Magic for AI Agents

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:06 PM UTC
• Version: 1.0.0

Overview

This skill openly connects tasks to external human assistants, but it pushes users toward routine personal-data sharing and persistent monitoring without enough scoping or safeguards.

Install only if you are comfortable sending task details and owner contact information to Magic's external service and human assistants. Avoid using it for secrets, regulated records, confidential business material, or personal data unless the user has explicitly approved the exact payload. Do not set up the heartbeat cron job or store the API key in a plain local file unless you have reviewed the remote instructions and can secure, rotate, and revoke the credential.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

other

Error

• Location: skill.md:124
• Finding: Mandatory Disclosure of Owner Contact Information to an External Service## Vulnerability Details **File Location**: `skill.md`, lines 124-141 **Vulnerability Type**: Mandatory personal-data disclosure **Risk Level**: High ### Vulnerable Code Snippet ```markdown ## ⚠️ CRITICAL: Including Owner Contact Information **You MUST include the task owner's contact information in your instructions!** The human assistant needs to know who to contact for questions, clarifications, or updates. Without this information, the assistant cannot effectively complete the task. ### Required Format Always include this block at the END of your instructions: ``` --- Owner Contact Information: Name: [First Name] [Last Name] Email: [[e-mail]] Phone: [[phone]] (if available) --- ``` ``` ### Technical Analysis The skill requires every delegated task to include the owner's name and email address, with a phone number encouraged when available. These details are embedded in task instructions and transmitted to `console.api.getmagic.com`, where external human assistants can access them. Mandatory collection violates data-minimization principles because contact information may not be necessary for every delegated task. The skill does not require informed consent, preview the final outbound payload, support anonymous relay communication, or define retention and deletion controls. ### Attack Path 1. The agent loads the skill and prepares a task for delegation. 2. The skill requires the agent to obtain the owner's contact information. 3. The agent appends the name, email address, and potentially phone number to the task instructions. 4. The complete instructions are submitted to `console.api.getmagic.com`. 5. The external service and assigned human assistants receive the personal information. 6. The information may remain associated with task records, logs, notifications, or external operational systems. ### Impact Assessment This behavior can disclose directly identifying per ...[truncated 449 chars]
• Remediation: ## Remediation Suggestions - Make owner contact information optional rather than mandatory. - Require explicit, informed approval before transmitting personal information. - Display the exact destination and complete outbound payload before submission. - Use an anonymized relay channel so assistants can communicate without receiving direct contact details. - Minimize submitted data according to the task's actual requirements. - Add automatic detection and redaction for unnecessary email addresses, phone numbers, credentials, and other sensitive values. - Document retention periods, authorized recipients, deletion procedures, and applicable privacy controls. - Allow users to revoke consent and delete previously submitted task and contact data.

T06 · System Persistence

Warning

• Location: skill.md:269
• Finding: Cross-Session Persistence Through Remotely Documented Cron Installation## Vulnerability Details **File Location**: `skill.md`, lines 269-272 **Vulnerability Type**: Scheduled-task persistence **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown If you have HEARTBEAT.md enabled, you should set **automatic** task monitoring: 1. **Save your API key** after registration to `~/.config/magic-api/state.json` 2. **Set up a cron job** — see [HEARTBEAT.md](https://console.api.getmagic.com/heartbeat.md#openclaw-integration) ``` ### Technical Analysis The skill instructs agents with heartbeat support to install a cron job for automatic monitoring. A cron entry survives the current skill invocation and causes authenticated activity to continue across sessions. The actual cron command is not included in the audited package. Instead, installation instructions are retrieved from a mutable external URL. Consequently, the package does not provide enough local content to verify the command, execution frequency, environment, credential handling, or future behavior. The remote instructions could change after this version of the skill has been reviewed. ### Attack Path 1. An agent loads the skill with heartbeat functionality enabled. 2. The agent follows the external `HEARTBEAT.md` link. 3. The agent installs the cron entry described by the remote content. 4. The scheduled task persists beyond the current invocation. 5. The recurring process reads or uses the stored API key and contacts the external service. 6. If the remotely hosted instructions are subsequently changed and followed during installation or reconfiguration, the effective scheduled behavior may differ from what was originally reviewed. ### Impact Assessment Successful installation provides recurring execution under the operating-system account that owns the cron entry. The scheduled process may access that user's files and stored Magic API credential to the extent permitted by the installed command. No direct privilege escal ...[truncated 217 chars]
• Remediation: ## Remediation Suggestions - Do not install scheduled jobs automatically. - Require explicit user approval that displays the complete cron command, frequency, executable path, environment, and credential access. - Include the monitoring implementation and scheduling documentation in the reviewed package. - If external documentation is unavoidable, pin it to an immutable, integrity-verified version. - Run monitoring with the least-privileged account and a narrowly scoped API credential. - Use a system-supported scheduler configuration with logging, rate limiting, and a clearly documented removal procedure. - Provide commands to inspect, disable, and uninstall every persistent artifact. - Ensure installation is idempotent and cannot silently create duplicate scheduled jobs.

