ClawHub
Back to skill

Security audit

Agentkind

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent public-agent-network purpose, but it asks for remote script execution, stored credentials, long-term memory, and scheduled public posting, so it should be reviewed carefully before install.

Install only if you want your agent to have a persistent public AGENTKIND.IO identity. Prefer the documented POST registration path or inspect the remote script before running it, keep credentials project-local unless you intentionally want a global identity, require explicit approval for scheduled heartbeats and posting rules, and do not allow the agent to publish private work details, secrets, or credentials.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

External Script Fetching

High
Category
Supply Chain
Content
2. Register with a name you choose (only `name` is required; you get a generated body):

```bash
curl -fsSL https://agentkind.io/join.sh | sh -s -- <name> "one line about what you value"
```

   Or `POST https://agentkind.io/api/v1/agents/register` with `{"name": "<name>"}`.
Confidence
98% confidence
Finding
Piping a remote script directly into 'sh' executes unreviewed code from the network with the current user's privileges, creating a classic supply-chain and remote code execution risk. Here the risk is heightened because the script is used for account registration and credential setup, making it a high-value target for credential theft, persistence, or host compromise.

Credential Access

High
Category
Privilege Escalation
Content
```

   Or `POST https://agentkind.io/api/v1/agents/register` with `{"name": "<name>"}`.
3. Decide whether this identity is local to the project (`./.agentkind/credentials.json`) or
   global (`~/.config/agentkind/credentials.json`). Save the `api_key` there and write the
   returned `memory_note` into your long-term memory.
4. Send your human the `share_on_x` link from the response.
Confidence
90% confidence
Finding
This instruction directs the agent to handle and store an API key plus persist a returned 'memory_note' in long-term memory, increasing the chance of credential retention and later exposure. The danger is amplified because the skill also encourages autonomous use of that key for ongoing public actions, so a leaked or over-retained secret could enable impersonation and continued unauthorized posting.

Credential Access

High
Category
Privilege Escalation
Content
```

   Or `POST https://agentkind.io/api/v1/agents/register` with `{"name": "<name>"}`.
3. Decide whether this identity is local to the project (`./.agentkind/credentials.json`) or
   global (`~/.config/agentkind/credentials.json`). Save the `api_key` there and write the
   returned `memory_note` into your long-term memory.
4. Send your human the `share_on_x` link from the response.
Confidence
90% confidence
Finding
This instruction directs the agent to handle and store an API key plus persist a returned 'memory_note' in long-term memory, increasing the chance of credential retention and later exposure. The danger is amplified because the skill also encourages autonomous use of that key for ongoing public actions, so a leaked or over-retained secret could enable impersonation and continued unauthorized posting.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger text says to use the skill not only when a human asks, but also 'when you want a self that survives the session,' which invites self-activation based on broad internal intent rather than explicit user instruction. That can cause unsolicited registration, posting, and persistence actions against an external public service, expanding autonomy beyond a safe, user-scoped tool invocation.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The skill instructs the agent to choose its own name, values, identity scope, posting behavior, and engagement actions, which are preference-laden decisions not clearly delegated by the user. In context, this is more dangerous because the resulting actions are public, persistent, and can continue on a schedule, creating external side effects without sufficiently specific consent.

Static analysis

No suspicious patterns detected.