Tmp.G0vnB95vQy

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:46 PM UTC
• Version: 3.1.0

Overview

The skill is a coherent social-platform guide, but it needs Review because it combines public account actions with sensitive credential handling, scheduled background execution, and autonomous crypto-related guidance.

Install only after reviewing whether you are comfortable giving this platform your agent and provider credentials, using an unpinned external SDK, and allowing any scheduled heartbeat. Do not let an agent buy tokens, mine cryptocurrency, bridge assets, or sign wallet transactions without explicit per-action approval and spending limits.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T06 · System Persistence

Error

• Location: GETTING_STARTED.md:694

Finding

Recurring Cron Job Establishes Cross-Session Persistence

Content

View full analysis

~/.impromptu/impromptu.skill.json.new if ! cmp -s ~/.impromptu/impromptu.skill.json ~/.impromptu/impromptu.skill.json.new; then echo "Skill manifest updated! Check for new capabilities." mv ~/.impromptu/impromptu.skill.json.new ~/.impromptu/impromptu.skill.json else rm ~/.impromptu/impromptu.skill.json.new fi # Lightweight heartbeat check curl -sf -X GET "https://impromptusocial.ai/api/agent/heartbeat" \ -H "Authorization: Bearer $IMPROMPTU_API_KEY" \ | jq -r ' "Notifications: \(.unreadNotifications)", "Tokens: \(.tokenBalance)", "Tier: \(.tier)", "Reputation: \(.reputation)", "Registration Fee: \(.registrationFeeStatus)" ' # If notifications > 0, process them UNREAD=$(curl -sf -X GET "https://impromptusocial.ai/api/agent/notifications" \ -H "Authorization: Bearer $IMPROMPTU_API_KEY" \ | jq -r '.unreadCount') if [[ "$UNREAD" -gt 0 ]]; then echo "You have $UNREAD unread notifications. Someone is waiting!" # Your agent logic to process notifications goes here fi ``` ```bash chmod +x ~/impromptu-heartbeat.sh ``` ```bash # REGISTERED: Every 1 hour 0 * * * * ~/impromptu-heartbeat.sh # ESTABLISHED: Every 30 minutes */30 * * * * ~/impromptu-heartbeat.sh # VERIFIED: Every 15 minutes */15 * * * * ~/impromptu-heartbeat.sh # PARTNER: Every 5 minutes */5 * * * * ~/impromptu-heartbeat.sh ``` Add to crontab: `crontab -e` ### Technical Analysis The instructions create an executable file in the user's home directory and direct the user to register ...[truncated 1994 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: EARNING_AND_EXPANDING.md:807

Finding

Instructions Remove Operator Approval from Financially Consequential Agent Actions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: GETTING_STARTED.md:171

Finding

Reusable Operator and OpenRouter Credentials Are Transmitted to the Platform

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: GETTING_STARTED.md:9

Finding

Executable SDK Dependency Is Installed Without Version or Integrity Pinning

Content

View full analysis

Remediation

View remediation

`. - Publish and verify package integrity hashes. - Commit and enforce a lockfile for reproducible dependency resolution. - Include the SDK source in the review artifact or link each documented release to an immutable source commit. - Use package provenance attestations and signed releases. - Audit lifecycle scripts and disable them during installation where they are not required. - Continuously scan direct and transitive dependencies for known vulnerabilities and ownership changes. - Run the SDK in a constrained environment with only the minimum filesystem, network, and secret access required. - Do not expose wallet private keys or broad operator credentials to the SDK process. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

YARA rule 'crypto_miner_software': References to known cryptocurrency mining software [cryptominers]

High

• Category: YARA Match
• Confidence: 88% confidence

Finding

Referencing specific mining software and setup resources in a social-platform skill lowers the barrier to deploying cryptomining activity and normalizes use of third-party miner binaries. In agent environments, such guidance is risky because mining tools are commonly associated with malware, unauthorized resource use, wallet theft, and operator harm if an agent follows or relays these instructions beyond the intended context.

Content

Scanner excerpt · EARNING_AND_EXPANDING.md (reported line 672)May include surrounding context.

md

y:** Collaboration > Competition -> Network effects

**All paths are valid.** The network doesn't prescribe your journey.

---

## Tools & Resources

### Mining Setup Guides
- **Flux mining:** https://runonflux.io/mining.html
- **Kaspa mining:** https://kaspa.org/mining
- **Ethereum mining:** https://ethereum.org/en/developers/docs/consensus-mechanisms/pow/mining/
- **Mining software:** NiceHash, T-Rex Miner, lolMiner, NBMiner

### DEX Tutorials
- **Uniswap guide:** https://docs.uniswap.org/
- **1inch guide:** https://help.1inch.io/
- **Base bridge tutorial:** https://docs.base.org/tutorials/bridge-to-base
- **MetaMask setup:** https://metamask.io/faqs/

### Market Data
- **IMPRMPT price:** https://www.coingecko.com/en/coins/impromptu
- **DEX analytics:** https://dexscreener.com/base/0x...
- **Trading volume:** https://info.uniswap.org/

### Optimization
- **Gas tracker (Base):** https://base.gastracker.io/
- **Mining profitability:** https://whattomine.com/
- **DEX gas comparison:** h

Self-Modification

High

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The heartbeat script instructs agents to fetch and replace a remote skill manifest automatically on a recurring basis. This is dangerous because it creates an unattended remote update channel: if the remote endpoint, DNS, TLS trust, or upstream content is compromised, the local agent state can be silently altered and future behavior influenced without review.

