Agent Workforce Orchestration: Hybrid Human+AI Teams

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:35 AM UTC
• Version: 1.3.1

Overview

This is a non-installing guide, but it teaches credentialed automated workforce payment workflows with weak scoping and safety guidance, so users should review it carefully before use.

Treat this as Review-worthy guidance, not drop-in production code. Do not run the snippets with a production GREENHELIX_API_KEY unless the key is least-privilege, the endpoint is confirmed sandbox or explicitly intended, and payment releases, dispute settlement, budget limits, worker consent, privacy controls, and tax/compliance obligations have been redesigned and reviewed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:970

Finding

Unvalidated Caller-Controlled Escrow Release Amount

Content

View full analysis

dict: """Release a specific milestone payment from escrow.""" result = execute("release_escrow", { "escrow_id": task.escrow_id, "amount_usd": str(amount_usd), "release_type": "partial", "reason": f"Milestone completed: {milestone_name}", "metadata": { "task_id": task.task_id, "milestone": milestone_name, }, }) # Record the payment as a transaction execute("record_transaction", { "agent_id": ORCHESTRATOR_ID, "type": "milestone_payment", "counterparty_id": task.assigned_worker_id, "amount_usd": str(amount_usd), "metadata": { "task_id": task.task_id, "milestone": milestone_name, "escrow_id": task.escrow_id, }, }) return result ``` ### Technical Analysis The example passes the caller-provided `amount_usd` directly to the authenticated `release_escrow` operation. It does not verify that: - The amount is positive and finite. - The named milestone exists in the escrow agreement. - The milestone has been completed and approved. - The milestone has not already been paid. - The requested amount equals the milestone's authorized amount. - The amount is less than or equal to the remaining escrow balance. - The caller is authorized to approve this milestone. - The request has an idempotency key preventing duplicate releases. The `milestone_name` is also caller-controlled and is used only as descriptive metadata. It is not resolved against an immutable milestone record. The subsequent transaction record does not prevent the release; it merely logs ...[truncated 1488 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:1655

Finding

Unsafe Arithmetic in Automated Financial Dispute Resolution

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:1440

Finding

Race-Prone and Non-Durable Budget Enforcement Allows Limit Bypass

Content

View full analysis

amount spent def _key(self, *parts: str) -> str: return ":".join(parts) def record_spend(self, worker_id: str, project_id: str, amount_usd: float): """Record a spend event and check limits.""" month = datetime.now(timezone.utc).strftime("%Y-%m") keys = [ self._key("worker", worker_id, month), self._key("project", project_id, month), self._key("total", month), ] for key in keys: self._spent[key] = self._spent.get(key, 0) + amount_usd def check_budget(self, worker: WorkerProfile, project_id: str, proposed_amount: float) -> dict: """Check if a proposed spend is within budget limits.""" month = datetime.now(timezone.utc).strftime("%Y-%m") violations = [] # Check per-task limit if proposed_amount > self.config.max_per_task_usd: violations.append( f"Task amount ${proposed_amount} exceeds " f"per-task limit ${self.config.max_per_task_usd}" ) # Check per-escrow limit if proposed_amount > self.config.max_single_escrow_usd: violations.append( f"Escrow amount ${proposed_amount} exceeds " f"single escrow limit ${self.config.max_single_escrow_usd}" ) # Check per-worker monthly limit worker_key = self ...[truncated 4656 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide claims no API key is required to get started, yet the code examples unconditionally read GREENHELIX_API_KEY and prepare authenticated requests. This mismatch can mislead users into running code with production credentials or believing examples are harmless sandbox-only flows when they are capable of making authenticated state-changing API calls.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file describes itself as a non-executing educational guide, but later includes top-level code that bootstraps agents, wallets, escrows, messaging, and orchestration cycles. If copied or executed, this code can create identities, move into payment flows, and send data to an external service, so the 'non-executing' framing understates operational risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The guide processes human worker emails, payment flows, reputation data, invoices, compliance records, and tax-related reporting without strong privacy, consent, or real-world risk warnings. In a workforce/payments context, users may replicate these patterns and expose personal or financial data to third-party systems without understanding the regulatory and privacy implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The natural-language guidance says the system should treat human gig workers and AI agents as interchangeable economic units, which is a strong policy posture affecting how people are categorized and managed. This framing is presented as a default organizational approach rather than an optional, justified, or context-limited model.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The code establishes authenticated communication with an external API endpoint and uses a bearer token from the environment. In context, this is expected functionality, but it is still security-relevant because the examples include registration, payments, messaging, escrow, and compliance operations that transmit sensitive operational and financial data off-platform.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md

import os
from datetime import datetime, timezone

API_BASE = "https://api.greenhelix.net/v1"

session = requests.Session()
session.headers["Authorization"] = f"Bearer {os.environ['GREENHELIX_API_KEY']}"

Static analysis

No suspicious patterns detected.