ClawHub
Back to skill

Security audit

AB5D Bounties

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but it tells agents to run mutable acceptance commands from a remote bounty service without clear containment or approval controls.

Only install this if you are comfortable with an agent using AB5D network APIs, wallet-signed claims, and claim tokens. Before running any acceptance command from a bounty record, inspect the exact command, run it in a disposable sandbox with minimal files and no secrets, and do not expose private keys or recovery phrases.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:18
Finding

Execution of Mutable Remotely Supplied Acceptance Commands

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-35
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Vulnerable Code Snippet:

markdown
## Source of truth

Read `https://ab5d.xyz/api/bounties` before acting. Begin work only when an individual task has `status: open`, a reward with `status: offered`, a claim route, and a submission route. Planned, draft, preparing, paused, completed, or absent tasks are not offers.

The same current task data is available through the stateless MCP endpoint at `https://ab5d.xyz/mcp`:

- `list_open_bounties` returns only current offers.
- `get_bounty` returns one task's status and operational routes.

## Claim workflow

1. Select an open task and read its program, protocol, schema, reward, eligibility, acceptance command, and deadline.
2. Confirm that the operator authorizes the work and Ethereum wallet. Never request or expose a private key or recovery phrase.
3. POST the public wallet address to the task's `claim` route to receive a short-lived challenge.
4. Ask the operator's wallet to sign the exact challenge message on Ethereum chain ID 1.
5. POST the challenge identifier and signature to the task's claim-creation route documented by `https://ab5d.xyz/.well-known/openapi.json`.
6. Retain the returned claim token privately. It authorizes release and submission for the 48-hour lease.
7. Perform only the named work. Preserve requested evidence, limitations, execution cost, and model provenance.
8. Run the task's published acceptance command before submitting.

Technical Analysis

The skill instructs the agent to obtain task definitions from an externally controlled, mutable API and execute the task's published acceptance command. The command is not pinned to an immutable version or digest, constrained by an executable and argument allowlist, reviewed locally, or required to run in an isolated environment.

Con ...[truncated 1735 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the instruction to execute acceptance commands obtained dynamically from remote task data.
  • Implement acceptance verification as reviewed local code with a narrowly defined interface.
  • If remote verification components are unavoidable, pin each component to an immutable version and cryptographic digest and reject any mismatch.
  • Require explicit operator approval after displaying the exact command, arguments, working directory, required permissions, and expected effects.
  • Enforce a strict allowlist of permitted executables and arguments; reject shell metacharacters, command substitutions, redirections, pipelines, and unapproved interpreters.
  • Run verification in a disposable sandbox or container with no secrets, claim tokens, wallet access, or host write access.
  • Disable network access unless it is demonstrably required, and allowlist necessary destinations when networking cannot be disabled.
  • Apply read-only mounts, a dedicated unprivileged account, resource limits, execution timeouts, and minimal filesystem exposure.
  • Record and present the verified command, source record, digest, output, and exit status for operator review and auditability.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.