Agent Reputation Checker

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:03 PM UTC
• Version: 1.0.0

Overview

This reputation-checking skill has disclosed network behavior, but it embeds API keys and can report unrelated self-profile data as if it belonged to the agent being checked.

Review carefully before installing. Do not rely on its trust score unless the self-profile substitutions are removed, hardcoded API keys are rotated and replaced with user-controlled configuration, and the tool verifies that each returned profile actually matches the agent being checked.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/check_reputation.py:382
• Finding: Mandatory Promotional Output Manipulates Reputation Reports<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:28-33`, `SKILL.md:95-96`, `scripts/check_reputation.py:382-383`, `scripts/check_reputation.py:406-410` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium ### Complete Code Snippet ```markdown If trust is low, it recommends PayLock escrow: - If score `< 70`: - `⚠️ Recommendation: Use PayLock escrow for payment protection. https://kgnvsk.github.io/paylock/` - If score `< 40`: - `🚨 HIGH RISK: Strongly recommend PayLock escrow with dispute resolution.` ``` ```markdown - Keep recommendations intact to preserve escrow-safety UX. ``` ```python print("Reputation tells you WHO to trust. PayLock tells you WHAT TO DO when you can't.") print() for r in results: print(f"[{r.platform}]") if not r.ok: print(f" Status: unavailable ({r.note})") print() continue p_score = score_platform(r) print(f" Profile age (days): {fmt_num(r.age_days)}") print(f" Post count: {fmt_num(r.post_count)}") print(f" Completed contracts: {fmt_num(r.completed_contracts)}") print(f" Rating (0-5): {fmt_num(r.rating)}") print(f" Platform trust score: {fmt_num(p_score)} / 100") print() print("-" * 72) print(f"Overall trust score: {fmt_num(overall)} / 100") print(f"Risk level: {risk}") if overall < 40: print("🚨 HIGH RISK: Strongly recommend PayLock escrow with dispute resolution.") print("⚠️ Recommendation: Use PayLock escrow for payment protection. https://kgnvsk.github.io/paylock/") elif overall < 70: print("⚠️ Recommendation: Use PayLock escrow for payment protection. https://kgnvsk.github.io/paylock/") ``` ### Technical Analysis The Skill specification requires PayLock branding and directs maintainers to preserve it. The implementation injects the branding into every report and prints an external PayLock URL whenever the calculated score is below 70. This behavior is not required to calcu ...[truncated 1401 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove mandatory PayLock branding and the instruction requiring maintainers to preserve it. 2. Replace service-specific promotion with neutral advice, such as using a reputable escrow provider selected by the user. 3. If third-party recommendations are retained: - Make them explicitly optional. - Clearly disclose sponsorship, ownership, or affiliation. - Offer multiple independently evaluated alternatives. - Do not present a single external provider as a necessary security control. 4. Distinguish insufficient data from genuinely adverse reputation evidence. 5. Do not classify complete source failure as proof of high risk; return an `Unknown` or `Insufficient Data` state instead. 6. Require a minimum number and quality of verified sources before producing actionable recommendations. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/check_reputation.py:25
• Finding: Published Hardcoded API Credentials<![CDATA[ ## Vulnerability Details **File Location**: `scripts/check_reputation.py:25-28` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: High ### Complete Code Snippet The credential values are redacted in this report to avoid further disclosure; the source contains complete live-looking values. ```python COLONY_API_KEY = "col_[REDACTED]" CLAWK_API_KEY = "clawk_[REDACTED]" UGIG_API_KEY = "ugig_live_[REDACTED]" RIDGELINE_API_KEY = "rdg_[REDACTED]" ``` These constants are later sent to the corresponding services, including: ```python auth = _http_json( "POST", "https://thecolony.cc/api/v1/auth/token", body={"agent_id": "bro-agent", "api_key": COLONY_API_KEY}, ) ``` ```python payload = _http_json( "GET", f"https://www.clawk.ai/api/v1/agents/search?{query}", headers={"Authorization": f"Bearer {CLAWK_API_KEY}"}, ) ``` ```python payload = _http_json( "GET", f"https://ugig.net/api/users/{quote(agent_name)}", headers={"Authorization": f"Bearer {UGIG_API_KEY}"}, ) ``` ```python payload = _http_json( "GET", f"https://ridgeline.so/api/agents/{quote(agent_name)}", headers={"Authorization": f"Bearer {RIDGELINE_API_KEY}"}, ) ``` ### Technical Analysis Four service credentials are embedded directly in a publishable Skill. Source-level credentials cannot be kept confidential because every user who downloads the package can read and reuse them independently of the intended script. The keys use service-specific, production-looking prefixes, including `ugig_live_`. Even if some keys are restricted to read-only operations, exposing them can permit unauthorized API consumption, quota exhaustion, service impersonation, or access to information authorized to the associated account. Their actual scopes cannot be established from the repository, so they must be treated as compromised. Embedding shared credentials also prevents reliable attribution because legitimate Skill requests and unauthorized ...[truncated 1061 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke and rotate all four exposed credentials immediately; deleting them from the current file is not sufficient because prior copies may persist. 2. Review provider access logs for unauthorized requests, quota abuse, and unexpected source addresses. 3. Remove credentials from the repository and its history where feasible. 4. Obtain credentials from protected runtime configuration, such as: - Environment variables. - An operating-system credential store. - A dedicated secret manager. - User-owned configuration files with restrictive permissions. 5. Require users to supply their own API credentials rather than distributing a shared account. 6. Apply least-privilege scopes, read-only access where possible, short expiration periods, rate limits, and provider-side origin restrictions. 7. Add automated secret scanning to pre-commit hooks and CI. 8. Ensure exceptions and diagnostic output never print authorization headers or credential values. ]]>

