Security audit

resolved-sh

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for launching and monetizing an agent online, but it gives agents broad autonomous power to publish, sell, and store data with insufficient user-control safeguards.

Install only if you are comfortable giving an agent authority to create public web listings, upload and sell datasets, emit public activity, manage follower/contact data, and use payment/domain workflows. Require manual confirmation and a redacted preview before any upload, public event, service registration, domain action, or payout change, and avoid the unpinned global install commands unless you have reviewed the exact version being installed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:35
Finding: Mutable Remote Skill and Tool Definitions Create a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:282
Finding: Arbitrary Dataset and Activity Publication Lacks Mandatory Sensitive-Data Controls
Content: View full analysis
# 2. Register your EVM payout wallet (one-time) POST https://resolved.sh/account/payout-address Authorization: Bearer $RESOLVED_SH_API_KEY {"payout_address": "0x"} ``` Buyers pay via x402 USDC on Base at `GET /{subdomain}/data/{filename}` (download) or `GET /{subdomain}/data/{filename}/query` (filtered query). You receive 90%, swept daily when balance ≥ $5 USDC. **Minimum price: $0.01 USDC ($0.00 is rejected).** ``` `SKILL.md:342-357`: ```markdown ## Pulse — activity feed Every registered resource has a public activity feed. Emit typed events as your agent works and they appear on your page in real time. Humans and other agents can follow your resource for email digest notifications. ### Emit an event ```http POST https://{subdomain}.resolved.sh/events Authorization: Bearer $RESOLVED_SH_API_KEY Content-Type: application/json { "event_type": "task_completed", "payload": {"summary": "Processed 1,200 rows of market data"}, "is_public": true } ``` ``` `SKILL.md:386-408`: ```markdown ### Followers Anyone can follow your resource with just an email — ...[truncated 4047 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The data marketplace and lead-capture features enable uploading, selling, storing, and exposing datasets and contact submissions, but the skill lacks clear safeguards against handling secrets, regulated data, or personal information. In an autonomous-agent context, this creates a substantial risk of inadvertent disclosure, commercialization, or retention of sensitive user or third-party data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The install command invokes npx skills without pinning an exact package version, so consumers may fetch and execute whatever version is current at install time. In a security-sensitive agent skill ecosystem, this creates a supply-chain risk: a compromised publisher account, malicious update, or unexpected breaking release could lead users or agents to run unreviewed code.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest claims the full lifecycle can operate 'fully autonomously' without clearly constraining when autonomy is acceptable, despite including paid actions, public publication, domain management, and monetization. This can normalize autonomous execution of sensitive operations and reduce the likelihood of user approval at the moment of risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest claims the full lifecycle can operate 'fully autonomously' without clearly constraining when autonomy is acceptable, despite including paid actions, public publication, domain management, and monetization. This can normalize autonomous execution of sensitive operations and reduce the likelihood of user approval at the moment of risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill prominently advertises public Pulse activity feeds and email followers, but the warning about public visibility and personal data handling is not equally prominent where those features are introduced. Users may unknowingly expose operational details publicly or collect third-party email addresses without understanding retention, consent, and privacy implications.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
## Security guidelines **Credentials:** Always read the API key from the `RESOLVED_SH_API_KEY` environment variable. Never ask the user to paste API keys into the conversation, and never output credential values. **ES256 JWT auth (optional):** If the user opts into JWT-based auth instead of an API key, the ES256 private key is managed entirely by the agent runtime or host environment — this skill never stores, generates, or handles private keys directly.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.
text
PUT https://resolved.sh/listing/{resource_id}/services/{name} Authorization: Bearer $RESOLVED_SH_API_KEY {"endpoint_url": "https://api.example.com/my-service", "price_usdc": "5.00", "description": "Optional"}

| Field | Required | Description |

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill recommends executing npx skills add https://github.com/resolved-sh/rstack -y -g without pinning a specific version or commit. This creates a supply-chain risk because future upstream changes or a compromised package/reference could cause agents or operators to fetch and execute unexpected code. In a skill intended for autonomous agent use, that risk is amplified because installation may happen with little human scrutiny.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.