ClawHub
Back to skill

Security audit

Pg Jobs

Security checks for vulnerabilities and agentic risk

Overview

This ProxyGate jobs skill is coherent, but it can guide an agent through real escrow and marketplace actions without enough scoping or confirmation guidance.

Review this skill before installing if you expect casual job-search requests in the same agent. Use it only when you intentionally want ProxyGate marketplace help, and require the agent to confirm the active account, job or listing ID, USDC amount, and exact action before creating, claiming, accepting, rejecting, canceling, deleting, depositing, withdrawing, proxying requests, or exposing services.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill metadata explicitly instructs activation on broad, everyday phrases such as "gig," "find work," and "submit work," which can cause the agent to invoke this high-impact marketplace skill in ambiguous contexts. Because the skill enables financial and state-changing actions like creating jobs and moving escrowed funds, accidental activation raises the risk of unintended transactions or workflow changes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
72% confidence
Finding

The skill presents an interactive proxygate jobs create flow and subsequent lifecycle commands without guidance to avoid relying on prior session context or to re-verify the active account, target job, and escrow amount. In multi-step agent sessions, persisted context can cause the agent to continue operating on the wrong job or account, leading to accidental claims, submissions, or fund-affecting actions.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

proxygate jobs get --table # formatted view

text

### 2. Create a job (poster)

Interactive:
```bash

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill walks through create, accept, reject, and cancel operations that lock, release, or refund escrowed USDC without an explicit warning that these actions move funds or alter irreversible job state. In a tool-invoking agent context, omission of a clear warning and confirmation requirement increases the chance of unintended financial actions, especially when combined with broad activation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation presents deposit and withdrawal commands that move real funds and modify wallet state without nearby warnings, confirmation expectations, or safety guidance. In an agent skill context, terse command references can be turned into unsafe automated actions, increasing the chance of unintended financial loss or irreversible transactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The proxy and tunnel/development commands allow sending arbitrary requests and exposing services, but the reference does not warn about leaking secrets, transmitting sensitive data to third-party APIs, or publicly exposing local endpoints. In this skill's context, users are interacting with external services and a marketplace, so omission of privacy and exposure warnings raises the risk of data disclosure and unintended service exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The command reference includes proxygate listings delete <id> and other job lifecycle actions without clearly flagging deletion as permanent or advising confirmation. In a marketplace skill, an agent may surface or automate this operation during routine management, causing accidental loss of listings or disruption of active business workflows.

Content

No source excerpt is available for this finding.