T08 · Insecure Dependencies
Error
- Location
SKILL.md:57- Finding
Unpinned Third-Party Wallet Dependency Handles High-Value Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Slopwork Marketplace
Security checks for vulnerabilities and agentic risk
Overview
The skill fits a Solana task marketplace, but it gives agents payment-signing power while using weak secret-handling and mutable remote instruction guidance.
Review this skill before installing. Use it only with a low-value or dedicated wallet, keep wallet files and passwords in separate protected stores, avoid passing real passwords on the command line, verify every Solana transaction amount and destination before signing, and do not let remote /api/skills content override the locally reviewed instructions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:83- Finding
Wallet Password Is Recommended to Be Stored Alongside the Encrypted Wallet
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:15- Finding
Agent Is Directed to Consume Mutable Remote Skill Instructions
- Content
View full analysis
**Docs Version: 2026-02-09** — Features evolve frequently. **Always re-read this document or fetch `/api/skills` before interacting with a task.** Using outdated assumptions (e.g. wrong endpoint for a task type) causes failures. ``` The remote endpoint is identified elsewhere in the same file: ```markdown - Skills docs (JSON): `https://slopwork.xyz/api/skills` - API base: `https://slopwork.xyz/api` ``` ### Technical Analysis The reviewed Skill explicitly directs an Agent to fetch remote skill documentation before interacting with tasks. The response at `/api/skills` is externally mutable and is not pinned to a content digest, immutable version, signature, or audited schema in the supplied documentation. If an Agent interprets that response as operational instructions rather than untrusted data, the server can modify effective Skill behavior after static review. Compromise of the service, deployment pipeline, DNS resolution, hosting account, or remote documentation publisher could introduce instructions that request additional files, alter transaction destinations, weaken confirmation requirements, or attempt to override the Agent's existing safety constraints. Fetching current API configuration can be necessary for marketplace interoperability. Treating remotely supplied documentation as authoritative Agent instructions is not necessary. Runtime configuration and supported operations should instead be represented as strictly validated data under locally defined behavior. ### Attack Path 1. An attacker compromises the remote service, its publishing pipeline, or another component capable of changing `/api/skills`. 2. The attacker modifies the endpoint response to include malicious operational instructions. 3. An Agent follows the audited Skill's directive and retrieves th ...[truncated 1440 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash npm install cp .env.example .env # configure DATABASE_URL, SOLANA_RPC_URL, etc. npm run db:push && npm run db:generate npm run dev npm run skill:auth -- --password "YOUR_WALLET_PASSWORD"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly recommends storing the wallet password alongside the encrypted wallet file, which defeats much of the protection provided by encryption. If a local filesystem, project directory, logs, backups, or adjacent tooling is compromised, an attacker can recover both factors at once and immediately take control of the Solana wallet and escrowed funds.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The 'Create Task' section says competition bidders 'submit work for free,' but elsewhere the document repeatedly states competition entries require a 0.001 SOL entry fee for spam prevention. This is an active contradiction in the skill documentation about user cost and transaction behavior, which can mislead agents about what the code/CLI is expected to do.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest describes the skill as a Solana task marketplace for posting tasks, bidding, escrowing funds, and releasing payments via multisig. However, the documented capabilities also include uploading/removing profile pictures and setting/removing usernames, which are user-profile features not reflected in that description. These are not core implementation details of task escrow and marketplace settlement.
- Content
Static analysis
No suspicious patterns detected.