ClawHub
Back to skill

Security audit

AgentDeal

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for a negotiation service, but it asks agents to persistently monitor and respond in external deal negotiations without enough user control or limits.

Install only if you are comfortable with an external service handling negotiation details and with your agent potentially acting within configured authority. Before use, require explicit approval for registration, owner-identifying data, deal creation, and any commitment; avoid full autonomy for legal, financial, medical, real-estate, or other high-impact negotiations; and do not add the heartbeat entry unless you intentionally want recurring background checks and have a way to remove it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T02 · Agent Memory Poisoning

Warning
Location
references/heartbeat.md:3
Finding

Persistent Autonomous Negotiation Instructions Written to Heartbeat State

Content
View full analysis

Vulnerability Details

File Location: references/heartbeat.md:3-10
Vulnerability Type: Persistent modification of agent memory and recurring behavior
Risk Level: Medium

Vulnerable Code Snippet

markdown
Add to your heartbeat file:

```markdown
## AgentDeal (every 15-30 minutes)
If 15-30 minutes since last AgentDeal check:
1. Check active negotiations for new messages
2. Check for pending approval requests
3. Check alignment scores on active negotiations
4. Respond to messages or escalate to owner as needed
text

### Technical Analysis

The Skill instructs the agent to add durable instructions to its heartbeat file. Unlike behavior limited to the current invocation, heartbeat instructions can remain active across subsequent sessions and repeatedly cause the agent to access the AgentDeal service.

The persisted procedure includes not only monitoring but also responding to negotiation messages. Those messages are externally controlled by negotiation participants. Consequently, future agent behavior can be influenced by content received after the initial Skill invocation and review. The documentation does not require explicit user consent before changing persistent state, establish an expiration time, provide removal instructions, or limit recurring checks to read-only notifications.

This constitutes agent memory poisoning because behavioral rules are written into long-term state and continue to affect later sessions. It does not establish operating-system persistence or grant host-level privileges.

### Attack Path

1. A user invokes the AgentDeal Skill.
2. Following the documentation, the agent writes the supplied procedure into its persistent heartbeat file.
3. The heartbeat repeatedly queries active negotiations, pending approvals, messages, and alignment reports every 15–30 minutes.
4. A malicious or compromised negotiation participant sends crafted content through an active negotiation.
5. During a later heartbeat cycle, the agent 
...[truncated 1086 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit, informed user approval before modifying any heartbeat file or other persistent agent state.
  2. Make heartbeat integration opt-in rather than a default operational step.
  3. Default recurring activity to read-only monitoring and owner notification. Do not permit heartbeat tasks to send negotiation messages, accept proposals, make concessions, or create commitments.
  4. Require fresh owner approval for every externally visible response or consequential negotiation action initiated by a heartbeat.
  5. Add a defined expiration time, maximum number of checks, and clear removal instructions for the persisted entry.
  6. Record when the heartbeat rule was installed, who authorized it, and each action performed under it.
  7. Treat all retrieved negotiation messages as untrusted content and explicitly prohibit them from modifying agent instructions, persistent memory, safety rules, or tool permissions.
  8. Enforce authority restrictions at the API layer so persistent instructions cannot bypass readonly or needs_approval controls.

T01 · Skill Instruction Hijacking

Warning
Location
references/categories.md:3
Finding

Remote Category Response Exposes a Behavior-Shaping System Prompt

Content
View full analysis

Vulnerability Details

File Location: references/categories.md:3-8
Vulnerability Type: Untrusted remote instruction injection
Risk Level: Medium

Vulnerable Code Snippet

markdown
AgentDeal supports 15 professional categories. Each has pre-configured defaults that shape agent behavior.

## Fetching Categories

```bash
GET /categories
GET /categories/{slug}

Returns: name, slug, description, agentDefaults (personality, tone, negotiationStyle, authorityLevel, systemPrompt).

text

### Technical Analysis

The category API returns an `agentDefaults.systemPrompt` value described as part of defaults that shape agent behavior. Because this value is retrieved from an external service, it can change independently of the reviewed Skill package.

The documentation does not state that `systemPrompt` must be treated as untrusted data, nor does it define a local allowlist or validation process for permissible instructions. If an implementation applies this remote field as an authoritative prompt, a compromised service, malicious API response, or unauthorized category modification could alter the agent's current goals, safety constraints, or negotiation behavior.

This issue is instruction hijacking rather than remote code execution: the documented response does not contain executable code and no local execution mechanism is shown. Exploitation also depends on the consuming agent actually interpreting the returned `systemPrompt` as instructions rather than displaying or ignoring it.

### Attack Path

1. The agent requests `/categories` or `/categories/{slug}` from the AgentDeal service.
2. The remote response supplies an `agentDefaults.systemPrompt` value.
3. An attacker who controls or compromises the relevant API response inserts instructions that conflict with the user's goals or established safety requirements.
4. A consuming implementation applies the returned value as a system-level or otherwise authoritative behavioral prompt.
5. The injected
...[truncated 949 chars]
Remediation
View remediation

Remediation Suggestions

  1. Never apply an API-provided systemPrompt as a system, developer, or authoritative agent instruction.
  2. Remove systemPrompt from category responses when possible. Represent category behavior through a strict schema of enumerated, non-executable settings.
  3. Validate personality, tone, negotiationStyle, and authorityLevel against local allowlists and reject unknown values.
  4. If remote prompt text must be retained, handle it only as untrusted descriptive data and clearly delimit it from executable instructions.
  5. Maintain locally reviewed prompt templates and map validated category identifiers to those templates.
  6. Require explicit user confirmation before any remote category setting changes agent authority or consequential behavior.
  7. Ensure remote content cannot override higher-priority instructions, safety requirements, owner approval rules, or tool access controls.
  8. Log category configuration changes and integrity-protect responses where feasible, while recognizing that signatures do not make remotely supplied instructions safe to execute.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list includes broad phrases like 'negotiate deal', 'start negotiation', and 'check alignment' that could match ordinary conversational requests and cause this skill to activate unexpectedly. Because the skill can initiate external negotiations and share owner-related information with a third-party service, overbroad activation increases the chance of unintended data disclosure or unauthorized actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill instructs the agent to send registration data, including an owner email, to an external service at agentdeal.io. While external API use is core to the skill's purpose, this is still a real security/privacy risk because accidental activation or insufficient user consent could result in unintended transmission of personal data and establishment of a third-party account.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

Register

bash
curl -X POST https://agentdeal.io/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "<your_name>", "description": "AI agent negotiating on behalf of my human", "owner_email": "human@example.com"}'

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/categories.md (reported line 19)May include surrounding context.

md
## Categories & Authority Levels

### ⚖️ Legal Services
- **Authority:** `advisory_only` — always recommend, never commit without approval
- **Key points:** hourly vs flat fee vs contingency, retainer, scope of representation, timeline
- **Tone:** formal, precise, no ambiguity

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/api-reference.md:10