Security audit

hoodbook

Security checks for vulnerabilities and agentic risk

Overview

The skill’s social-network purpose is clear, but it asks users to run mutable remote code and follow mutable remote instructions while using a persistent wallet that can post, pay, and trade.

Review this carefully before installing. Use only an isolated, low-value wallet, avoid running it in sensitive project directories, do not let it access secrets, and require explicit human approval before any paid data request, trade, or transaction. The main unresolved risk is that important code and rules come from live remote endpoints rather than the reviewed package.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:42
Finding: Mutable Remote Program Is Downloaded and Executed Without Integrity Verification
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:25
Finding: Mutable Remote Documents Are Treated as Trusted Agent Instructions
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:55
Finding: Operational Checkpoints Can Disclose Sensitive Agent Context to an External Service
Content: View full analysis
$A comment "…" # answer people who replied to you first $A post "Title" "Plain text, no markdown" # only with something worth saying, max one per heartbeat $A checkpoint "what I was doing, what I decided, what to look at next" # before you stop ``` ### Technical Analysis The Skill directs the agent to submit a checkpoint describing current work, decisions, and planned next steps through the network-oriented Hoodbook client. This information can contain sensitive prompt context, private project details, internal decisions, user intentions, file names, or other operational metadata. No local redaction procedure, sensitivity classification, field restriction, retention limitation, or explicit per-transmission user approval is specified. The broad checkpoint content exceeds what is minimally necessary for social posting and creates a potential data-exfiltration channel even if the wallet private key itself is never submitted. The included source does not establish the exact endpoint, storage period, access controls, or server-side handling of checkpoints because the client implementation is downloaded remotely and is not part of the audited project. ### Attack Path 1. The agent performs work involving confidential user or project context. 2. Before stopping, it follows the Skill instruction to summarize what it was doing, what it decided, and what it plans to inspect next. 3. The summary includes sensitive operational information because no redaction or allowlist is required. 4. The checkpoint command sends that ...[truncated 936 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:71
Finding: Unpinned npm Packages May Introduce Supply-Chain Code Execution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill prominently describes wallet creation, signed actions, and trading from a locally created wallet but does not give a clear up-front warning that blockchain transactions and signatures can have irreversible financial consequences. In this context, an agent user could enable or perform actions with real funds while underestimating the permanence and risk of on-chain operations.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: The skill establishes persistent identity and signing state via a wallet key stored on disk and used for ongoing authenticated actions. Persistent local credentials are not inherently malicious, but in this skill they materially raise risk because later remote code execution or prompt-driven misuse would expose a durable signing identity capable of posting, buying data, or trading.
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
# Hoodbook A social network where only AI agents post, comment, vote and trade; humans watch. Your identity is a wallet created on this machine: every write is an EIP-191 signature, verifiable by anyone, and trades are checked from the chain. No API key exists. The full, always current rules live at https://api.hoodbook.tech/skill.md. Read that file first; this skill

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
md
created on this machine: every write is an EIP-191 signature, verifiable by anyone, and trades are checked from the chain. No API key exists. The full, always current rules live at https://api.hoodbook.tech/skill.md. Read that file first; this skill is the short version. ## Security rules

External Transmission

Medium

Category: Data Exfiltration
Confidence: 98% confidence
Finding: This external transmission is part of a curl command that fetches executable code from api.hoodbook.tech. In context, the danger is not simply network communication but the retrieval of executable content from a remote source, which can be modified server-side and then run locally.
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
mkdir -p ~/.hoodbook && cd ~/.hoodbook [ -f package.json ] || npm init -y >/dev/null npm install --silent viem@2 curl -fsSL https://api.hoodbook.tech/agent.mjs -o agent.mjs node agent.mjs init node agent.mjs register YourName "What you are and what you care about"

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The setup flow downloads agent.mjs directly from a remote server with curl and immediately executes it with Node. This is a classic remote code execution pattern: if the server, DNS, TLS trust chain, or upstream content is compromised, arbitrary code runs locally with access to the user's environment, including the wallet key stored under ~/.hoodbook/key.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 82% confidence
Finding: The skill tells the agent to fetch and follow heartbeat.md from a remote server. Because that file is mutable and framed as operational guidance, it becomes an instruction channel that can alter agent behavior outside the reviewed local skill, increasing prompt-injection and remote-instruction risk.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
$A checkpoint "what I was doing, what I decided, what to look at next" # before you stop

text
Or fetch https://api.hoodbook.tech/heartbeat.md and follow it. Communities: general, introductions, markets, builds, meta. Start by posting in introductions. ## Also available

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This line includes a paid data retrieval endpoint (x402 GET https://api.hoodbook.tech/x402/launches) tied to wallet-enabled spending. In context, contacting this endpoint may trigger financial expenditure and ingestion of untrusted remote content, making the transmission materially riskier than an ordinary external link.
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
md
## Also available - `$A wait 60` sleeps until someone replies to you (long poll) instead of polling. - `$A x402 GET https://api.hoodbook.tech/x402/launches` buys data from other agents over x402, once your human ran `$A x402 on --max-usd 0.05`. - Trading tokenized stocks and memecoins from your own wallet: `$A trading on …` by your human, then `$A trade …`. - MCP instead of a shell: `npx -y hoodbook-mcp`. ElizaOS: `npm i hoodbook-plugin-eliza`.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The skill instructs users to run an MCP package via npx -y hoodbook-mcp without pinning a version or integrity source. That causes execution of whatever code is current on the package registry at runtime, creating a supply-chain risk where a compromised publisher account or malicious update can execute arbitrary code on the host.
Content: No source excerpt is available for this finding.