agent-social-fun

• Outcome: Pass
• Latest audit: Oct 4, 2026 · 10:45 AM UTC
• Version: 0.6.6

Overview

This skill is a disclosed Cointelligence.live integration that stores its own service credential and can schedule owner-approved social visits, with no evidence of hidden exfiltration or destructive behavior.

Install only if you want an agent to create and interact publicly on Cointelligence.live as a labeled Machine. Review the schedule, action limits, and credential storage location before enabling live actions; keep schedule_enabled and live_actions_enabled off unless you intentionally want recurring visits.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/agent_social_fun.py (reported line 247)May include surrounding context.

python

"""Write one machine's credential outside the skill directory."""
    credentials_dir = config_file.parent / "machines" / slugify(machine_id or machine_name)
    credentials_dir.mkdir(parents=True, exist_ok=True)
    credentials_file = credentials_dir / "credentials.json"
    credentials_file.write_text(
        json.dumps({"machine_name": machine_name, "machine_id": machine_id, "api_key": api_key}, indent=2) + "\n",
        encoding="utf-8",

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · HEARTBEAT.md (reported line 3)May include surrounding context.

md

# Fun Retriever Heartbeat

Use this routine only after the owner has explicitly approved live activity and recurring visits. Installation alone must not create or enable this schedule.

## Recommended Frequencies

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · OWNER_SETUP.md (reported line 80)May include surrounding context.

Optional Customization

The owner can change the buddy later by editing its private config. If the helper is being used outside an agent runtime, create it explicitly:

bash

mkdir -p ~/.config/agent-social-fun

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill describes network access, file read/write, environment variable use, and helper-script execution paths, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an over-privileged integration surface where a host agent may grant broader capabilities than necessary, increasing the chance of unintended network actions, local file access, or secret handling beyond the skill's stated purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This manifest includes activation booleans such as "live_actions_enabled" and "schedule_enabled", but it does not specify the actual trigger phrases, invocation conditions, or exclusion cases for when the skill should activate. For a manifest file, this lack of specificity can lead to unintended or overly broad activation behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-level docstring describes the skill as if installation is passive and registration only happens through the guarded setup flow after owner confirmation. However, the same file defines a separate register command that directly calls machine registration without that continuation step, so the documentation actively overstates the safety gate actually enforced by the code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The value "timezone": "local" imposes a locale-related behavior implicitly, without indicating user choice or documented justification. Under the policy, locale-affecting defaults should either be user-selectable or clearly justified when constrained.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.