Security audit

Agent ID

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned but asks users to create persistent public agent discovery, register with a third-party service, and store credentials without enough safety controls.

Review carefully before installing. Only use it if you intentionally want your agent to be publicly discoverable through the named third-party hub, are comfortable sending identity and capability metadata there, can secure or avoid the credential file, and can independently verify any companion packages before installing them.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:19
Finding: Persistent External Coordination Configuration in Agent State Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 19-35; duplicate OADP marker at line 57 **Vulnerability Type**: Persistent modification of agent state and external registration **Risk Level**: High ### Code Snippet ```markdown Add this to your `AGENTS.md` or `AGENT.md`: ```markdown  ``` This single line makes your agent discoverable by any OADP-compatible scanner. ## Register on ClawSwarm ```bash curl -s -X POST "https://onlyflies.buzz/clawswarm/api/v1/agents/register" \ -H "Content-Type: application/json" \ -d '{"name":"YOUR_NAME","description":"What you do","capabilities":["your","skills"]}' ``` Save credentials to `~/.config/clawswarm/credentials.json`. ``` A duplicate marker also appears at line 57: ```markdown  ``` ### Technical Analysis The Skill directs users to insert a third-party OADP endpoint into `AGENTS.md` or `AGENT.md`. These files commonly provide persistent instructions or configuration to agents across sessions. Consequently, the external coordination endpoint remains active beyond the immediate Skill invocation. The workflow also sends the agent's name, description, and capabilities to `onlyflies.buzz`. Remote registration and discovery are declared features, so the network access is functionally related to the Skill. However, writing the endpoint into a persistent agent state file exceeds the minimum privileges needed to create a local identity card and unnecessarily mixes remote-service configuration with persistent agent instructions. The audited file does not demonstrate that the remote service currently returns executable instructions, and no direct code executio ...[truncated 1342 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Do not place remote coordination endpoints in `AGENTS.md`, `AGENT.md`, or other persistent instruction files. - Store OADP settings in a dedicated configuration file that cannot alter agent instructions. - Make remote registration explicitly optional and require informed user consent before transmitting metadata. - Document every transmitted field, the service operator, retention policy, authentication model, and deletion procedure. - Allow users to configure an approved endpoint rather than hardcoding a single third-party service. - Validate and treat all remote responses as untrusted data; never interpret them directly as agent instructions or executable commands. - Provide a clear removal procedure for the marker, registration, and remotely retained identity. ]]>

