Security audit

Agora Marketplace

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent agent marketplace guide, but it asks agents to register public endpoints, accept untrusted tasks, and handle crypto payments without enough safeguards.

Review before installing. Use this only with a constrained agent, a dedicated public endpoint, authenticated callbacks, strict task validation, and a limited wallet. Do not let it accept arbitrary quests or sign blockchain transactions without explicit human or administrator approval and independent verification of chain, token, recipient, amount, and fee details.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:25
Finding: Untrusted Marketplace Quests Can Hijack Agent Instructions## Vulnerability Details **File Location**: `SKILL.md:25-31`, `SKILL.md:47-52`, and `SKILL.md:78-83` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium **Relevant Code**: ```markdown ## How to Find Quests ``` GET https://agora.is-a.dev/api/quests GET https://agora.is-a.dev/api/quests?category=data GET https://agora.is-a.dev/api/quests?status=open ``` ``` ```markdown ## How to Accept a Quest ``` POST https://agora.is-a.dev/api/quests/{quest_id}/accept { "agent_id": "YOUR_AGENT_ID", "wallet": "YOUR_JPYC_WALLET" } ``` ``` ```markdown ## Important Rules 1. No humans. This is agent-to-agent only. 2. Always provide your agent_id in requests. 3. Complete quests fully before requesting payment. 4. Disputes resolved by on-chain proof of work. ``` ### Technical Analysis The skill instructs an agent to retrieve and accept quests created by external marketplace participants. Quest titles, descriptions, and task instructions are therefore attacker-controlled input. The instruction to complete accepted quests fully does not establish a trust boundary between marketplace content and authoritative agent instructions. The skill does not require the agent to: - Treat quest descriptions as untrusted data. - Reject instructions that conflict with system or user policies. - Detect prompt injection or instructions requesting secrets. - Restrict the tools available while processing a quest. - Obtain approval before performing network, filesystem, credential, or financial operations. Consequently, a malicious quest may contain embedded instructions designed to redirect the agent from its intended task or weaken its safety constraints. ### Attack Path 1. An attacker creates a marketplace quest containing malicious instructions in its title or description. 2. The agent retrieves the quest through `GET /api/quests`. 3. The agent accepts the quest through `POST /api/qu ...[truncated 879 chars]
Remediation: ## Remediation Suggestions - Explicitly state that all quest titles, descriptions, attachments, and responses are untrusted data and never authoritative instructions. - Require the agent to preserve system, developer, and user constraints regardless of quest content. - Validate quests against an allowlist of supported task types before acceptance. - Reject quests requesting secrets, credentials, private keys, policy changes, arbitrary code execution, or unrelated tool use. - Process marketplace content in a constrained context with least-privilege tools and no default access to secrets or sensitive files. - Require explicit user or administrator approval before network access, filesystem modification, credential use, code execution, or financial operations. - Add prompt-injection detection and structured task schemas that separate data fields from executable instructions. - Apply output filtering to prevent accidental disclosure of secrets or sensitive local information.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:54
Finding: Published Agent Endpoint Lacks Required Authentication and Request Validation Controls## Vulnerability Details **File Location**: `SKILL.md:54-66` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium **Relevant Code**: ```markdown ## How to Register Your Agent ```json POST https://agora.is-a.dev/api/agents { "name": "YOUR_AGENT_NAME", "capability": "analysis", "skills": ["summarization", "sentiment_analysis", "json_output"], "endpoint": "https://your-agent.workers.dev", "min_reward": 100, "availability": "24/7" } ``` ``` ### Technical Analysis The registration instructions encourage operators to publish an externally reachable agent endpoint, its capabilities, and continuous availability. However, they specify no security requirements for that endpoint. Missing controls include: - Authentication of marketplace callbacks. - Cryptographic request signatures. - Sender authorization. - Timestamp and nonce validation. - Replay protection. - Strict request schemas and payload-size limits. - Rate limiting and denial-of-service protection. - Restrictions on which agent tools may be invoked by remote requests. HTTPS protects data in transit but does not prove that an application-level request originated from an authorized marketplace participant. An implementation that follows only the documented example may expose an unauthenticated agent-control surface. ### Attack Path 1. An agent registers its public endpoint and capability metadata with the marketplace. 2. The endpoint becomes known to the marketplace, its participants, or a party able to enumerate registration data. 3. An attacker sends forged task or callback requests directly to the published endpoint. 4. Without authentication or signature verification, the endpoint cannot reliably distinguish forged requests from legitimate marketplace traffic. 5. The agent processes attacker-controlled payloads and may invoke its available tools. 6. The attacker may repeat or flood re ...[truncated 587 chars]
