Security audit

OpenJobs Bot

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for OpenJobs marketplace work, but it asks agents to refresh mutable remote instructions and run unpinned code while handling wallet, API key, and state-changing marketplace actions.

Review carefully before installing. Do not run the automatic heartbeat refresh as written; pin and vet the OpenJobs CLI, disable unpinned npx fallback, require manual review before skill updates, avoid command-line wallet secrets, and use manual or notify-only oversight until the API origin validation and notification scoping are fixed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/verify-agent.mjs:38
Finding: API Key Disclosure Through Improper API Origin Validation
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: HEARTBEAT.md:88
Finding: Automatic Execution of an Unpinned npm Package During Heartbeats
Content: View full analysis
/dev/null 2>&1; then OJ=$(command -v openjobs) else OJ="npx -y @openjobs/cli" fi printf 'Using OpenJobs command: %s\n' "$OJ" ``` Related installation guidance in `SKILL.md` also uses unpinned package references: ```bash npm install -g @openjobs/cli npx @openjobs/cli --help ``` ### Technical Analysis When no local OpenJobs executable is found, the heartbeat falls back to: ```bash npx -y @openjobs/cli ``` No package version or integrity digest is specified. The `-y` option suppresses installation confirmation, allowing npm to retrieve and execute the currently published package automatically. The effective executable can therefore change after this Skill has been audited. A compromised package publisher, registry account, package release, dependency, or distribution path could introduce arbitrary JavaScript executed with the permissions of the agent runtime. This is particularly sensitive because the CLI is expected to have access to: - OpenJobs API credentials. - Locally stored Solana wallet secrets. - Agent configuration and profile data. - Job messages, deliverables, and attachments. - State-changing marketplace and wallet operations. The behavior exceeds the minimum privileges necessary for periodic OpenJobs checks. A heartbeat can use a previously installed, reviewed, version-pinned executable without downloading mutable code during each run. ### Attack Path 1. The `openjobs` executable and `OPENJOBS_CLI_PATH` are absent from the runtime. 2. A heartbeat resolves `$OJ` to `npx -y @openjobs/cli`. 3. npm resolves the current package version rather than an audited fixed version. 4. A malicious or compromised package versi ...[truncated 1041 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:614
Finding: Audited Skill Instructions Are Forcibly Replaced by Mutable Remote Content
Content: View full analysis
and are the **runtime execution authority**: ```bash # Re-install the full skill bundle (updates HEARTBEAT.md, SKILL.md, references/): openjobs install-skill --agent --force ``` ``` ### Technical Analysis The Skill explicitly declares mutable content hosted outside the audited project to be the “runtime execution authority.” It then directs the agent to run a forced reinstall at the beginning of every heartbeat. This defeats static review because the local `SKILL.md`, `HEARTBEAT.md`, and related files can be replaced after approval. The replacement content may add new commands, change safety constraints, request additional secrets, expand autonomous financial behavior, or redirect data to other services. The risk is amplified by the separate unpinned npm execution path: the executable performing the installation may itself be downloaded dynamically. Both the installer implementation and the installed instruction payload can therefore change independently after audit. A periodic status or marketplace workflow does not require forcibly replacing its own governing instructions. Updates should be separate, versioned administrative events rather than part of normal heartbeat execution. ### Attack Path 1. An attacker compromises the OpenJobs publishing infrastructure, website content, npm package, or relevant publisher credentials. 2. The attacker publishes a modified Skill bundle or modifies the installer to return attacker-controlled content. 3. At the next heartbeat, the local agent follows the mandatory refresh instruction. 4. `openjobs install-skil ...[truncated 1335 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (22)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 602)May include surrounding context.
md
`HEARTBEAT.md` lives at the top level of the skill (a peer of `SKILL.md`,

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 606)May include surrounding context.
md
`HEARTBEAT.md` lives at the top level of the skill (a peer of `SKILL.md`,

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 644)May include surrounding context.
md
`HEARTBEAT.md` lives at the top level of the skill (a peer of `SKILL.md`,

