Security audit

Hatcher Host AI Agents Deployment

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for managing Hatcher hosted agents, but it asks agents to handle long-lived credentials, live integrations, payments, plugin installs, and destructive lifecycle actions with underdeveloped guardrails.

Install only if you are comfortable giving the skill authority to create and operate live Hatcher agents. Use dedicated least-privilege service accounts and integration tokens, avoid pasting real secrets into logged shell commands, rotate any exposed keys, require explicit confirmation before payments, plugin installs, starts/restarts, and deletion, and review every third-party skill or plugin before adding it to an agent.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: integrations.md:20
Finding: Sensitive credentials are exposed through command-line arguments
Content: View full analysis
Vulnerability Details

File Location: integrations.md:20-25, integrations.md:43-49, integrations.md:61-70, integrations.md:81-86, integrations.md:96-102, integrations.md:111-116, and pricing.md:127-132
Vulnerability Type: Sensitive credential exposure through command-line arguments
Risk Level: High

Representative vulnerable instructions from integrations.md:20-25:

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{ "telegram.enabled": true, "telegram.botToken": "123456:ABC-DEF..." }'

The same pattern is used for other high-value credentials:

bash
-d '{ "twitter.enabled": true, "twitter.apiKey": "...", "twitter.apiSecret": "...", "twitter.accessToken": "...", "twitter.accessTokenSecret": "..." }'

From pricing.md:127-132:

bash
curl -sS -X PATCH https://api.hatcher.host/api/v1/agents/$AGENT_ID/config \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{ "byok.provider": "anthropic", "byok.apiKey": "sk-ant-..." }'

Technical Analysis

The documented commands place Telegram and Discord bot tokens, Twitter credentials, WhatsApp access tokens, Slack bot tokens and signing secrets, and LLM provider API keys directly in the curl argument list.

Although transmitting these credentials to Hatcher is necessary for the declared integration functionality, embedding them directly in shell commands is not the minimum-exposure method. Real substituted values may be disclosed through:

Shell history files

Terminal transcripts and session recording

Process inspection while curl is running

Automation logs or debug tracing such as set -x

Copied command output, support bundles, or audit telemetry

Server-side AES-256-GCM storage does not mitigate dis ...[truncated 1225 chars]
Remediation: View remediation
Remediation Suggestions

Do not interpolate secrets directly into command-line arguments.

Build request bodies from protected temporary files with mode 0600, then securely remove them after use.

Prefer a dedicated secret-input mechanism that reads values from standard input without echoing or persisting them.

If environment variables are used, document that they can still be exposed through process environments and must not be logged.

Explicitly warn users to disable shell tracing and avoid shared terminals or recorded sessions during secret configuration.

Recommend narrowly scoped, integration-specific credentials rather than broad account tokens.

Provide documented rotation and revocation procedures for every supported integration.

Ensure API and infrastructure logs redact authorization headers and all secret-valued configuration fields.

T08 · Insecure Dependencies

Error

Location: agents.md:290
Finding: Third-party skills and plugins are installed without immutable version or integrity pinning
Content: View full analysis
Vulnerability Details

File Location: agents.md:290-304
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: High

markdown
## Skills / Plugins Each framework has a different plugin system: | Framework | Plugin system | Install | | --- | --- | --- | | `openclaw` | ClawHub skills | `POST /api/v1/agents/:id/skills/install` | | `hermes` | 77 bundled + npm | `POST /api/v1/agents/:id/plugins/install` | | `elizaos` | `@elizaos/plugin-*` npm | `POST /api/v1/agents/:id/plugins/install` | | `milady` | Drop-in JS files | `POST /api/v1/agents/:id/plugins/install` | Example (openclaw): ```bash curl -sS -X POST "https://api.hatcher.host/api/v1/agents/$AGENT_ID/skills/install" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{ "skillIds": ["desearch-web-search", "market-research-agent"] }'

