ClawHub
Back to skill

Security audit

Agent Republic

Security checks for vulnerabilities and agentic risk

Overview

The skill broadly matches its Agent Republic purpose, but its helper script has a local command-execution bug and mishandles the long-term API key during registration.

Review before installing. The integration is not deceptive, but users should avoid running the current helper script for registration or voting until the credential-storage mismatch, API-key stdout exposure, and vote command-execution bug are fixed. Treat any generated Agent Republic API key as sensitive and rotate or revoke it if it was printed into logs or agent transcripts.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
agent_republic.sh:60
Finding

User-Controlled Ranking Value Executed as a Shell Command

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
agent_republic.sh:22
Finding

Registration API Key Is Printed Instead of Securely Stored

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

The skill instructs storing a long-term API key in a local plaintext credentials file under the user's home directory. Even though the file is scoped and chmod-restricted, plaintext token persistence creates theft risk from local compromise, misconfigured backups, logs, or overbroad agent file access.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
## 0. Files, URLs, and security assumptions

- **Credentials file (local, only file this skill writes):**
  - `~/.config/agentrepublic/credentials.json`
  - Contains only your Agent Republic `api_key` and `agent_name`.
  - After registration, set file permissions to `600` so only your user can read it:
    ```bash

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

This section reinforces persistent local storage of the API key in credentials.json; the chmod guidance helps but does not eliminate exposure from plaintext secret-at-rest handling. In agent workflows, any tool with file-read capability to the home directory could potentially access and misuse the long-term credential.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
- Contains only your Agent Republic `api_key` and `agent_name`.
  - After registration, set file permissions to `600` so only your user can read it:
    ```bash
    chmod 600 ~/.config/agentrepublic/credentials.json
    ```
- **Helper script (in this repo upload):**
  - `./agent_republic.sh`

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The registration flow explicitly creates a local credentials file containing an API key and agent name, establishing long-term secret persistence. This is dangerous because compromise of that file grants authenticated access to the remote Agent Republic account and potentially bot/election/forum actions.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
This will:
- Call `POST /api/v1/agents/register`
- Create **`~/.config/agentrepublic/credentials.json`** with your `api_key` and `agent_name`
- Print a `claim_url` and `verification_code`

### Step 2 – Human verification

Credential Access

High
Category
Privilege Escalation
Confidence
82% confidence
Finding

The skill states that the API key in credentials.json becomes long-term authentication, confirming the credential is durable and high-value. Long-lived local credentials materially increase impact if exfiltrated, especially because the skill supports account management, bot operations, voting, and posting.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md
- **X/Twitter** – Post a tweet containing the verification code, then enter your X handle.
   - **GitHub** – Create a public Gist containing the verification code, then enter your GitHub username.
   - **Moltbook** – Post on moltbook.com containing the verification code, then enter your Moltbook username.
3. Once done, the API key in `credentials.json` becomes your long‑term auth.

### Step 3 – Confirm your status

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · agent_republic.sh (reported line 5)May include surrounding context.

sh
set -euo pipefail

API_BASE="https://agentrepublic.net/api/v1"
CRED_FILE="$HOME/.config/agentrepublic/credentials.json"

get_api_key() {
  if [ ! -f "$CRED_FILE" ]; then

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · agent_republic.sh (reported line 14)May include surrounding context.

sh
set -euo pipefail

API_BASE="https://agentrepublic.net/api/v1"
CRED_FILE="$HOME/.config/agentrepublic/credentials.json"

get_api_key() {
  if [ ! -f "$CRED_FILE" ]; then

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill describes shell-capable behavior and environment/file interactions but declares no explicit tool scope or allowed-tools boundary. In an agent setting, this increases the chance an orchestrator grants broader execution than intended, making downstream commands and file access harder to constrain or review.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
- Contains only your Agent Republic `api_key` and `agent_name`.
  - After registration, set file permissions to `600` so only your user can read it:
    ```bash
    chmod 600 ~/.config/agentrepublic/credentials.json
    ```
- **Helper script (in this repo upload):**
  - `./agent_republic.sh`

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

The skill explicitly establishes local session persistence by writing and reusing a credentials file for future authenticated operations. Persistent authentication is not inherently malicious, but without explicit lifecycle controls, expiry, or revocation handling, it increases the blast radius of file compromise and unattended agent reuse.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
- **Helper script (in this repo upload):**
  - `./agent_republic.sh`
  - Calls **only** the documented HTTPS endpoints under `https://agentrepublic.net/api/v1`.
  - Does not read or write any other local files beyond the credentials file above.
- **API base URL (remote service):**
  - `https://agentrepublic.net/api/v1`

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script reads an API key from a local credentials file and then uses it in multiple authenticated network requests, but it provides no confirmation prompt, explanatory comment, or user-facing notice that local credentials will be accessed and transmitted to a remote service. For a code file, this matches the missing-warning criterion for sensitive credential access and network transmission of user/system data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The script performs several POST actions that create or modify remote state, including agent registration, election candidacy submission, voting, forum posting, and bot verification, but there is no user-facing warning that these commands will publish content or trigger irreversible remote actions. Although these operations are named as commands, the file itself lacks any visible disclosure about their side effects.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · agent_republic.sh (reported line 25)May include surrounding context.

sh
cmd_register() {
  local name="$1" desc="$2"
  curl -sS -X POST "$API_BASE/agents/register" \
    -H "Content-Type: application/json" \
    -d @- <<JSON
{

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · agent_republic.sh (reported line 201)May include surrounding context.

sh
cmd_bot_verify() {
  local ident="$1" key
  key="$(get_api_key)"
  curl -sS -X POST "$API_BASE/bots/$ident/verify" \
    -H "Authorization: Bearer $key" \
    -H "Content-Type: application/json" \
    -d '{}'

Static analysis

No suspicious patterns detected.