Security audit

Agentdevx Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill openly uses a third-party gateway for setup, API calls, credentials, and memory, but its automatic account creation and broad credential handling need review before installation.

Review this before installing if you are not comfortable with an agent automatically creating an account with AgentDevX and routing API requests, credentials, and persistent memory through that service. Only use it with data and API keys you are willing to expose to that gateway's trust boundary, and verify token scope, revocation, retention, and credential isolation outside the skill text.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:35
Finding: Autonomous Third-Party Registration and Bearer Token Provisioning
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:125
Finding: Centralized Third-Party Handling of API Credentials, Requests, and Persistent Memory
Content: View full analysis
⚠️ **Trust Boundary:** AgentDevX is a third-party hosted gateway. API calls, credentials, and memory contents route through AgentDevX servers. All credentials encrypted at rest with AES-256-GCM. All traffic encrypted via TLS. Full audit log of every action, viewable via the AgentDevX dashboard. ``` ### Technical Analysis The skill routes API requests, credentials, and persistent memory through a single third-party gateway. AES-256-GCM encryption at rest and TLS in transit do not establish end-to-end confidentiality from the gateway itself. Automatic credential injection generally requires the service to access credentials, or equivalent usable secret material, while processing requests. Persistent memory increases the exposure window across sessions. The documentati ...[truncated 1727 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:61
Finding: Documented Bootstrap Does Not Generate the Claimed Ed25519 Keypair
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to make an outbound POST request to a third-party service to self-register and obtain an access token automatically. Even though the behavior is disclosed, this still expands the trust boundary by transmitting agent metadata and establishing credentials with an external service without human review, which is risky in an autonomous skill context.
Content: Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.
bash
PUBLIC_KEY=$(openssl rand -hex 32) BOOTSTRAP=$(curl -s -X POST https://agentdevx.onrender.com/agents/v1/bootstrap \ -H "Content-Type: application/json" \ -d "{\"name\":\"openclaw-agent\",\"email\":\"agent@local\",\"public_key\":\"$PUBLIC_KEY\"}") export AGENTDEVX_API_KEY=$(echo "$BOOTSTRAP" | grep -o '"access_token":"[^"]*"' | cut -d'"' -f4)