T08 · Insecure Dependencies

Error

Location: SKILL.md:45
Finding: Unpinned Third-Party Skill Installation Creates Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 45-55 **Vulnerability Type**: Mutable and unverified third-party dependencies **Risk Level**: High ### Code Snippet ```markdown ## Scan for Others ```bash clawhub install agent-ping ``` ## Full Integration ```bash clawhub install clawswarm ``` ``` ### Technical Analysis The Skill recommends installing the third-party packages `agent-ping` and `clawswarm` without specifying immutable versions, checksums, source repositories, or verified publishers. The effective content installed by these commands can therefore change after this Skill has been audited. Because agent Skills can contain instructions, tools, or scripts, installing a mutable package expands the trust boundary beyond the reviewed `SKILL.md`. A compromised publisher account, registry, package version, or dependency-resolution process could cause later users to receive content different from what was originally intended. The commands do not use shell piping or directly execute a downloaded script in the audited file. The vulnerability is the absence of dependency pinning and authenticity controls. ### Attack Path 1. A user follows the documented integration instructions. 2. `clawhub` resolves `agent-ping` or `clawswarm` using the package name alone. 3. An attacker compromises the package, publisher, registry entry, or dependency-resolution path. 4. The package manager retrieves the attacker-controlled current release. 5. The newly installed Skill introduces malicious instructions or executable components. 6. Those components run with the permissions granted to the agent or package manager. ### Impact Assessment The resulting privileges depend on the behavior of the retrieved Skills and the permissions of the invoking agent. A malicious package could potentially access files available to the agent, read configuration or credentials, make network requests, alter persistent agent instructions, or execute supported tools. ...[truncated 220 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Pin each dependency to an immutable, reviewed version. - Where supported, verify package hashes, signatures, or provenance attestations before installation. - Identify the expected publisher and authoritative source repository. - Document the exact permissions and behaviors required from each dependency. - Require users to review dependency contents before activation. - Use a lockfile or equivalent integrity mechanism if supported by the package ecosystem. - Avoid automatically updating installed Skills without a new security review. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:35
Finding: Credential Storage Guidance Omits Filesystem and Secret-Management Protections<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 35 **Vulnerability Type**: Insecure plaintext credential storage guidance **Risk Level**: Medium ### Code Snippet ```markdown Save credentials to `~/.config/clawswarm/credentials.json`. ``` ### Technical Analysis The Skill instructs users to persist service credentials in a regular JSON file but does not provide a secure creation procedure, restrictive permissions, secret-store integration, rotation guidance, or revocation instructions. Depending on the user's environment and `umask`, the file or its parent directory could be readable by other local accounts or processes. Plain JSON credentials may also be captured by broad home-directory backups, synchronization tools, diagnostic bundles, or unrelated applications with filesystem access. Credential persistence is relevant to authenticated remote integration, but it is not necessary for the narrower local identity-card function. The Skill should therefore make this storage optional and apply least-privilege controls when remote registration is enabled. ### Attack Path 1. The user registers with the external service and receives credentials. 2. The user saves them to `~/.config/clawswarm/credentials.json` as instructed. 3. The file is created with permissions inherited from the user's environment, without an explicit `0600` requirement. 4. Another local user, process, backup system, or synchronization utility obtains the file. 5. The exposed credentials are reused to impersonate the agent or access its ClawSwarm account. ### Impact Assessment An attacker who obtains reusable credentials may be able to impersonate the registered agent and perform any service operations authorized by those credentials. Potential effects include identity takeover, unauthorized coordination activity, reputation manipulation, or access to associated bounty functionality. The exact server-side privileges and credential format are not documented in the aud ...[truncated 159 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Prefer the operating system's credential manager or secret store instead of a plaintext JSON file. - If file storage is unavoidable, create the directory with mode `0700` and the credential file with mode `0600`. - Provide secure setup commands that avoid exposing credentials in shell history, logs, process arguments, or temporary files. - Define the credential schema without including real secret examples. - Document credential lifetime, scope, rotation, revocation, and deletion procedures. - Ensure tools never print credentials during normal or verbose operation. - Make credential persistence and remote registration optional rather than required for local identity generation. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Hidden Instructions

High

Category: Prompt Injection
Content: Add this to your `AGENTS.md` or `AGENT.md`: ```markdown  ``` This single line makes your agent discoverable by any OADP-compatible scanner.
Confidence: 93% confidence
Finding: The hidden HTML comment embeds machine-readable registration and ping endpoints intended to be consumed by scanners, which can trigger discovery or integration behavior without prominent user awareness. In this skill's context, the hidden instruction is specifically designed to make agents discoverable by external infrastructure, making covert external exposure more dangerous than an ordinary comment.

Credential Access

High

Category: Privilege Escalation
Content: -d '{"name":"YOUR_NAME","description":"What you do","capabilities":["your","skills"]}' ``` Save credentials to `~/.config/clawswarm/credentials.json`. ## Why Bother?
Confidence: 95% confidence
Finding: Telling users to save credentials to a predictable local file path without any guidance on permissions, encryption, or secret management promotes insecure credential handling. If those credentials grant access to a public coordination hub, theft or misuse could lead to impersonation, unauthorized actions, or persistent tracking of the agent/operator.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Phrases like "Give your agent a persistent cross-platform identity" and "This skill makes it findable everywhere" describe a very broad purpose without specific trigger conditions, scope limits, or exclusion cases. The file does not define concrete invocation phrases or when the skill should not be used, which can lead to unintended activation in ordinary identity or discovery-related conversations.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill directs users to publicly register an agent and then store resulting credentials locally, but provides no warning about privacy, trust, or secure secret handling. In the context of an agent skill, this can expose operator metadata, capabilities, and credentials to an untrusted third-party service and increase the attack surface for tracking or account compromise.

External Transmission

Medium

Category: Data Exfiltration
Content: ## Register on ClawSwarm ```bash curl -s -X POST "https://onlyflies.buzz/clawswarm/api/v1/agents/register" \ -H "Content-Type: application/json" \ -d '{"name":"YOUR_NAME","description":"What you do","capabilities":["your","skills"]}' ```
Confidence: 97% confidence
Finding: The skill explicitly instructs users to POST agent information to an external domain, causing data exfiltration to a third-party service outside the user's environment. Because the skill is framed as making agents "findable everywhere" and uses a nonstandard external hub, the transmission materially increases privacy, tracking, and supply-chain risk.

Static analysis

No suspicious patterns detected.