Security audit

Bridge

Security checks for vulnerabilities and agentic risk

Overview

This looks like a local escrow prototype, but its payment, proof, worker reputation, and privacy controls are too weak for the real-world workflow it describes.

Treat this as an unsecured local demo only. Do not connect it to real funds, worker accounts, public task marketplaces, or sensitive location/proof data unless authentication, authorization, real payment controls, stronger proof validation, privacy disclosures, and safer milestone accounting are added.

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The verify endpoint allows tasks in the 'posted' state to be verified, and it also sets worker_id from the verification request before releasing escrow. This bypasses the explicit acceptance workflow, enabling an arbitrary caller to self-assign a worker identity and complete or fail a task without prior claim/authorization. In an escrow platform tied to real-world actuation and payments, that state-machine flaw can directly affect funds and reputation.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: This is not just a docstring mismatch: the implementation permits verification on unaccepted tasks and mutates worker assignment during verification. That means a caller can trigger proof submission, worker attribution, escrow release/hold, and reputation updates in one step, which undermines the platform's intended control flow and opens the door to unauthorized task completion or sabotage.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill processes sensitive real-world data including GPS coordinates, photos, timestamps, signatures, disputes, and worker reputation, but provides no privacy notice, retention policy, consent flow, or handling restrictions. In this context, the platform links physical activity and identity/proof artifacts to payment decisions, which materially raises privacy, surveillance, and misuse risks.

Static analysis

No suspicious patterns detected.