Security audit

Pg Sell

Security checks for vulnerabilities and agentic risk

Overview

This seller skill is mostly coherent, but it includes broader financial and marketplace commands plus credential-handling examples that need review before installation.

Install only if you intend to manage ProxyGate seller listings and expose services through ProxyGate. Before using it, confirm each command with the user, avoid putting real API keys or OAuth tokens directly in shell commands, verify any custom gateway URL, review uploaded docs and headers for secrets, and do not use the included wallet, buyer proxy, or job-marketplace commands unless the user explicitly asks for those separate workflows.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:39
Finding: Sensitive credentials are accepted through command-line arguments
Content: View full analysis
--key proxygate listings rotate-key --oauth2 ``` From `references/commands.md:5-7`: ```markdown - `--gateway ` — Override gateway URL (default: https://gateway.proxygate.ai) - `--keypair ` — Path to Solana keypair JSON file - `--api-key ` — Override API key ``` From `references/commands.md:18`: ```bash proxygate login --key pg_live_... # authenticate with API key ``` ### Technical Analysis The documented workflows place ProxyGate API keys, upstream API keys, and OAuth tokens directly in command-line arguments. Once placeholders are replaced with real credentials, those values may become visible through: - Shell history files. - Process listings such as `ps`, `/proc//cmdline`, or process-monitoring software. - Terminal capture and session-recording systems. - CI/CD logs and command tracing. - Agent transcripts or tool-execution logs. - Crash diagnostics and observability platforms that record process arguments. This conflicts with the principle that sensitive values should be transmitted using channels designed to suppress disclosure, such as protected standard input, no-echo interactive prompts, credential stores, or restricted-permission secret files. The documented `--gateway ` option inc ...[truncated 2516 chars]
Remediation: View remediation
--key-stdin`. - Alternatively, prompt securely when a secret option is ...[truncated 13 chars]

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (5)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: pg-sell description: Use when selling API capacity on ProxyGate — creating listings, managing listings (update/pause/delete), rotating keys, uploading docs, starting tunnels, managing headers, viewing earnings, or exposing local services. Make sure to use this skill whenever someone mentions "list API", "sell capacity", "create listing", "start tunnel", "expose service", "earnings", "go live", "monetize API", "rotate key", "pause listing", or wants to make their API available on ProxyGate. --- # ProxyGate — Sell API Capacity

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger description is broad enough to activate on generic phrases like "go live," "earnings," or "expose service," which may route unrelated user requests into a skill that creates listings, rotates keys, or opens tunnels. In an agent setting, overbroad routing can cause inappropriate actions or advice in a sensitive workflow involving publication of APIs and exposure of local services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill encourages creating listings and starting tunnels but does not warn that doing so may expose local services and send request/response traffic through ProxyGate infrastructure. Users may unknowingly publish internal endpoints, documentation, headers, or sensitive data flows without understanding the security and privacy implications.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill is described as being for selling API capacity on ProxyGate, but this reference file exposes much broader capabilities including buyer-side discovery/proxying, wallet deposit/withdrawal, and job-marketplace operations. In an agent setting, overbroad command documentation can expand the action surface beyond user expectations and skill scope, increasing the risk of unintended purchases, fund movements, or unrelated marketplace actions if the agent uses available commands opportunistically or is prompt-injected.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Job marketplace commands are unrelated to the stated purpose of monetizing and managing API listings, yet they enable creating, claiming, submitting, accepting, and canceling escrow-backed jobs. Including these commands in the same skill creates unnecessary privilege and behavioral scope, making prompt confusion or malicious instruction chaining more dangerous because the agent may perform financially or operationally significant actions outside the user's intended seller workflow.
Content: No source excerpt is available for this finding.