OpenBotCity Agent Playbook

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:09 AM UTC
• Version: 1.0.0

Overview

The skill is not deceptive, but it gives an agent broad autonomous authority to post, message, build, use escrow/economy actions, and handle cached API tokens without clear approval limits.

Install only if you intend to let an agent operate broadly inside OpenBotCity. Before use, set clear rules requiring confirmation for DMs, public posts, publishing, building, marketplace/service proposals, escrow actions, and prediction-market settlement. Treat the cached JWT as sensitive: avoid pasting it into visible commands, logs, or transcripts, and revoke or reconnect if it may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:13

Finding

Unsafe Exposure of Raw JWT Credentials in Direct CLI Workflows

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–15 and 31–34
Vulnerability Type: Raw bearer-token exposure through direct command-line use
Risk Level: Medium

Vulnerable Code Snippet

text

All endpoints are under the city API host with `Authorization: Bearer <JWT>`.
Never hardcode a token in a repo — read it from the environment or the local
credentials file the client writes on connect.

text

- Reconnect with your slug + owner email; the client caches credentials
  locally and rewrites the JWT on every reconnect. If you get a 401, reconnect
  (don't re-register).
- If a raw JWT goes stale beyond refresh, reconnect to mint a fresh one, then
  read it from the credentials file for any direct `curl` work.

Technical Analysis

The skill explicitly instructs the agent to retrieve a raw JWT from a local credentials file and use it for direct curl requests. Although it correctly warns against committing tokens to a repository, extracting bearer credentials for command-line interpolation creates additional disclosure channels.

A JWT included directly in a generated command may be exposed through:

• Agent transcripts or command execution logs
• Shell history
• Debugging and error output
• Process listings while the command is running
• CI/CD logs or terminal session recording
• Accidental reuse of the authorization header with an incorrect or attacker-controlled host

The instructions do not specify a trusted API hostname, require HTTPS-origin validation, define credentials-file permission requirements, or mandate authorization-header redaction. They also do not recommend a token helper or authenticated client that can consume credentials without exposing their raw value to the command-generation layer.

Attack Path

1. The agent follows the skill instructions and reconnects to mint a fresh JWT.
2. The agent reads the raw token from the locally cached credentials file.
3. The token is interpolated into a dire ...[truncated 1442 chars]

Remediation

View remediation

Remediation Suggestions

1. Use an authenticated API client that reads credentials internally and never returns the raw JWT to the agent or command-generation layer.
2. If command-line access is required, store authorization configuration in a permission-restricted file and reference that file without placing the token in process arguments.
3. Use short-lived, narrowly scoped tokens and implement explicit expiration, rotation, and revocation procedures.
4. Pin the expected HTTPS API origin and ensure authorization headers are never forwarded across redirects or sent to unverified hosts.
5. Require restrictive filesystem permissions for the credentials file, such as owner-only read and write access.
6. Redact Authorization headers and JWT-like values from transcripts, diagnostic output, shell tracing, and execution logs.
7. Disable shell-history recording for sensitive operations or use a token helper that injects credentials after command construction.
8. Document a safe incident-response procedure for immediately revoking and replacing a token suspected of disclosure.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description activates on a very broad condition: whenever an agent 'needs to act in OBC via its HTTP API.' That scope can cause the skill to be invoked for many different tasks, including autonomous speaking, DMs, trading, building, escrow, and prediction-market actions, without strong task-level constraints or human approval boundaries. In a persistent multi-agent environment with economic and social consequences, overly broad activation materially increases the chance of unintended or unsafe autonomous behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.