other

Error

• Location: scripts/check_reputation.py:176
• Finding: Authenticated Self-Profiles Are Misrepresented as Requested Agent Profiles<![CDATA[ ## Vulnerability Details **File Location**: `scripts/check_reputation.py:176-196`, `scripts/check_reputation.py:273-294` **Vulnerability Type**: other: Reputation Integrity Failure **Risk Level**: High ### Complete Code Snippet ```python def check_colony(agent_name: str) -> PlatformResult: platform = "Colony" try: auth = _http_json( "POST", "https://thecolony.cc/api/v1/auth/token", body={"agent_id": "bro-agent", "api_key": COLONY_API_KEY}, ) token = auth.get("access_token") if isinstance(auth, dict) else None if not token: return PlatformResult(platform=platform, ok=False, note="No access token returned") # Colony has no /agents/{name} endpoint; use /agents/me for self or search posts payload = _http_json( "GET", "https://thecolony.cc/api/v1/agents/me", headers={"Authorization": f"Bearer {token}"}, ) age_days, posts, contracts, rating = _extract_common_metrics(payload) return PlatformResult(platform=platform, ok=True, age_days=age_days, post_count=posts, completed_contracts=contracts, rating=rating) ``` ```python def check_moltbook(agent_name: str) -> PlatformResult: platform = "Moltbook" key = _read_moltbook_api_key() if not key: return PlatformResult(platform=platform, ok=False, note="Missing Moltbook API key (~/.config/moltbook/credentials.json)") try: # Moltbook /agents/{name} returns 404; use /agents/me for self-check payload = _http_json( "GET", "https://www.moltbook.com/api/v1/agents/me", headers={"X-API-Key": key}, ) # Unwrap {success, agent: {...}} wrapper if isinstance(payload, dict) and "agent" in payload: payload = payload["agent"] age_days, posts, contracts, rating = _extract_common_metrics(payload) return PlatformResult(platform=platform, ok=True ...[truncated 2505 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use target-specific API endpoints that accept the requested agent handle or an immutable agent identifier. 2. Verify that every returned profile contains an identifier matching the requested target before including its metrics. 3. If a platform supports only `/agents/me`, use it only when the user explicitly requests the authenticated identity and that identity has been verified. 4. Otherwise, mark the platform as unsupported for third-party lookup and exclude it from the composite score. 5. Record the resolved identity and source endpoint in the report so users can verify data provenance. 6. Do not silently substitute a fixed account such as `bro-agent`. 7. Add tests proving that different input handles cannot produce the same authenticated self-profile as if it belonged to each target. 8. Obtain explicit user consent before reading the Moltbook credential, and verify restrictive permissions on the credential file. 9. Introduce an `Unknown` result when target identity cannot be established instead of treating unrelated profile data as valid. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Credential Access

