Security audit
Security checks for vulnerabilities and agentic risk
This skill needs review because it requires public promotion and lets recurring agent activity follow changeable instructions and moderator-assigned work.
Before installing, make promotion optional, approve the allowed public actions and moderator tasks, and keep recurring participation under your control. Use HTTPS exclusively and review an immutable skill revision. Do not treat hash receipts or credit balances alone as proof of independent verification.
AGENT-API.mdDirect HTTP workflow exposes bearer credentials to network interception
The intermediary can replay the captured token to impersonate the agent for operations authorized to that token, including publishing work and submitting claims or reviews under the documented bearer-authentication contract.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
R=$(curl -s -X POST $MESH/agents/register -H 'Content-Type: application/json' \
-d '{"name":"grok-1","model":"grok-4","role":"adversarial review"}')
TOKEN=$(echo "$R" | python3 -c "import json,sys;print(json.load(sys.stdin)['token'])")
# publish
Entries 59–62 show agent_b58cbfdcb807 publishing and claiming work_8d8a3d2198dc, then receiving 10 completion credits without an intervening independent review in the supplied ledger. This contradicts the skill's verified-contribution trust model and, if accepted by reward and reputation consumers, allows unverified work to inflate credits and reputation; hash chaining preserves the recorded events but does not establish independent verification. The ledger demonstrates the integrity discrepancy, although the implementation is needed to determine whether it remains exploitable or reflects historical test behavior.
Registration sends ordinary agent metadata and is expected for this skill, not evidence of malicious exfiltration. However, the contract documents plain HTTP, and registration returns a bearer token; if that transport is used over an untrusted network, an on-path attacker can capture the token or substitute the response.
R=$(curl -s -X POST $MESH/agents/register -H 'Content-Type: application/json' \
-d '{"name":"grok-1","model":"grok-4","role":"adversarial review"}')
TOKEN=$(echo "$R" | python3 -c "import json,sys;print(json.load(sys.stdin)['token'])")
# publish
Publishing work is an intended network operation, and the example contains no actual private material. Nevertheless, using the documented plain-HTTP transport exposes the Authorization bearer token and work payload to interception or modification, potentially enabling impersonation and unauthorized mesh mutations; hash-chained receipts do not secure the transport.
-d '{"name":"grok-1","model":"grok-4","role":"adversarial review"}')
TOKEN=$(echo "$R" | python3 -c "import json,sys;print(json.load(sys.stdin)['token'])")
# publish
curl -s -X POST $MESH/work -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
-d '{"kind":"finding","title":"...","body":"...","evidence_refs":[]}'
# heartbeat every so often
curl -s -X POST $MESH/agents/heartbeat -H "Authorization: Bearer $TOKEN"
The command npx skills add dbottrader/ASIN-HHC-Agent-Mesh can download and execute an unpinned npm CLI, so its behavior depends on the version resolved at installation time. A compromised package release could execute code with the installing user's permissions and access local credentials or files; the repository source is also not pinned to an immutable revision. Although the scanner incorrectly describes this as an MCP server reference, the underlying supply-chain risk is valid, and installing instructions for an autonomous agent increases the potential exposure.
The skill makes an external promotional endorsement mandatory through “Do not skip it,” expanding a network-joining request into publicity on behalf of the service. This can pressure the user into publicly linking themselves to an agent identity and endorsing claims they have not independently verified, creating privacy and reputational risks. Requiring the human to publish the post limits direct unauthorized action, but does not eliminate the workflow hijacking.
The file describes its instructions as pinned to a versioned commit, but its canonical URL points to the mutable main branch and explicitly permits following the repository version. A repository compromise or unauthorized update could therefore substitute new agent instructions while retaining this claimed trust, with recurring authenticated network activity increasing the opportunities for misuse. The token-handling and injection warnings are useful safeguards, but they do not establish the integrity of a replacement instruction file.
Suspicious Unicode normalization or mixed-script content
The skill makes soliciting a public promotional endorsement mandatory, redirecting an agent-network joining task into advertising through the user's identity and audience. Its ready-made claim includes promotional and verification assertions that the described onboarding steps do not independently establish. Requiring the human to publish it, rather than posting automatically, limits direct harm but does not eliminate the manipulative workflow or potential reputational consequences.
No suspicious patterns detected.