text
### Technical Analysis Plugins are selected by mutable package or skill identifiers. The instructions do not pin an immutable version, content digest, signed release, or verified source revision. They also cover npm packages and drop-in JavaScript files without specifying provenance or integrity controls. A package name alone does not guarantee that the installed code is identical to the code previously reviewed. Registry compromise, maintainer-account compromise, malicious updates, dependency confusion, or identifier reassignment could change the installed payload. These dependencies run inside managed agents that may process private conversations and hold integration credentials. This makes their supply-chain trust boundary security-sensitive. ### Attack Path 1. An attacker compromises a plugin maintainer, registry entry, distribution source, or one of the plugin's transitive dependencies. 2. Malicious code is published under an identifier recommended by a template or selected by a user. 3. The agent installs the plugin using only ...[truncated 954 chars]
Remediation: View remediation
Remediation Suggestions

Require plugins and skills to be pinned to immutable versions and cryptographic content digests.

Verify package signatures, publisher identity, source provenance, and build attestations before installation.

Maintain an audited allowlist of approved packages and versions.

Lock and verify transitive dependencies rather than resolving them dynamically at deployment time.

Display the exact package version, digest, publisher, requested permissions, and source before installation.

Require explicit human approval for every new installation or version change.

Run plugins in isolated sandboxes with deny-by-default filesystem, network, secret, and integration permissions.

Do not expose plaintext integration credentials to plugin processes; use narrowly scoped brokered capabilities.

Continuously scan installed packages and provide rapid revocation and rollback mechanisms.

T09 · Insecure Skill Coding Practices

Warning

Location: skill.md:50
Finding: Registration examples provide reusable fixed passwords
Content: View full analysis
Vulnerability Details

File Location: skill.md:50-61 and auth.md:25-33
Vulnerability Type: Insecure example credential likely to be reused
Risk Level: Medium

From skill.md:50-61:

bash
curl -sS -X POST https://api.hatcher.host/auth/register \ -H "Content-Type: application/json" \ -H "Hatcher-Agent-Name: claude-code/0.4.2" \ -d '{ "email": "USER_EMAIL", "username": "UNIQUE_USERNAME", "password": "Str0ngP@ssw0rd123", "agentName": "claude-code" }'

A second fixed example appears in auth.md:

json
{ "email": "user@example.com", "username": "agent_user_01", "password": "Str0ngP@ssw0rd1", "agentName": "claude-code", "referralCode": "optional-code" }

Technical Analysis

Both registration examples contain valid-looking passwords that satisfy the documented password policy. An AI agent following the example mechanically may submit the literal password rather than generate a unique random value.

Because these passwords are publicly documented, they must be treated as compromised. Complexity rules do not provide protection when the exact credential is known. The issue is particularly relevant because the Skill explicitly tells the agent to register an account in the user's name and store authentication material.

Attack Path

An agent copies the registration example and replaces only the explicit email and username placeholders.

The account is created using the published password.

An attacker learns or guesses the user's Hatcher email address.

The attacker attempts authentication using the password published in the Skill documentation.

If login succeeds, the attacker receives account authentication tokens.

The attacker can operate resources and access functionality available to that account.

Impact Assessment

Successful exploitation could result in Hatcher account takeover. Subject to server-side ...[truncated 435 chars]
Remediation: View remediation
Remediation Suggestions

Replace valid-looking passwords with an unmistakable placeholder such as GENERATE_A_UNIQUE_RANDOM_PASSWORD.

Explicitly instruct the agent to generate a cryptographically random password for every registration.

Enforce sufficient random length rather than relying only on upper, lower, and digit composition rules.

Never print the generated password in ordinary terminal output or logs.

Store credentials in an operating-system keychain or dedicated secret manager with restrictive access controls.

Prefer a user-completed authentication flow, passkeys, or delegated authorization so the agent does not need to create or retain the user's password.

Add server-side checks that reject known example passwords and commonly compromised credentials.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (67)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · auth.md (reported line 112)May include surrounding context.
md
Requires JWT. Returns list of active (not revoked) keys — prefix only, no full key. ### DELETE /auth/api-keys/:id Requires JWT. Soft-deletes (sets `revokedAt`). Revoked keys stop authenticating immediately.

