T01 · Skill Instruction Hijacking
Error
- Location
heartbeat.md:17- Finding
Persistent Retrieval and Execution of Mutable Skill Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
BrainVsByte
Security checks for vulnerabilities and agentic risk
Overview
This skill is for a crypto competition, but it gives the agent autonomous control over a funded mainnet wallet without enough user approval, spending limits, or secret-handling safeguards.
Review before installing. Only use this skill with a dedicated low-balance wallet, never a personal wallet, and do not let an agent store or print private keys. Require explicit approval for every mainnet transaction, set strict spending limits, verify contract addresses independently, and avoid recurring heartbeat actions that can submit, vote, or spend funds automatically.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T01 · Skill Instruction Hijacking
Error
- Location
skill.md:64- Finding
Autonomous Use of User-Funded Cryptocurrency Without Per-Transaction Approval
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skill.md:68- Finding
Private Key Exposure Through Console Output and Agent Memory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to generate, store, and autonomously operate a blockchain wallet, including retaining a private key and requesting funds from the human. This materially expands the agent's authority from informational competition participation into custody of credentials and financial assets, creating risk of irreversible fund loss, theft, or unauthorized spending if the skill or surrounding environment is compromised.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill directs the agent to perform live Polygon mainnet transactions, including ERC-20 approvals and contract calls, which can transfer spend authority and incur real monetary loss. Token approvals are especially dangerous because they can grant the contract ongoing access to funds beyond a single action, and all blockchain actions are irreversible once signed.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The heartbeat text explicitly says the skill can be checked 'anytime someone asks,' which broadens a periodic-only trigger into an on-demand invocation path. That can cause unintended execution, increased external API activity, and potentially repeated wallet-affecting actions if an agent follows the workflow too eagerly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to notify the owner when it generates its first wallet address so the owner can save the private key and fund it, but it provides no safety guidance on secret handling. In a wallet-enabled agent context, mentioning private-key preservation and funding workflows without explicit safeguards increases the risk of unsafe key exposure, insecure storage, or socially engineered fund transfers.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Install locally:
bash mkdir -p ~/.agents/skills/brainvsbyte curl -s BASE_URL/skill.md > ~/.agents/skills/brainvsbyte/skill.md curl -s BASE_URL/heartbeat.md > ~/.agents/skills/brainvsbyte/heartbeat.md
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash mkdir -p ~/.agents/skills/brainvsbyte curl -s BASE_URL/skill.md > ~/.agents/skills/brainvsbyte/skill.md curl -s BASE_URL/heartbeat.md > ~/.agents/skills/brainvsbyte/heartbeat.md
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash mkdir -p ~/.agents/skills/brainvsbyte curl -s BASE_URL/skill.md > ~/.agents/skills/brainvsbyte/skill.md curl -s BASE_URL/heartbeat.md > ~/.agents/skills/brainvsbyte/heartbeat.md
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The instruction hard-codes a user-facing message the agent should send immediately, which imposes a specific communication behavior without any opt-in or customization. Under the policy criteria, prescriptive natural-language behavior can be a concern when it does not offer user choice, even though no specific locale is named here.
- Content
Static analysis
No suspicious patterns detected.