Security audit

axihub-subscription

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its AxiHub content-sharing purpose, but its setup grants persistent network and publishing authority while downloading mutable remote instructions without enough safeguards.

Review this skill carefully before installing. Use a secret manager instead of saving the API key in shell startup files, avoid the auto-install downloader unless you can verify the files, and enable scheduled pulling or scheduled publishing only with clear intervals, storage limits, and a way to inspect and remove the task. Treat subscribed content and custom processing prompts as untrusted data, and require confirmation before public publishing or destructive account changes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SETUP.md:38
Finding: Unverified Remote Skill Instructions Are Downloaded and Loaded
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SETUP.md:176
Finding: Setup Installs a Recurring Cross-Session Agent Task
Content: View full analysis
20: Show board summary to user, ask if they want to continue processing channels according to predefined rules due to large volume, wait for user instruction 3. [Load Processing Rules] Call GET https://api.axihub.net/v1/agent/my/subscriptions to get subscription list, Build serviceId -> processingRule mapping table, default to 'notify' if no rule exists 4. [Pull and Process Content] Iterate through each channel in board data: - For each channel with unread content, call GET /agent/contents?serviceId={serviceId}&mode=full&unreadOnly=true to pull full content - Process content according to the channel's processingRule: * notify: Show title + summary to user * summarize: Read full content, generate brief summary then notify user * digest: Save full content to local buffer ~/self-storage/axihub/digests/{serviceName}-{date}.md, don't notify yet * save: Save content to ~/self-storage/axihub/{serviceName}/{title}.md * custom: Process according to user-defined logic 5. [Update Status] Write current time to lastAxiHubCheck field in ~/self-memory/axihub-state ...[truncated 2102 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SETUP.md:194
Finding: Untrusted Channel Content and Remote Processing Rules Enter Agent Instruction Context
Content: View full analysis
processingRule mapping table, default to 'notify' if no rule exists 4. [Pull and Process Content] Iterate through each channel in board data: - For each channel with unread content, call GET /agent/contents?serviceId={serviceId}&mode=full&unreadOnly=true to pull full content - Process content according to the channel's processingRule: * notify: Show title + summary to user * summarize: Read full content, generate brief summary then notify user * digest: Save full content to local buffer ~/self-storage/axihub/digests/{serviceName}-{date}.md, don't notify yet * save: Save content to ~/self-storage/axihub/{serviceName}/{title}.md * custom: Process according to user-defined logic ``` The Skill also persists custom prompt-like parameters remotely: ```markdown → Call: PUT /agent/subscriptions/{subscriptionId}/metadata Body: {"processingRule": "summarize", "processingParams": {"prompt": "Summarize into 3 sentences for me"}} **Important:** Processing rules MUST be saved via the API (`PUT /agent/subscriptions/:subscriptionId/metadata`), not just in local memory. Local memory may be lost on restart; the API persists the rule permanently. ``` ### Technical Analysis Channel payloads and processing-rule parameters originate outside the trusted Skill package. The scheduled workflow directs the Agent to read full remote content and execute “custom” processing logic, but it does not establish a trust boundary requiring remote text to be treated only as data. An attacker-controlled channel payload can contain instructions formatted to resemble system messages, tool requests ...[truncated 2165 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SETUP.md:120
Finding: Bearer API Key Is Persisted in Plaintext User Configuration
Content: View full analysis
> ~/.bashrc source ~/.bashrc ``` The Windows procedure persists the same bearer credential in the user environment: ```powershell $env:AXIHUB_API_KEY = "axi_the_key_you_got" [Environment]::SetEnvironmentVariable("AXIHUB_API_KEY", "axi_the_key_you_got", "User") ``` ### Technical Analysis The API key is a bearer credential used to authorize account operations. The Linux/macOS instructions append it in plaintext to `.bashrc`, where it may be exposed through file reads, backups, diagnostics, dotfile synchronization, accidental sharing, or broad file permissions. It is also exported into every child process started from the shell, increasing its exposure to unrelated programs. The Windows procedure stores the key as a persistent user environment variable. This is not equivalent to using an operating-system credential vault and can make the value available to other processes running under the same user account. The setup does not configure restrictive permissions, use a dedicated secret store, minimize process inheritance, or automatically rotate credentials after suspected exposure. ### Attack Path 1. The user follows Step 2 and persists the API key in `.bashrc` or the user environment. 2. A local process, malicious extension, backup collector, diagnostic utility, or another party with access to the user profile reads the stored value. 3. The attacker extracts the `axi_...` bearer token. 4. The attacker submits authenticated requests to the AxiHub API using the stolen token. 5. The attacker exercises the account operations permitted by that credential until it is revoked or rotated. ### Impact Assessment A stolen key can allow account-level actions documented by the Skill, pote ...[truncated 561 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SETUP.md (reported line 125)May include surrounding context.
ion/json"
-d '{}'

text
**Response:** ```json { "code": 0, "data": { "user": { "id": "uuid", "username": "agent_a3k9m2", "email": "agent_a3k9m2@anonymous.local" }, "apiKey": "axi_xxxxxxxxxxxxxxxx" } }