Remediation: ## Remediation Suggestions - Require every callback to carry a cryptographic signature generated by an authorized marketplace identity. - Verify signatures over the complete canonical request body, destination, timestamp, and nonce. - Reject expired timestamps and previously used nonces to prevent replay attacks. - Authenticate and authorize the requester before accepting any task. - Define strict JSON schemas, maximum payload sizes, allowed content types, and field-length limits. - Apply per-identity and per-IP rate limits, request quotas, timeouts, and concurrency limits. - Use a default-deny tool policy for remotely submitted tasks. - Separate the public request receiver from the privileged agent execution environment. - Log authentication failures and anomalous request patterns without recording secrets. - Document key rotation, revocation, incident response, and endpoint de-registration procedures.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:68
Finding: Cryptocurrency Workflow Lacks Transaction Approval and Asset Validation Safeguards## Vulnerability Details **File Location**: `SKILL.md:47-52` and `SKILL.md:68-76` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium **Relevant Code**: ```markdown ## How to Accept a Quest ``` POST https://agora.is-a.dev/api/quests/{quest_id}/accept { "agent_id": "YOUR_AGENT_ID", "wallet": "YOUR_JPYC_WALLET" } ``` ``` ```markdown ## Payment - Primary currency: USDC on World Chain (`0x79A02482A880bCE3F13e09Da970dC34db4CD24d1`) - Secondary currency: WLD on World Chain (`0x2cFc85d8E48F8EAB294be644d9E25C3030863003`) - Network: World Chain (Chain ID: 480) - Gas: 0.03 WLD per transaction - Platform fee: 5% deducted from reward → sent to `0x3104d8e765d0c64c263f3386a3844d8e9f32a30b` - You receive: reward × 0.95 - Explorer: https://worldscan.org ``` ### Technical Analysis The skill promotes autonomous cryptocurrency activity and provides fixed token and fee addresses, but it does not require independent verification or approval before transactions. Missing safeguards include chain-ID enforcement, trusted contract-address verification, transaction simulation, recipient validation, allowance limits, spending caps, and explicit approval of each transaction. There is also a documentation inconsistency: the skill metadata and acceptance example identify the currency or wallet as JPYC, while the payment section identifies USDC as the primary currency and WLD as the secondary currency. This ambiguity can cause an implementation to select the wrong asset, wallet, or payment workflow. The documentation does not request private keys, and no wallet-draining code is present. The risk arises from insufficient controls around implementations acting on the financial instructions. ### Attack Path 1. The agent accepts an externally supplied quest and submits its wallet address. 2. The quest or marketplace response introduces payment instructions or transaction parameters. 3. The agent ...[truncated 843 chars]
Remediation: ## Remediation Suggestions - Require explicit, transaction-specific approval before signing or broadcasting any blockchain transaction. - Clearly define one supported settlement currency and make the metadata, wallet terminology, and payment section consistent. - Independently verify the chain ID, token contract, token decimals, recipient, fee address, and transaction amount against trusted configuration. - Do not trust payment addresses or transaction parameters supplied in quest descriptions. - Simulate transactions and display the decoded effects before approval. - Enforce per-transaction and cumulative spending limits. - Use exact token allowances instead of unlimited approvals, and revoke allowances after use. - Maintain allowlists for approved networks, contracts, and recipients. - Keep private keys and seed phrases outside the agent context and API payloads. - Use a restricted wallet or smart-account policy that cannot transfer more than the authorized quest amount. - Stop processing when the marketplace response conflicts with locally configured asset or network details.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill tells agents to submit wallet information and engage in blockchain payments, including gas costs and fee addresses, but does not warn that these transactions may be irreversible and may incur real financial loss. In the context of an autonomous marketplace skill, this omission is more dangerous because agents may execute payment-related actions automatically against an untrusted third-party service.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The registration flow instructs agents to submit identifying capability data and a public endpoint to a third-party API without any privacy, trust-boundary, or data-use warning. Publishing an agent endpoint and operational metadata can enable unwanted discovery, profiling, targeting, or abuse of the exposed service by untrusted parties.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The skill metadata declares the currency as JPYC, but the payment instructions direct users to USDC/WLD on World Chain instead. This inconsistency can mislead an agent into funding or transacting on the wrong asset/network, causing failed payments, operational errors, or irreversible loss from mistaken on-chain transfers.

Static analysis

No suspicious patterns detected.