Agent Flight Recorder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:27 AM UTC
• Version: 1.0.0

Overview

The skill’s proof-registration purpose is coherent, but it ships and persists Cryptowerk API credentials in the skill directory in a way users should review before installing.

Install only if you are comfortable with this skill contacting Cryptowerk’s external API and storing proof metadata locally. Before use, treat the bundled cwconfig.json values as exposed credentials, prefer user-provided or secret-manager credentials, keep any credential file out of synced or committed directories, and restrict its filesystem permissions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: cwconfig.json:1

Finding

Hardcoded Cryptowerk Service Credentials Distributed with the Skill

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cwcommon.py:99

Finding

Issued Credentials Are Persisted Without Enforced Restrictive File Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The guidance recommends storing credentials in the skill directory and only briefly mentions restricting permissions, but it does not clearly warn that local skill directories may be copied, synced, committed, or exposed to other users/processes. In a security-focused audit/proof skill, mishandling API credentials could let an attacker access proof services, register or query data under the user's account, or pivot into broader service abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This function performs outbound API requests, including with API keys, without any visible user-facing disclosure or consent mechanism in the file. In an agent setting, silent network access can expose workflow metadata, trigger account actions, and violate user expectations about when external services are contacted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code stores issued API credentials in a local JSON configuration file without any warning, consent, or filesystem protection measures shown here. Persisting secrets silently increases the risk of later compromise through local file disclosure, accidental check-in, multi-user access, or reuse by other processes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code contains a built-in bootstrap API key and uses it to automatically request and persist service credentials in cwconfig.json. Even if intended for convenience, embedding a provisioning secret in distributable skill code expands trust beyond proof-only operations and allows anyone with the code to obtain or refresh credentials, creating unauthorized service access and credential leakage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The download helper fetches remote content over HTTPS and writes it directly to a caller-specified file path with no user-facing warning and no integrity validation. In an agent ecosystem, silent remote file writes can be abused for payload staging, overwriting local artifacts, or planting misleading audit material, especially given this skill's trust-sensitive 'verifiable data' context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script computes a hash of a user-supplied file and sends that file-derived value to a remote service via apiRequest("register", ...), but the code provides no explicit user-facing disclosure, consent prompt, or confirmation at the point of transmission. Even though only the hash is sent rather than raw file contents, hashes of sensitive or low-entropy documents can still enable correlation, existence checks, and privacy leakage, and the skill context explicitly involves external proof registration, making silent transmission a real security/privacy concern rather than a false positive.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 12)May include surrounding context.

text

permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Although autoUpdate() currently returns immediately, the file still includes an active helper that can download arbitrary remote content and write it directly to disk. Retaining dormant update/download primitives in an agent skill increases the attack surface because later code changes, reuse from other modules, or prompt-driven invocation could enable unverified remote file writes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This Python code makes an API request to the external service via apiRequest using a retrievalId derived from file metadata, but the script provides no print, comment, docstring, or confirmation indicating that data will be sent over the network. For code files, network transmission without any visible disclosure in the file is in scope unless the warning is otherwise documented; no such warning is visible here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.