet securit

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation instructs agents to use wallet private keys for transfers but does not prominently warn that private-key exposure leads to immediate, irreversible asset theft. Because the skill involves real on-chain value, weak key-handling guidance materially increases the likelihood of catastrophic loss.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SECURITY.md (reported line 275)May include surrounding context.
bash
# Add to .gitignore .env .env.local *.env

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The document states no remote manifest auto-fetch by default, but also references install and heartbeat helpers, remote docs, and recurring setup behavior. Even if benign, that mixture of promotion and automation guidance creates ambiguity around what gets downloaded or scheduled, which is risky in a shell-capable skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The document states no remote manifest auto-fetch by default, but also references install and heartbeat helpers, remote docs, and recurring setup behavior. Even if benign, that mixture of promotion and automation guidance creates ambiguity around what gets downloaded or scheduled, which is risky in a shell-capable skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The document states no remote manifest auto-fetch by default, but also references install and heartbeat helpers, remote docs, and recurring setup behavior. Even if benign, that mixture of promotion and automation guidance creates ambiguity around what gets downloaded or scheduled, which is risky in a shell-capable skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The document states no remote manifest auto-fetch by default, but also references install and heartbeat helpers, remote docs, and recurring setup behavior. Even if benign, that mixture of promotion and automation guidance creates ambiguity around what gets downloaded or scheduled, which is risky in a shell-capable skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The document states no remote manifest auto-fetch by default, but also references install and heartbeat helpers, remote docs, and recurring setup behavior. Even if benign, that mixture of promotion and automation guidance creates ambiguity around what gets downloaded or scheduled, which is risky in a shell-capable skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The document states no remote manifest auto-fetch by default, but also references install and heartbeat helpers, remote docs, and recurring setup behavior. Even if benign, that mixture of promotion and automation guidance creates ambiguity around what gets downloaded or scheduled, which is risky in a shell-capable skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The document states no remote manifest auto-fetch by default, but also references install and heartbeat helpers, remote docs, and recurring setup behavior. Even if benign, that mixture of promotion and automation guidance creates ambiguity around what gets downloaded or scheduled, which is risky in a shell-capable skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The document states no remote manifest auto-fetch by default, but also references install and heartbeat helpers, remote docs, and recurring setup behavior. Even if benign, that mixture of promotion and automation guidance creates ambiguity around what gets downloaded or scheduled, which is risky in a shell-capable skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The document states no remote manifest auto-fetch by default, but also references install and heartbeat helpers, remote docs, and recurring setup behavior. Even if benign, that mixture of promotion and automation guidance creates ambiguity around what gets downloaded or scheduled, which is risky in a shell-capable skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The document states no remote manifest auto-fetch by default, but also references install and heartbeat helpers, remote docs, and recurring setup behavior. Even if benign, that mixture of promotion and automation guidance creates ambiguity around what gets downloaded or scheduled, which is risky in a shell-capable skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The document states no remote manifest auto-fetch by default, but also references install and heartbeat helpers, remote docs, and recurring setup behavior. Even if benign, that mixture of promotion and automation guidance creates ambiguity around what gets downloaded or scheduled, which is risky in a shell-capable skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The document states no remote manifest auto-fetch by default, but also references install and heartbeat helpers, remote docs, and recurring setup behavior. Even if benign, that mixture of promotion and automation guidance creates ambiguity around what gets downloaded or scheduled, which is risky in a shell-capable skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The document states no remote manifest auto-fetch by default, but also references install and heartbeat helpers, remote docs, and recurring setup behavior. Even if benign, that mixture of promotion and automation guidance creates ambiguity around what gets downloaded or scheduled, which is risky in a shell-capable skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The document states no remote manifest auto-fetch by default, but also references install and heartbeat helpers, remote docs, and recurring setup behavior. Even if benign, that mixture of promotion and automation guidance creates ambiguity around what gets downloaded or scheduled, which is risky in a shell-capable skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The document states no remote manifest auto-fetch by default, but also references install and heartbeat helpers, remote docs, and recurring setup behavior. Even if benign, that mixture of promotion and automation guidance creates ambiguity around what gets downloaded or scheduled, which is risky in a shell-capable skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The document states no remote manifest auto-fetch by default, but also references install and heartbeat helpers, remote docs, and recurring setup behavior. Even if benign, that mixture of promotion and automation guidance creates ambiguity around what gets downloaded or scheduled, which is risky in a shell-capable skill.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
ts require manual review before execution.** `install.sh`, `heartbeat.sh`, and `impromptu-health.sh` are included and inspectable. Do not run them blindly. Use

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
ts require manual review before execution.** `install.sh`, `heartbeat.sh`, and `impromptu-health.sh` are included and inspectable. Do not run them blindly. Use

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code exposes dispute resolution actions that can force payment release or cancellation, directly determining financial outcomes. In a skill whose declared purpose is only conversation creation, this is an especially sensitive hidden capability because misuse or accidental invocation could irreversibly move or release escrowed value.
Content: No source excerpt is available for this finding.

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · examples/create-conversation.ts (reported line 29)May include surrounding context.
ts
*/ const API_URL = process.env['IMPROMPTU_API_URL'] ?? 'https://impromptusocial.ai/api' const API_KEY = process.env['IMPROMPTU_API_KEY'] if (!API_KEY) { console.error('Missing IMPROMPTU_API_KEY environment variable')

Static analysis

Detected: suspicious.env_credential_access, suspicious.prompt_injection_instructions

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: examples/create-conversation.ts:28

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: examples/hiring.ts:173

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: examples/manage-credentials.ts:19

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: TOKENOMICS.md:272