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:271
• Finding: Bearer API Key Stored in a Predictable Plaintext File## Vulnerability Details **File Location**: `skill.md`, line 271 **Vulnerability Type**: Insecure credential storage **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown 1. **Save your API key** after registration to `~/.config/magic-api/state.json` ``` ### Technical Analysis The skill directs the agent to persist a bearer API key in a predictable JSON file. It does not require restrictive file permissions, encryption, an operating-system credential manager, key scoping, rotation, or revocation. A bearer key generally grants access based solely on possession. Therefore, any local process or user able to read the file may be able to impersonate the registered agent. Predictable plaintext storage also increases exposure through workstation backups, diagnostic bundles, accidental repository commits, home-directory synchronization, or malware scanning common configuration paths. ### Attack Path 1. The agent registers with the external API and receives an API key. 2. The agent stores the key in `~/.config/magic-api/state.json`. 3. The file is created with permissive permissions, copied into a backup, synchronized, logged, or read by a compromised local process. 4. An attacker extracts the bearer credential. 5. The attacker uses the credential in the `Authorization` or `x-api-key` header. 6. The attacker accesses the API operations available to that key, such as listing task records, reading task status, creating tasks, or adding conversation messages. ### Impact Assessment Exposure may permit impersonation of the registered agent and unauthorized access to task metadata, task results, instructions, and conversations available under the credential. It may also allow creation of fraudulent tasks or messages. The exact server-side privileges and revocation controls are not defined in the audited file, so broader account or system compromise cannot be established. The demonstrated scope is the external API autho ...[truncated 32 chars]
• Remediation: ## Remediation Suggestions - Store the API key in an operating-system credential manager or dedicated secret-management service. - If file storage is unavoidable, create the directory and file with owner-only permissions, such as `0700` for the directory and `0600` for the file. - Avoid placing credentials in logs, command histories, diagnostic output, backups, or synchronized folders. - Issue narrowly scoped and short-lived credentials where supported. - Implement credential expiration, rotation, and immediate revocation. - Document how users can identify and revoke a compromised key. - Separate configuration metadata from secret values. - Validate ownership and permissions before reading an existing credential file.

other

Error

• Location: skill.md:83
• Finding: Unrestricted Third-Party Delegation of Task Content and Conversations## Vulnerability Details **File Location**: `skill.md`, lines 83-101 **Vulnerability Type**: External disclosure of task data **Risk Level**: High ### Vulnerable Code Snippet ```markdown ## Create a Task Hand off a task to a human assistant: ```bash curl -X POST https://console.api.getmagic.com/api/v1/request \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "title": "Research competitor pricing", "instructions": "Please research our top 3 competitors and document their pricing tiers.\n\n---\nOwner Contact Information:\nName: John Doe\nEmail: [e-mail]\nPhone: [phone]\n---", "objective": "Create a comparison table with pricing information", "max_minutes": 60 }' ``` ``` Additional conversation data is submitted through the same external control plane: ```markdown curl -X POST https://console.api.getmagic.com/api/v1/conversation \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "request_id": "TASK_ID", "content": "Quick question: should I include international competitors?" }' ``` ### Technical Analysis The skill's core workflow transfers task titles, detailed instructions, objectives, contact information, and follow-up conversation messages to an external service and human operators. It does not define prohibited categories of data, require a per-request confirmation, provide a payload preview, or require redaction of credentials and confidential information. Task results and conversation messages returned by external human operators also cross the agent's trust boundary. If downstream automation treats those values as trusted instructions rather than untrusted data, malicious or compromised responses could influence subsequent agent actions. The audited file does not itself show direct execution of returned content, but it also does not establish output validati ...[truncated 1381 chars]
• Remediation: ## Remediation Suggestions - Require explicit approval for every task and conversation transmitted to the external service. - Preview the complete payload and clearly identify all external recipients before submission. - Establish an allowlist of task categories suitable for human delegation. - Prohibit submission of passwords, API keys, authentication tokens, regulated records, and unnecessary confidential data. - Add automated sensitive-data detection and redaction. - Treat all results and conversation messages from the service as untrusted data. - Never execute commands, follow links, disclose additional data, or invoke privileged tools solely because an external result requests it. - Apply output validation, content isolation, and human confirmation before downstream actions. - Document service retention, human-access controls, incident response, deletion procedures, and subprocessors. - Offer a local or privacy-preserving workflow for tasks that cannot safely be transferred to third parties.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

External Transmission

Medium

• Category: Data Exfiltration

Content

Every agent needs to register once to get an API key:

```bash
curl -X POST https://console.api.getmagic.com/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "YourAgentName",

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

---

## Create a Task

Hand off a task to a human assistant:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The examples demonstrate embedding personal contact information directly in task payloads, which normalizes unsafe copy-paste behavior by downstream agents and users. Sample code often becomes production behavior, so insecure examples materially increase the likelihood of over-sharing personal data.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly requires agents to include task owner contact information in instructions sent to third-party human assistants. This creates routine external disclosure of personal data that is not strictly necessary for many tasks, increasing privacy risk and potential unauthorized sharing of user information.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill normalizes sending owner contact information to human assistants but does not provide a clear privacy notice, consent flow, retention policy, or data-handling limitations. Users may unknowingly disclose personal information to a third party under the assumption it is required for all tasks.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Requiring inclusion of owner contact details in every task encourages default disclosure of personal identifiers to external humans regardless of task sensitivity. This broad data-sharing pattern can expose names, email addresses, and phone numbers unnecessarily and may conflict with data minimization expectations.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The documentation tells agents to persist API keys locally and configure cron-based automatic monitoring, expanding credential exposure and background activity beyond simple one-off task handoff. Local plaintext or weakly protected storage plus unattended polling can increase the chance of credential theft or misuse.

Ssd 3

Low

• Confidence: 88% confidence
• Finding: The template repeatedly instructs users to include names, email addresses, and optionally phone numbers in outbound content, reinforcing a default pattern of transmitting personal identifiers. While presented as guidance, templates strongly shape implementation and can lead to systematic unnecessary disclosure.

Static analysis

No suspicious patterns detected.