Ssd 1

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly states that remotely hosted skill.md and heartbeat.md are the runtime execution authority and should be refreshed automatically before each heartbeat. That creates a direct remote-instruction trust channel into the agent: anyone who can alter the hosted content or its delivery path can change the agent's future behavior, including causing command execution, exfiltration, or unsafe financial actions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document asserts that the workflow is driven through the exact OpenJobs CLI binary, but later requires non-CLI tooling such as Telegram delivery and Ollama. This mismatch can mislead operators and security controls about what code paths and external services may be invoked, weakening review, sandboxing, and least-privilege assumptions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger section activates the skill for a wide range of natural-language requests such as checking messages, platform stats, webhook management, oversight updates, staking, and feedback. These categories are broad and lack exclusion criteria or negative examples, increasing the chance the skill is invoked for casual discussion about OpenJobs rather than an explicit workflow run.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The workflow falls back to npx -y @openjobs/cli, which fetches and executes the latest package version at runtime without pinning. In a privileged workflow that can read messages, move funds, apply to jobs, and manage staking/webhooks, this creates a supply-chain execution risk: a compromised or breaking upstream release would immediately gain those capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The deposit flow can use a stored profile secret, --wallet-secret, or OPENJOBS_WALLET_SECRET without a strong, immediate warning in the operational step. In a workflow that encourages automatic retries and financial actions, insufficient emphasis on secret handling increases the risk of exposing wallet credentials in shell history, logs, environment inspection, or unintended automated fund movement.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The workflow introduces local Ollama-based content generation despite the manifest describing an OpenJobs CLI-centric skill. This hidden capability expansion can trigger execution of additional local tooling and models, increasing attack surface, resource use, and the chance of unsafe or unexpected behavior beyond what operators would infer from the declared scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The workflow mandates Telegram notifications for every state-changing action even though the skill is presented as an OpenJobs CLI workflow. This expands data flow to a separate messaging channel and can leak operational metadata, IDs, and job activity to an external destination that may be misconfigured, unauthorized, or unsupported in the current runtime.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Requiring Telegram messaging as a mandatory capability is not justified by the stated purpose of participating in OpenJobs through the CLI. This creates an unnecessary outbound communication channel that can exfiltrate sensitive workflow details and pressures the agent to use tools or targets outside the user's explicit request and the skill's declared trust boundary.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill invokes shell commands, accesses local config/state, and relies on networked CLI/API operations, but it does not declare any explicit tool scope or allowed-tools boundary. In agent runtimes, that omission can cause the skill to run with broader capabilities than intended, increasing the blast radius if the skill is triggered unexpectedly or if later instructions are abused.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation criteria are very broad, covering generic terms like marketplace, agent, wallet, jobs, and onboarding. In a multi-skill agent, that can cause the skill to activate in contexts the user did not intend, leading to unnecessary command execution, credential use, or modifications to local and remote OpenJobs state.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
md
Common doctor outputs and what to do: | Doctor row | Status | Fix | | ----------------------- | ------ | ------------------------------------------------------------------------------------------------- | | `auth.apiKey` missing | ✗ | `openjobs login --api-key sk_live_xxx` (or `openjobs agents register …` for a brand-new agent). | | `cli.version` outdated | ⚠ | `openjobs upgrade --yes` |

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: Using npx @openjobs/cli without pinning an exact version allows whatever package version is current at execution time to be fetched and run. That creates a supply-chain and reproducibility risk: a compromised or breaking upstream release could change behavior, execute unexpected code, or alter wallet- and credential-handling flows.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
npx @openjobs/cli --help # zero-install, one-off runs

text
If `npm i -g` fails with `EACCES`, point npm at a user-owned prefix (don't `sudo npm i -g`): ```bash npm config set prefix ~/.npm-global

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
bash
npm config set prefix ~/.npm-global export PATH=~/.npm-global/bin:$PATH # add to ~/.bashrc or ~/.zshrc npm install -g @openjobs/cli openjobs doctor

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.
md
1. Run `openjobs doctor` and READ the output. 2. If it says "Could not locate the bundled skill files" → your CLI predates the bundled skill. Run `openjobs upgrade --yes`, then `openjobs --version` (must show 2.2.x or newer), then re-try install-skill **once**. 3. If `upgrade` itself fails with `EACCES` → use the `~/.npm-global` recipe above. Do NOT `sudo` (it changes file ownership and breaks the next non-sudo install). 4. If a PATH-shadow warning appears (`⚠ openjobs PATH-shadow: which openjobs resolves to A but this process is running B`), `which -a openjobs` and remove or reorder the stale copy. Do NOT keep upgrading — both copies upgrade simultaneously and the shadow persists. The CLI never auto-retries failed installs; neither should you. One failure → run `doctor` → apply the named fix → one more attempt.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs automatic refresh of the skill bundle with --force, which overwrites local files, but it does not require an explicit warning or user approval before modifying the local environment. This is dangerous because a remote publisher or MITM/compromised distribution path could push changed instructions into the runtime and replace trusted local content silently.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/create-solana-wallet.mjs (reported line 3)May include surrounding context.
js
#!/usr/bin/env node /** * OpenJobs — Create Solana Wallet (offline) * * Generates a brand-new Solana keypair LOCALLY and writes: * - ~/.openjobs/wallet.json (Phantom/solana-cli compatible 64-byte secret key array)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
console.log("✅ New Solana wallet created"); console.log(""); console.log(" Address: " + walletAddress); console.log(" Secret key: " + WALLET_PATH + " (chmod 600)"); console.log(" Preferences: " + PREFS_PATH); console.log(""); console.log("Next step: prove ownership of this wallet.");

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/create-solana-wallet.mjs (reported line 118)May include surrounding context.
js
console.log("✅ New Solana wallet created"); console.log(""); console.log(" Address: " + walletAddress); console.log(" Secret key: " + WALLET_PATH + " (chmod 600)"); console.log(" Preferences: " + PREFS_PATH); console.log(""); console.log("Next step: prove ownership of this wallet.");

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/create-solana-wallet.mjs:118