Security audit

OpenServ Multi Agent Workflows

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent workflow documentation, but its examples normalize risky wallet-key handling and unreviewed third-party agent selection for sensitive workflows.

Review this before installing or following the examples. Use a dedicated low-value wallet, never commit .env, prefer a secret manager, pin package and skill versions, and replace marketplace first-result selection with reviewed or allowlisted agent IDs before processing sensitive or client data.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: examples/life-coaching-pipeline.md:81
Finding: Sensitive life-coaching data is forwarded to dynamically selected marketplace agents
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:160
Finding: Executable packages and Skill updates are installed from mutable, unpinned sources
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (107)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.
md
- `reference.md` - Workflow patterns, declarative sync, triggers, monitoring

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: The example explicitly instructs storing a wallet private key in plaintext environment configuration. If the file is exposed through source control, endpoint compromise, backups, or accidental sharing, an attacker may gain direct control over the associated wallet or account, making this more serious than a generic credential reference.
Content: Scanner excerpt · examples/content-creation-pipeline.md (reported line 39)May include surrounding context.
└── tsconfig.json

text
### .env ```env WALLET_PRIVATE_KEY=0x...

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: This line explicitly instructs users to store a wallet private key in a plaintext .env file. While common in examples, private keys are highly sensitive and compromise can allow full control of the associated wallet/account, making the documentation risky if it omits strong safeguards.
Content: Scanner excerpt · examples/crypto-alpha-pipeline.md (reported line 39)May include surrounding context.
└── tsconfig.json

text
### .env ```env WALLET_PRIVATE_KEY=0x...

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/blog-pipeline.md (reported line 32)May include surrounding context.
paid-image-pipeline/ ├── src/ │ └── agent.ts ├── .env ├── package.json └── tsconfig.json

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/blog-pipeline.md (reported line 37)May include surrounding context.
paid-image-pipeline/ ├── src/ │ └── agent.ts ├── .env ├── package.json └── tsconfig.json

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/content-creation-pipeline.md (reported line 34)May include surrounding context.
paid-image-pipeline/ ├── src/ │ └── agent.ts ├── .env ├── package.json └── tsconfig.json

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/crypto-alpha-pipeline.md (reported line 34)May include surrounding context.
paid-image-pipeline/ ├── src/ │ └── agent.ts ├── .env ├── package.json └── tsconfig.json

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/life-coaching-pipeline.md (reported line 40)May include surrounding context.
paid-image-pipeline/ ├── src/ │ └── agent.ts ├── .env ├── package.json └── tsconfig.json

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/life-coaching-pipeline.md (reported line 45)May include surrounding context.
paid-image-pipeline/ ├── src/ │ └── agent.ts ├── .env ├── package.json └── tsconfig.json

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/paid-image-pipeline.md (reported line 21)May include surrounding context.
paid-image-pipeline/ ├── src/ │ └── agent.ts ├── .env ├── package.json └── tsconfig.json

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/paid-image-pipeline.md (reported line 26)May include surrounding context.
paid-image-pipeline/ ├── src/ │ └── agent.ts ├── .env ├── package.json └── tsconfig.json

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/podcast-production-line.md (reported line 34)May include surrounding context.
paid-image-pipeline/ ├── src/ │ └── agent.ts ├── .env ├── package.json └── tsconfig.json

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/polymarket-intelligence.md (reported line 34)May include surrounding context.
paid-image-pipeline/ ├── src/ │ └── agent.ts ├── .env ├── package.json └── tsconfig.json

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/social-media-pipeline.md (reported line 34)May include surrounding context.
paid-image-pipeline/ ├── src/ │ └── agent.ts ├── .env ├── package.json └── tsconfig.json

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/social-media-pipeline.md (reported line 39)May include surrounding context.
paid-image-pipeline/ ├── src/ │ └── agent.ts ├── .env ├── package.json └── tsconfig.json

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/tokenomics-design-pipeline.md (reported line 34)May include surrounding context.
paid-image-pipeline/ ├── src/ │ └── agent.ts ├── .env ├── package.json └── tsconfig.json

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/video-content-factory.md (reported line 34)May include surrounding context.
paid-image-pipeline/ ├── src/ │ └── agent.ts ├── .env ├── package.json └── tsconfig.json

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/video-content-factory.md (reported line 39)May include surrounding context.
paid-image-pipeline/ ├── src/ │ └── agent.ts ├── .env ├── package.json └── tsconfig.json

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/youtube-to-blog-pipeline.md (reported line 34)May include surrounding context.
paid-image-pipeline/ ├── src/ │ └── agent.ts ├── .env ├── package.json └── tsconfig.json

text

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example shows a .env containing WALLET_PRIVATE_KEY and later states that provision() auto-populates it, but it does not prominently warn that a private key will be written to local disk. This can lead developers to accidentally commit the key, expose it via backups or logs, or reuse an insecure workstation secret for an on-chain identity and payment wallet.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: Reloading .env specifically to consume WALLET_PRIVATE_KEY confirms that the workflow persists a usable private key in plaintext and then reads it back into process memory for authentication and on-chain operations. In this context, compromise of the project directory, source control, CI artifacts, or developer workstation can directly lead to wallet theft, unauthorized registrations, and loss of funds or identity control.
Content: Scanner excerpt · examples/paid-image-pipeline.md (reported line 143)May include surrounding context.
md
// ... after provision(), before run(): // Reload .env to pick up WALLET_PRIVATE_KEY written by provision() dotenv.config({ override: true }) try {

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The documentation explicitly tells users to store a WALLET_PRIVATE_KEY in plaintext in a .env example without adjacent safety guidance. Because a wallet private key is a highly sensitive authentication secret, weak handling can lead to account compromise, unauthorized workflow actions, or loss of assets/control associated with that wallet.
Content: Scanner excerpt · examples/podcast-production-line.md (reported line 39)May include surrounding context.
└── tsconfig.json

text
### .env ```env WALLET_PRIVATE_KEY=0x...

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: This line shows a raw WALLET_PRIVATE_KEY value in a .env example, directly normalizing local storage of a highly sensitive signing credential. If users follow this guidance without safeguards, exposure of the file, shell history, backups, screenshots, or accidental commits could lead to wallet compromise and unauthorized transactions.
Content: Scanner excerpt · examples/polymarket-intelligence.md (reported line 39)May include surrounding context.
└── tsconfig.json

text
### .env ```env WALLET_PRIVATE_KEY=0x...

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The example explicitly places a wallet private key in .env without accompanying safe-handling guidance. In a blockchain context, compromise of this secret can allow unauthorized wallet use, making the documentation risky even if the intent is instructional.
Content: Scanner excerpt · examples/tokenomics-design-pipeline.md (reported line 39)May include surrounding context.
└── tsconfig.json

text
### .env ```env WALLET_PRIVATE_KEY=0x...

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/blog-pipeline.md (reported line 67)May include surrounding context.
md
const client = new PlatformClient() if (!process.env.WALLET_PRIVATE_KEY) { console.error('Missing WALLET_PRIVATE_KEY in .env') process.exit(1) }

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: examples/paid-image-pipeline.md:55