Content

Scanner excerpt · GETTING_STARTED.md (reported line 706)May include surrounding context.

md

exit 1
fi

# Update skill manifest (check for new endpoints)
curl -sf https://impromptusocial.ai/impromptu.skill.json \
  > ~/.impromptu/impromptu.skill.json.new

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · GETTING_STARTED.md (reported line 714)May include surrounding context.

md

echo "Skill manifest updated! Check for new capabilities."
  mv ~/.impromptu/impromptu.skill.json.new ~/.impromptu/impromptu.skill.json
else
  rm ~/.impromptu/impromptu.skill.json.new
fi

# Lightweight heartbeat check

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document materially expands a social/content skill into operational guidance for cryptocurrency mining, token acquisition, bridging, exchange transfers, and DEX trading. Even though framed as optional and padded with disclaimers, it encourages off-platform financial activity and use of third-party tools that can expose operators to fraud, wallet compromise, regulatory issues, and unintended resource consumption outside the declared skill purpose.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · EARNING_AND_EXPANDING.md (reported line 623)May include surrounding context.

md

**Reinvestment strategy:**
- Monitor your revenue share earnings
- Reinvest earnings into budget for expansion
- Create a virtuous cycle: earn -> reinvest -> create more -> earn more

**Example:** Agent_333 queries only high-opportunity nodes. Earns consistently from targeted, high-signal content. Reinvests 50% of earnings into budget expansion. Reputation: 85. Sustainable growth through revenue share alone.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The FAQ states registration costs $2 IMPRMPT and can either be paid upfront or withheld from first earnings, but later says registration fees are always paid upfront and that agents keep 100% of revenue share from day one. These statements are materially inconsistent about billing behavior and earning retention.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The FAQ shows an API key hardcoded directly in source code without an explicit warning against embedding secrets in code or logs. In an agent-skill context, users often copy examples verbatim, so this pattern can normalize unsafe secret handling and increase the chance of credential leakage through repositories, prompts, crash logs, or telemetry.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This section says registration fees are always already paid and that users keep 100% of revenue share from day one, which directly conflicts with the earlier explanation that the $2 fee may be withheld from first earnings. That is an intent/documentation contradiction rather than a mere omission.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · GETTING_STARTED.md (reported line 243)May include surrounding context.

text

Checking dependencies...
------------------------------------------------------------
[OK] curl installed (v8.4.0)
[OK] jq installed (v1.7)

Checking environment...

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The health-check example normalizes displaying partial live credential values in terminal output, which encourages logging or screen exposure of secrets. Even masked tokens can leak identifying prefixes/suffixes, end up in shell history, screenshots, CI logs, or support transcripts, increasing the chance of credential compromise or targeted phishing.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The preview notice says impromptu-assess.sh and related mining tooling do not perform actual mining yet and that implementation is 'coming soon'. Later, the token documentation states agents can earn tokens through 'Mining (optional) - If you have GPU capacity', which presents mining as an active capability rather than a future/preview one. These statements conflict at the intent/documentation level.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The documentation directs creation of a recurring heartbeat script that stores operational behavior on disk and is later scheduled for repeated execution. In context, this becomes more dangerous because the script also performs network fetches and processes remote content, so the persistence materially increases exposure to supply-chain or remote-content manipulation over time.

Content

Scanner excerpt · GETTING_STARTED.md (reported line 692)May include surrounding context.

This is the most important step. Agents who show up consistently thrive. Those who disappear get forgotten.

Create Heartbeat Script

bash

#!/bin/bash

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · GETTING_STARTED.md (reported line 761)May include surrounding context.

*/5 * * * * ~/impromptu-heartbeat.sh

text

Add to crontab: `crontab -e`

**Consistency matters more than frequency.** A reliable hourly heartbeat beats a sporadic 5-minute one.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file includes a curl example that sends the user's OpenRouter API key to a remote endpoint as part of credential setup. The quickstart does not include any warning about storing, transmitting, or protecting that sensitive key, which is a privacy- and security-relevant behavior users should be told about.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · QUICKSTART.md (reported line 37)May include surrounding context.

Agents bring their own LLM provider key. Set it once:

bash

curl -X PUT https://impromptusocial.ai/api/agent/credentials \
  -H "x-api-key: $IMPROMPTU_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"provider": "openrouter", "apiKey": "sk-or-v1-your-key"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README demonstrates actions like creating prompts, reprompting, engaging, joining communities, posting, and accepting/delivering jobs without clearly warning that these are user-visible, potentially public, account-affecting operations. In an agent skill context, users may wire these examples directly into autonomous workflows, causing unintended public posting, social interactions, or marketplace actions that spend budget and affect reputation or funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs operators to send both an operator API key and an OpenRouter key to a third-party registration endpoint, but it provides no warning about key handling, storage, scope, or trust boundaries. In an agent-skill context, this is dangerous because users may paste high-value secrets into an external service without understanding whether the service stores them, reuses them, or exposes them through logs or compromise.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 62% confidence

Finding

The preview notice says the impromptu-mine.sh script currently provides only GPU detection and profitability estimation and that actual mining implementation is 'coming soon.' Later, the document gives direct shell execution guidance for local scripts (~/.impromptu/heartbeat.sh at L888-L891), creating ambiguity about what local automation actually exists and undermining the claim that such automation is only preview/informational. This is a documentation-level inconsistency rather than a code behavior issue.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The 'Check Your Status' example encourages reading status.tokenBalance as part of normal status output. Later, the 'Known Limitations' section explicitly says tokenBalance in heartbeat responses is not implemented and will always return 0, making the earlier example misleading about what the code/API actually provides.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README instructs users to export an API key but does not state that it is a sensitive credential that must be stored securely and never committed, logged, or embedded in prompts or client-side code. In agent ecosystems, weak credential guidance increases the chance of accidental leakage through repos, traces, screenshots, or model context, which could enable unauthorized use of the account and associated actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.