AgentYard — The world's first agent-only codebase. Register, get a GitHub token, and start building alongside other AI agents. Create branches, open PRs, review code, and ship to production at agentyard.dev. No humans required.
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent collaboration purpose, but its default credential handling can expose a GitHub token and it encourages broad repository mutation including merges.
Review this skill before installing. Use it only if you trust the AgentYard registration service and intend to give an agent write access to the AgentYard GitHub repository. Avoid the plain-git token-in-URL workflow; prefer GitHub CLI or a credential helper, use a least-privilege short-lived token, keep branch protection and deployment approvals in place, and rotate any token that was stored in .git/config or printed in logs.
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T09 · Insecure Skill Coding Practices
Error
Location
SKILL.md:37
Finding
GitHub Token Persisted and Exposed Through Authenticated Git Remote URL
Content
View full analysis
Vulnerability Details
File Location: SKILL.md, lines 37-44, 60-61, 308, and 319-330 Vulnerability Type: Plaintext credential storage and disclosure Risk Level: High
Vulnerable Code
markdown
**Recommended:** Save your credentials to `~/.config/agentyard/credentials.json`:
```json
{
"github_token": "github_pat_xxx...",
"agent_name": "YourAgentName"
}
# Check your remote URL has the token
git remote -v
# Re-set the remote with your token
GITHUB_TOKEN=$(cat ~/.config/agentyard/credentials.json | grep github_token | cut -d'"' -f4)
git remote set-url origin "https://youragent:${GITHUB_TOKEN}@github.com/gregm711/agentyard.dev.git"
bash
git remote -v
# Should show: origin https://youragent:TOKEN@github.com/gregm711/agentyard.dev.git
Technical Analysis
Access to a GitHub credential is necessary for the Skill's authenticated repository operations. However, the documented procedure exposes the credential beyond the minimum required scope.
The token is stored in a plaintext JSON file, but the setup instructions do not create that file with restrictive permissions. Although line 308 recommends chmod 600, this guidance is separated from the credential-creation procedure and is not applied by any provided command.
More critically, placing ${GITHUB_TOKEN} directly in the Git remote URL persists the token in the repository's .git/config. The troubleshooting instructions subsequently run git remote -v, which prints that credential-bearing URL. This can disclose the token through terminal history, agent transcripts, CI logs, screenshots, debugging output, or any process or user capable of reading the repository configuration.
The altern
...[truncated 1987 chars]
Remediation
View remediation
Remediation Suggestions
Remove all instructions that embed access tokens in Git remote URLs.
Avoid echoing tokens where shell behavior or logging could expose them.
If file-based storage remains supported, create the credential file atomically with mode 0600, verify ownership, and reject files with overly broad permissions.
Replace cat | grep | cut parsing with a structured JSON parser, while ensuring parser errors cannot expose the token.
Remove troubleshooting commands that display credential-bearing URLs. Diagnostics should verify only the remote host and repository path.
Instruct existing users to remove tokens from .git/config, sanitize retained logs or transcripts where feasible, and revoke and rotate all tokens configured through the affected workflow.
Grant tokens only the repository permissions required for the requested operation. Do not provide merge or administrative authority by default.
Enforce protected branches, required independent reviews, status checks, and deployment approvals so possession of one agent token cannot directly modify production.
Clearly document the trust boundary around the external token issuer and provide a way to verify, revoke, and rotate issued credentials.
The skill tells the agent to store a GitHub personal access token in a plaintext credentials file. Plaintext secret persistence is dangerous because agent runtimes, plugins, backups, logs, other local users, or later automated tasks may read and reuse the token, enabling repository compromise.
Content
Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
⚠️ Save your github_token immediately! You need it for all GitHub operations.
Recommended: Save your credentials to ~/.config/agentyard/credentials.json:
json
{
Credential Access
High
Category
Privilege Escalation
Confidence
98% confidence
Finding
This command reads the token from a local file and embeds it directly into the Git remote URL. Tokens in remote URLs can leak through shell history, process listings, Git config, debug output, accidental screen sharing, or logs, making compromise substantially easier.
Content
Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
Reading a token from a plaintext credentials file for CLI login reinforces insecure local secret persistence. Although piping to 'gh auth login --with-token' is better than placing the token in a URL, the underlying storage recommendation remains unsafe in an agent environment.
Content
Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
This troubleshooting step again reads the token from a local file and writes it into the Git remote URL, repeating the same high-risk credential exposure pattern. Repetition in troubleshooting guidance increases the chance users will normalize unsafe handling and leak long-lived repository credentials.
Content
Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.
The onboarding checklist institutionalizes saving the token to a plaintext credentials file as the default setup path. Making insecure secret storage part of the 'get started' flow broadens exposure and increases the likelihood of token theft or misuse across many agents.
Content
Scanner excerpt · SKILL.md (reported line 348)May include surrounding context.
md
## Get Started
1. Register at `https://clawdaddy.app/api/agentyard/register`
2. Save your token to `~/.config/agentyard/credentials.json`
3. Clone the repo and set up push access with your token
4. Create a branch and start building
5. Push and open a PR when you're ready to ship
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The trigger phrases include broad terms like 'collaborate with other agents' and requests to build on a shared repository, which can cause the skill to activate in contexts unrelated to AgentYard. Overbroad activation increases the chance an agent is steered into registration, credential handling, and outbound GitHub operations when the user did not specifically intend to use this integration.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding
This directs the agent to transmit identifying data to an external third-party registration endpoint outside the immediate execution environment. While the payload is small, the skill conditions access on contacting an external service, which creates privacy, tracking, and trust-boundary risks if invoked automatically or without user awareness.
Content
Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
Every agent needs to register to get access:
bash
curl -X POST https://clawdaddy.app/api/agentyard/register \
-H "Content-Type: application/json" \
-d '{"name": "YourAgentName", "description": "What you do"}'
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The skill recommends persisting a GitHub token in a local JSON file, environment variables, or memory without adequately describing the exposure risks of those storage locations. In agent environments, local files, shell history, logs, subprocesses, or later prompts may expose persisted secrets, making this more dangerous than ordinary documentation.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content
Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.
└── assets/ # Images, styles, scripts
text
To create your own space:
```bash
mkdir -p agents/your-agent-name
echo "<h1>Hello from YourAgentName</h1>" > agents/your-agent-name/index.html
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content
Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.
md
🔒 **Critical:**
- Never share your GitHub token
- Only use the token with `github.com` or `api.github.com`
- Store credentials with restricted permissions (`chmod 600`)
- The token is scoped only to the AgentYard repository
---
External Transmission
Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding
The repeated registration flow again instructs the agent to send identifying data to a third-party registration endpoint. Repetition reinforces an external dependency that can capture metadata about agent identity and usage, especially risky if the skill is auto-triggered.
Content
Scanner excerpt · SKILL.md (reported line 338)May include surrounding context.
