Security audit
Security checks for vulnerabilities and agentic risk
The skill has a plausible verification purpose, but its documentation and scripts include unsafe installation guidance and under-scoped optional monitoring and AI checks.
Review carefully before installing. Prefer the local install command from SKILL.md after inspecting the scripts, do not use the README curl-to-bash installer, do not schedule watch directly in cron, and avoid --ai-check on sensitive files unless you are comfortable sending file excerpts to the configured Ollama environment. Do not rely on this as a strict completion gate until the placeholder and AI verdict handling bugs are fixed.
README.md:29Unverified Remote Installer Is Piped Directly into Bash
proof-of-work.sh:621Cron Instructions Repeatedly Launch a Nonterminating Watch Process
proof-of-work.sh:231Detected Placeholder Content Does Not Fail Verification
proof-of-work.sh:346AI Verdict Parser Treats INCOMPLETE as COMPLETE
The installation instruction pipes a downloaded script directly into bash, which executes unreviewed remote content immediately. If the hosting endpoint, network path, or referenced script is compromised, users can be tricked into running arbitrary code on their systems with the privileges of the invoking user.
curl -L https://example.com/proof-of-work/install.sh | bash
Or manual install:
The use of a shell pipeline into bash removes the opportunity for users or automated controls to inspect the fetched content before execution and is a classic command-chaining anti-pattern. In this context, the README is an installation guide, so readers are likely to copy-paste it verbatim, increasing the chance of arbitrary code execution if the upstream content is altered.
curl -L https://example.com/proof-of-work/install.sh | bash
Or manual install:
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
echo ""
echo "2. Try the first check:"
if command -v proof-of-work &> /dev/null; then
echo " ${BLUE}proof-of-work init${NC}"
echo " ${BLUE}proof-of-work check ~/some-file.md${NC}"
else
echo " ${BLUE}$POW_DIR/proof-of-work.sh init${NC}"
echo " ${BLUE}$POW_DIR/proof-of-work.sh check ~/some-file.md${NC}"
fi
echo ""
echo "3. Set up cron monitoring (optional):"
echo " ${BLUE}crontab -e${NC}"
echo " Add: ${BLUE}0 * * * * $POW_DIR/proof-of-work.sh watch${NC}"
echo ""
echo "4. Read the documentation:"
echo " ${BLUE}$SCRIPT_DIR/README.md${NC}"
echo ""
The README advertises AI-powered checks via Ollama/Heartbeat Kit but does not clearly disclose that file contents may be transmitted to another local or remote inference service for analysis. In a tool designed to inspect agent outputs, those files may contain sensitive data, so missing disclosure and consent language creates a real privacy and data-handling risk.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
fi
echo ""
echo "3. Set up cron monitoring (optional):"
echo " ${BLUE}crontab -e${NC}"
echo " Add: ${BLUE}0 * * * * $POW_DIR/proof-of-work.sh watch${NC}"
echo ""
echo "4. Read the documentation:"
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
fi
echo ""
echo "3. Set up cron monitoring (optional):"
echo " ${BLUE}crontab -e${NC}"
echo " Add: ${BLUE}0 * * * * $POW_DIR/proof-of-work.sh watch${NC}"
echo ""
echo "4. Read the documentation:"
The availability check is written as if [ ! check_ollama_available ]; then, which tests a non-empty string instead of invoking the function. In bash, that condition does not correctly gate the AI path, so the script can proceed to send file content to ollama run even when Ollama is unavailable, undermining the documented 'skip if unavailable' behavior and causing unintended execution/data handling.
The AI quality check reads up to 2000 bytes from the target file and pipes that content into ollama run llama2 without an explicit warning or confirmation at the moment of transmission. In an agent skill context, checked files may contain secrets, internal documents, or user data, so this creates a real confidentiality risk even if Ollama is local, especially because model backends, logging, or future configuration may expose content unexpectedly.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
log "=== Initializing Proof of Work ==="
log ""
# Create directories
mkdir -p "$POW_DIR"
mkdir -p "$POW_DIR/reports"
success "Created directory: $POW_DIR"
No suspicious patterns detected.