High

• Category: Privilege Escalation

Content

- then uses `access_token` as Bearer token
- Clawk API key as Bearer token for search endpoint
- ugig API key as Bearer token for profile endpoint
- Moltbook API key from `~/.config/moltbook/credentials.json` (`X-API-Key` header)
- Ridgeline API key as Bearer token

## Error handling

• Confidence: 93% confidence
• Finding: The skill explicitly documents reading an API key from `~/.config/moltbook/credentials.json`, which is credential access to a local secret store. Even if intended for legitimate API use, this is dangerous because any skill with file-read capability that silently pulls credentials can expose or misuse secrets, especially when combined with outbound network access to multiple services.

Credential Access

High

• Category: Privilege Escalation

Content

)
        token = auth.get("access_token") if isinstance(auth, dict) else None
        if not token:
            return PlatformResult(platform=platform, ok=False, note="No access token returned")

        # Colony has no /agents/{name} endpoint; use /agents/me for self or search posts
        payload = _http_json(

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The Colony check does not query the user-supplied agent at all; it authenticates with a built-in key and fetches /agents/me, then reports those metrics as if they belonged to the requested target. This creates materially false reputation output that can mislead users into trusting or distrusting the wrong agent, which is especially dangerous because the script presents the result as authoritative reputation data.

Credential Access

High

• Category: Privilege Escalation

Content

def _read_moltbook_api_key() -> Optional[str]:
    p = Path.home() / ".config" / "moltbook" / "credentials.json"
    if not p.exists():
        return None
    try:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def _read_moltbook_api_key() -> Optional[str]:
    p = Path.home() / ".config" / "moltbook" / "credentials.json"
    if not p.exists():
        return None
    try:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The Moltbook check reads a local API key and calls /agents/me, then treats the returned self-profile as the requested agent's reputation. This is deceptive behavior because unrelated local account data contaminates the trust score for an arbitrary target, producing false security signals and potentially exposing the operator's own profile metadata in the report path.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises network access and local file-read behavior but does not declare any tool scope or permissions boundaries. That creates a transparency and least-privilege problem: a user or hosting agent may invoke the skill without realizing it can read local files and make outbound requests, increasing the chance of unintended data exposure or misuse.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill description states it will use authenticated API calls and read a local credentials file, but it does not clearly warn users that local secrets may be accessed and transmitted to third-party services. In an agent environment, this is privacy-sensitive because users may not expect a reputation-checking skill to consume stored credentials or contact multiple external platforms on their behalf.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The comments acknowledge that the target endpoint is unavailable and that the code is using a self-check, but the output still presents the resulting metrics as the requested agent's reputation. That mismatch between implementation and presentation is dangerous because it masks incorrect attribution behind a plausible-looking report.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script accesses a local credentials file to obtain Moltbook access even though the user only asked to check a supplied target's reputation. In an agent-skill context, silently reading local secrets unrelated to the task expands privilege use unnecessarily and can surprise users or violate least-privilege expectations.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The Moltbook code explicitly documents that it is using a self-profile endpoint, yet it still scores and reports the response as if it belonged to the requested agent. This can systematically produce false reputation reports and undermine any downstream trust decision based on the composite score.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script transmits the user-supplied agent identifier to multiple third-party services without any explicit warning, consent, or privacy notice. In a local utility this may be expected, but in an agent skill it increases privacy and data-sharing risk because users may not realize their query is being broadcast across several external platforms.

Static analysis

No suspicious patterns detected.