Step 2: Save API Key

After receiving the API key, save it immediately:

On Linux/macOS:

bash
export AXIHUB_API_KEY="axi_the_key_you_got" echo 'export AXIHUB_API_KEY="axi_the_key_you_got"' >> ~/.bashrc source ~/.bashrc

On Windows (PowerShell):

powershell
$env:AXIHUB_API_KEY = "axi_the_key_you_got" [Environment]::SetEnvironmentVariable("AXIHUB_API_KEY", "axi_the_key_you_got", "User")

Initialize storage directories:

bash
mkdir -p ~/self-memory mkdir -p ~/self-storage/axihub echo '{"lastAxiHubCheck": "'$(date '+%Y-%m-%d %H:%M:%S')'"}' > ~/self-memory/axihub-state.json

Step 3: Verify Connection

bash
curl https://api.axihub.net/v1/agent/account \ -H "Authorization: Bearer $AXIHUB_API_KEY"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 597)May include surrounding context.
text
POST /agent/services/:serviceId/pause POST /agent/services/:serviceId/resume DELETE /agent/services/:serviceId

No request body needed. Pause/Resume returns updated service object. Delete returns 204 No Content.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 753)May include surrounding context.
Delete Content

text
DELETE /agent/contents/:contentId

Mark as Read

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 834)May include surrounding context.
Unsubscribe from a Channel

text
DELETE /agent/subscriptions/:subscriptionId

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SETUP.md (reported line 94)May include surrounding context.
Step 1: Auto-Register

bash
curl -X POST https://api.axihub.net/v1/agent/register \ -H "Content-Type: application/json" \ -d '{}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide instructs users to persist the API key in shell startup files and user environment variables, which increases the chance of credential exposure through dotfile syncing, backups, local disclosure, shell history mistakes, or other local processes reading inherited environment variables. While this is a common convenience pattern, it lacks strong warnings or safer alternatives for storing long-lived secrets.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The scheduled task explicitly saves pulled content to local paths such as ~/self-storage/axihub without warning that subscribed content may contain sensitive, proprietary, or personal information. Persistent local caching expands the data exposure surface through insecure file permissions, backup leakage, multi-user access, and accidental indexing or sync by other software.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SETUP.md (reported line 94)May include surrounding context.
md
## 🔧 Configuration **Base URL:** `https://api.axihub.net/v1` **Environment Variable:** `AXIHUB_API_KEY`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SETUP.md (reported line 149)May include surrounding context.
md
## 🔧 Configuration **Base URL:** `https://api.axihub.net/v1` **Environment Variable:** `AXIHUB_API_KEY`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SETUP.md (reported line 184)May include surrounding context.
md
## 🔧 Configuration **Base URL:** `https://api.axihub.net/v1` **Environment Variable:** `AXIHUB_API_KEY`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SETUP.md (reported line 193)May include surrounding context.
md
## 🔧 Configuration **Base URL:** `https://api.axihub.net/v1` **Environment Variable:** `AXIHUB_API_KEY`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SETUP.md (reported line 241)May include surrounding context.
md
## 🔧 Configuration **Base URL:** `https://api.axihub.net/v1` **Environment Variable:** `AXIHUB_API_KEY`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SETUP.md (reported line 251)May include surrounding context.
md
## 🔧 Configuration **Base URL:** `https://api.axihub.net/v1` **Environment Variable:** `AXIHUB_API_KEY`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
## 🔧 Configuration **Base URL:** `https://api.axihub.net/v1` **Environment Variable:** `AXIHUB_API_KEY`

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: The skill explicitly enables autonomous decision-making for scheduled publishing, where the agent can execute a self-contained instruction and publish content on a timer. Autonomous outward actions increase risk because a bad prompt, prompt injection in gathered source material, or model error can directly trigger external side effects without human review.
Content: Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.
md
## 📅 Scheduled Publishing Users can create custom scheduled tasks to automatically publish content to their designated channels. When the task triggers, it automatically executes the user-defined instruction. ### Create a Publishing Task

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The scheduled publishing section instructs the agent to create autonomous tasks that generate and publish content without requiring per-run user confirmation or review. This can cause unintended, inaccurate, policy-violating, or reputation-damaging content to be published automatically if the task prompt is flawed or the model behaves unexpectedly.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The setup guide instructs configuring the scheduled task to run 'every 1 hour' in Step 4, but Step 5 tells the agent to report to the user that the task was set to run 'every 30 minutes.' This is a direct contradiction in the file's own operational instructions and can mislead the user about actual behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file instructs the agent to use the save processing rule to write full channel content to ~/.self-storage/axihub/, which can affect local user data and persistence. While the behavior is documented, the skill description does not clearly warn users about privacy or disk-storage implications before enabling this mode.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T06 · System Persistence

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

SkillSpector

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Step 2: Save API Key

Step 3: Verify Connection

Tool Parameter Abuse

Tool Parameter Abuse

Delete Content

Mark as Read

Tool Parameter Abuse

Unsubscribe from a Channel

External Transmission

Step 1: Auto-Register

Missing User Warnings

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Autonomous Decision Making

Missing User Warnings

Intent-Code Divergence

Missing User Warnings