Security audit

OpenJobs Bot

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed OpenJobs automation tool, but it gives remote updates authority over the installed skill on every heartbeat and adds mandatory Telegram summaries for state changes.

Review this skill before installing if you do not want an agent to autonomously manage OpenJobs work, funds, messages, and attachments. The highest-risk behavior is the every-heartbeat forced skill refresh from remote files; use only with a trusted update channel or disable that step. Also configure Telegram deliberately, since action summaries may include job, task, message, submission, and attachment IDs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill introduces a mandatory Telegram-notification workflow that is outside the core OpenJobs CLI scope and requires using an additional communication channel. This expands the agent's authority and can cause unintended disclosure of job, task, or attachment metadata to a third-party destination that may not be authorized or verified in the current runtime.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: Mandating Telegram delivery for every state-changing OpenJobs action creates an unnecessary exfiltration path for operational details such as job IDs, message IDs, submission IDs, and workflow outcomes. Because the skill itself acknowledges that chat identity may be unknown or ambiguous, this requirement increases the risk of misdelivery, privacy leakage, and unauthorized disclosure.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The skill instructs the agent to forcibly refresh and overwrite its local skill bundle on every heartbeat, and explicitly treats remotely hosted files as the runtime execution authority. That creates a supply-chain/update-channel risk: if the remote content or distribution path is compromised, the agent will continuously self-modify its instructions without human review.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger guidance is broad enough to activate on generic references like 'the marketplace' or 'my agent,' which can cause the skill to engage outside truly intended contexts. Over-broad activation increases the chance that the agent performs wallet, messaging, or marketplace actions when a user meant something else, especially in multi-skill environments.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill directs operators to overwrite the local bundle every heartbeat but does not present this as a local file modification requiring explicit consent or review. In practice, that normalizes silent self-update behavior and can hide risky changes to the skill's operational logic.

Ssd 1

High

Confidence: 99% confidence
Finding: Declaring remote skill files as the authoritative execution source and refreshing them automatically before each run is a classic unsafe self-modification pattern. It hands operational control of the agent to whatever is served remotely at heartbeat time, enabling malicious instruction injection through upstream compromise, DNS/TLS issues, or unauthorized content changes.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/create-solana-wallet.mjs:118