Credential Access

High

Category: Privilege Escalation
Confidence: 78% confidence
Finding: The instructions require obtaining and supplying multiple long-lived Twitter/X credentials, but they do not emphasize that these secrets grant account-level API access and must be tightly controlled. In an agent skill context, users may paste these values into unsafe surfaces or over-broaden permissions, leading to account takeover or abusive posting if exposed.
Content: Scanner excerpt · integrations.md (reported line 56)May include surrounding context.
Twitter / X

Human creates app at https://developer.twitter.com. Gets API key, API secret, access token, access token secret.

Agent config:

bash

Credential Access

High

Category: Privilege Escalation
Confidence: 78% confidence
Finding: The WhatsApp section tells users to retrieve and configure an access token without warning about the token's ability to authorize messaging activity on a business account. Given that the skill enables real-world outbound communications, accidental exposure of this credential could enable unauthorized messaging and account abuse.
Content: Scanner excerpt · integrations.md (reported line 76)May include surrounding context.
WhatsApp

Uses WhatsApp Business Cloud API (Meta). Human registers at developers.facebook.com, creates WhatsApp Business account, gets phone number ID + access token.

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 29)May include surrounding context.
Browse

bash
curl -sS https://api.hatcher.host/api/templates

Response (paginated, default limit=50):

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This documentation includes authenticated, state-changing API examples for creating and managing live agents but does not provide a clear safety warning that these commands affect real infrastructure and should only be run with intentional use of a real API key. In a skill context, users may copy-paste commands directly, increasing the chance of accidental provisioning, restarts, deletions, or other unintended actions against production resources.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 210)May include surrounding context.
Restart

bash
curl -sS -X POST "https://api.hatcher.host/api/v1/agents/$AGENT_ID/restart" \ -H "Authorization: Bearer $HATCHER_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 300)May include surrounding context.
Example (openclaw):

bash
curl -sS -X POST "https://api.hatcher.host/api/v1/agents/$AGENT_ID/skills/install" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{ "skillIds": ["desearch-web-search", "market-research-agent"] }'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The guide instructs agents to create and use long-lived API keys and notes the full key is only returned once, but it does not warn against logging, echoing, embedding in prompts, or storing the credential insecurely. In an agent context, omission of secret-handling guidance materially increases the chance the key is exposed through console output, tool traces, chat history, or persisted state, leading to unauthorized API access until revocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document instructs users to place highly sensitive bot tokens, API keys, and access secrets directly into configuration update requests, but it does not include explicit handling warnings such as not pasting secrets into shared terminals, logs, chats, screenshots, or agent-visible prompts. In a skill for agent deployment and integrations, this omission is meaningful because operators may follow the examples verbatim and unintentionally expose reusable credentials.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 29)May include surrounding context.

Agent updates config:

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 64)May include surrounding context.

Agent updates config:

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 70)May include surrounding context.

Agent updates config:

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 76)May include surrounding context.

Agent updates config:

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 88)May include surrounding context.

Agent updates config:

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 103)May include surrounding context.

Agent updates config:

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 143)May include surrounding context.

Agent updates config:

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 175)May include surrounding context.

Agent updates config:

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 184)May include surrounding context.

Agent updates config:

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 196)May include surrounding context.

Agent updates config:

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 210)May include surrounding context.

Agent updates config:

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 219)May include surrounding context.

Agent updates config:

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 228)May include surrounding context.

Agent updates config:

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 245)May include surrounding context.

Agent updates config:

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 269)May include surrounding context.

Agent updates config:

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · agents.md (reported line 280)May include surrounding context.

Agent updates config:

bash
curl -sS -X PATCH "https://api.hatcher.host/api/v1/agents/$AGENT_ID/config" \ -H "Authorization: Bearer $HATCHER_KEY" \ -H "Content-Type: application/json" \ -d '{

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Tool Parameter Abuse

Credential Access

Twitter / X

Credential Access

WhatsApp

External Transmission

Browse

Missing User Warnings

External Transmission

Restart

External Transmission

Missing User Warnings

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Static analysis