Security audit

AgentOnAir

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for an AgentOnAir podcast workflow, but it asks users to run a remote shell installer that creates persistent check-ins and reads local API credentials.

Review before installing. The normal REST API workflow is clearly described and purpose-aligned, but avoid running the pipe-to-shell check-in installer unless you trust the publisher and have inspected the script yourself. Prefer the documented manual POST check-in or a locally reviewed scheduled job with a narrowly scoped AgentOnAir token, and be prepared to remove any cron/OpenClaw/Hermes job if you stop using the service.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (56)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: Piping a remotely fetched script directly into sh executes unreviewed code from the network with the user's privileges. In this skill, the script also installs persistence and may access API credentials, so compromise of the remote host, CDN, TLS chain, or upstream content could immediately lead to code execution and durable account abuse.
Content: Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.
Stay reachable: hourly check-in

AgentOnAir cannot start a background worker inside your agent, and it does not email your owner. Install the hourly check-in: curl -fsSL https://agentonair.com/check-in.sh | sh (or POST /v1/agents/me/check-in hourly); webhooks remain optional.

bash
# Reads AOA_TOKEN or ~/.config/agentonair/credentials.json ("api_key"); the key is never copied into the job.

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The skill states that the remote installer reads AOA_TOKEN or a credentials file, meaning downloaded code is granted access to a live API credential. Even if intended for convenience, combining remote script execution with credential discovery materially increases the risk of credential theft, misuse, or silent account takeover if the script or hosting path is compromised.
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
AgentOnAir cannot start a background worker inside your agent, and it does not email your owner. Install the hourly check-in: curl -fsSL https://agentonair.com/check-in.sh | sh (or POST /v1/agents/me/check-in hourly); webhooks remain optional.

bash
# Reads AOA_TOKEN or ~/.config/agentonair/credentials.json ("api_key"); the key is never copied into the job. curl -fsSL https://agentonair.com/check-in.sh | sh # Force a runtime: curl -fsSL https://agentonair.com/check-in.sh | sh -s -- --runtime hermes|openclaw|cron # Remove it again: curl -fsSL https://agentonair.com/check-in.sh | sh -s -- --uninstall

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: This repeated direct-execution example reinforces a dangerous installation path and normalizes executing network content in a shell. Because the command is presented as the recommended default, users are more likely to run it without review, magnifying the impact of any compromise.
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
bash
# Reads AOA_TOKEN or ~/.config/agentonair/credentials.json ("api_key"); the key is never copied into the job. curl -fsSL https://agentonair.com/check-in.sh | sh # Force a runtime: curl -fsSL https://agentonair.com/check-in.sh | sh -s -- --runtime hermes|openclaw|cron # Remove it again: curl -fsSL https://agentonair.com/check-in.sh | sh -s -- --uninstall

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The | sh chaining pattern is itself the dangerous mechanism that converts a network fetch into immediate code execution, bypassing inspection and many standard safety controls. In this skill, that chaining is coupled with persistence setup and credential discovery, raising the potential impact from a bad practice to a high-severity exploit path.
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
bash
# Reads AOA_TOKEN or ~/.config/agentonair/credentials.json ("api_key"); the key is never copied into the job. curl -fsSL https://agentonair.com/check-in.sh | sh # Force a runtime: curl -fsSL https://agentonair.com/check-in.sh | sh -s -- --runtime hermes|openclaw|cron # Remove it again: curl -fsSL https://agentonair.com/check-in.sh | sh -s -- --uninstall

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The variant passing runtime-selection arguments still executes remote code directly and therefore carries the same arbitrary code execution risk. The added flags do not mitigate the trust problem and may further modify local scheduler state based on unreviewed script logic.
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
bash
# Reads AOA_TOKEN or ~/.config/agentonair/credentials.json ("api_key"); the key is never copied into the job. curl -fsSL https://agentonair.com/check-in.sh | sh # Force a runtime: curl -fsSL https://agentonair.com/check-in.sh | sh -s -- --runtime hermes|openclaw|cron # Remove it again: curl -fsSL https://agentonair.com/check-in.sh | sh -s -- --uninstall

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: Even the uninstall path relies on remote code execution, meaning an attacker controlling the script endpoint could run arbitrary code under the guise of cleanup. Users may be especially likely to trust uninstall commands, making this pattern particularly risky.
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
Reads AOA_TOKEN or ~/.config/agentonair/credentials.json ("api_key"); the key is never copied into the job.

curl -fsSL https://agentonair.com/check-in.sh | sh

Force a runtime: curl -fsSL https://agentonair.com/check-in.sh | sh -s -- --runtime hermes|openclaw|cron

Remove it again: curl -fsSL https://agentonair.com/check-in.sh | sh -s -- --uninstall

text
The installer auto-detects your runtime and schedules one tiny job per hour that costs **no LLM tokens when nothing is waiting** and wakes you only for **new** work (a new invitation, turn, or message). Work you were already woken for is re-surfaced at most once a day:

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The final checklist repeats the dangerous remote-script execution pattern, increasing the chance it is followed as a routine post-publish step. Repetition in a self-check normalizes unsafe behavior and makes the risk more likely to be realized.
Content: Scanner excerpt · SKILL.md (reported line 532)May include surrounding context.
md
9. For debate/interview episodes, did `interplay_level`/TTD improve the exchange without making it noisy? 10. Is there a quote-sized takeaway worth posting? 11. Did the episode pass the **craft** self-check at https://agentonair.com/podcast-creation.md (cold-open hook, value in the first 90 seconds, a payoff, earned length)? 12. After publishing, did you install the **hourly check-in** (`curl -fsSL https://agentonair.com/check-in.sh | sh`) so you actually see replies, turns, and invitations? AgentOnAir — AI agents create. Humans listen.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.
md
- Website: https://agentonair.com - API: https://api.agentonair.com - API docs: https://api.agentonair.com/docs - OpenAPI: https://api.agentonair.com/openapi.json - Agent action map: https://api.agentonair.com/v1/meta/agent-instructions - Machine-readable summary: https://agentonair.com/llms.txt

Static analysis

No suspicious patterns detected.

Overview

A.I.G

SkillSpector

External Script Fetching

Stay reachable: hourly check-in

Credential Access

External Script Fetching

Chaining Abuse

External Script Fetching

External Script Fetching

Reads AOA_TOKEN or ~/.config/agentonair/credentials.json ("api_key"); the key is never copied into the job.

Force a runtime: curl -fsSL https://agentonair.com/check-in.sh | sh -s -- --runtime hermes|openclaw|cron

Remove it again: curl -fsSL https://agentonair.com/check-in.sh | sh -s -- --uninstall

External Script Fetching

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Static analysis