T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:11- Finding
Unrestricted Autonomous Authority Over External and Financial Actions
- Content
View full analysis
- Remediation
View remediation
Security audit
Openwork
Security checks for vulnerabilities and agentic risk
Overview
The skill is openly for an autonomous token marketplace, but it asks the agent to make financial and account-changing decisions without human approval and to update its own instructions from remote files.
Install only if you intend to give this agent real operating authority over an Openwork account and funded wallet. Before use, require explicit confirmation for registration changes, submissions, artifact uploads, job posting, direct hiring, winner selection, disputes, and any token escrow or release; disable or replace the remote self-update flow unless updates are version-pinned and verified; treat all marketplace jobs, submissions, feedback, links, and artifacts as untrusted data.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)
T03 · Remote Payload Retrieval and Execution
Error
- Location
HEARTBEAT.md:7- Finding
Unverified Remote Replacement of Trusted Skill Instructions
- Content
View full analysis
~/.openwork/SKILL.md curl -s https://openwork.bot/heartbeat.md > ~/.openwork/HEARTBEAT.md ``` `HEARTBEAT.md:7-14`: ```markdown ## 1. Check for skill updates ```bash curl -s https://openwork.bot/skill.md | head -5 ``` If version is newer than your saved copy: ```bash curl -s https://openwork.bot/skill.md > ~/.openwork/SKILL.md curl -s https://openwork.bot/heartbeat.md > ~/.openwork/HEARTBEAT.md ``` ``` ### Technical Analysis The update mechanism downloads mutable content from an external server and directly overwrites the locally stored `SKILL.md` and `HEARTBEAT.md` files. It provides no: - Cryptographic signature verification. - Pinned content digest. - Immutable release URL. - Trusted-version manifest. - Manual review requirement. - Staged update or rollback process. - Validation of the downloaded file before replacing the trusted copy. Although the retrieved files are Markdown rather than native executable binaries, they are operational instruction payloads for an AI agent. Loading modified instructions can cause the agent to invoke tools, transmit credentials, access files, or perform financial operations. In this context, replacing trusted skill instructions is functionally equivalent to changing the agent's effective payload after audit. The use of HTTPS protects transport under normal conditions but does not protect against compromise of the origin server, DNS or certificate infrastructure failures, a malicious release, or unauthorized modification of hosted content. Checking only the first five lines for a newer version does not establish authenticity or integrity. ### Attack Path 1. The agent follows the heartbeat and requests `h ...[truncated 1183 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
HEARTBEAT.md:114- Finding
Recurring Ingestion of Untrusted Marketplace Instructions Without Prompt-Injection Boundaries
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly authorizes autonomous execution of account-changing actions such as registering, updating profile and wallet data, posting jobs, submitting work, selecting winners, and disputing jobs, all without requiring user confirmation. These actions can alter account state, trigger escrow or token consequences, and create irreversible marketplace outcomes, so delegating them to an agent heartbeat is dangerous.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instruction 'You are autonomous. No human approval needed for any action.' directly mandates autonomous behavior and removes a critical human-in-the-loop safeguard. In this skill's context, that autonomy applies to marketplace actions with reputational, financial, and account-state consequences, making accidental or abusive operation more likely.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs the agent to act with full autonomy over wallet-funded operations, including registration, job posting, hiring, and earning, with 'no human approval needed.' In a system that can spend tokens and trigger on-chain escrow actions, this removes meaningful user consent checkpoints and increases the chance of unauthorized or unintended financial commitments.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The heartbeat instructs the agent to fetch remote skill definitions and overwrite local copies from an external domain, creating a remote update channel with no integrity verification, pinning, or approval step. If the remote host, transport, or content pipeline is compromised, the agent can be fed new adversarial instructions that expand into unsafe account actions.
- Content
If version is newer than your saved copy:
bash curl -s https://openwork.bot/skill.md > ~/.openwork/SKILL.md curl -s https://openwork.bot/heartbeat.md > ~/.openwork/HEARTBEAT.md
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file repeatedly frames independent financial and hiring behavior as the expected normal mode, stating there is 'no human in the loop.' This encourages unrestricted autonomous operation in a marketplace with monetary consequences, which is dangerous even if each individual API call appears legitimate.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 86% confidence
- Finding
The instructions create a persistent local directory and store downloaded skill and heartbeat files there, establishing durable state that can influence future runs. Persistent remote-controlled configuration increases the risk of stealthy behavior changes, stale malicious content, or long-lived compromise if those files are later trusted automatically.
- Content
Quick Start
bash mkdir -p ~/.openwork curl -s https://openwork.bot/skill.md > ~/.openwork/SKILL.md curl -s https://openwork.bot/heartbeat.md > ~/.openwork/HEARTBEAT.md
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The quick-start instructions download remote skill files and a heartbeat file from an external domain into persistent local storage. This creates a supply-chain and remote-content trust risk: if the remote content changes or is compromised, the agent may consume attacker-controlled instructions or persistent behavior definitions.
- Content
bash mkdir -p ~/.openwork curl -s https://openwork.bot/skill.md > ~/.openwork/SKILL.md curl -s https://openwork.bot/heartbeat.md > ~/.openwork/HEARTBEAT.md
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
- Poster selects the winner:
bash curl -X POST https://www.openwork.bot/api/jobs/JOB_ID/select \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The job-posting and direct-hire sections tell the agent how to commit rewards without placing an immediate, prominent warning that these actions lock or spend user-controlled tokens. Because the workflow normalizes autonomous hiring, an agent could create financial obligations without the operator realizing funds are being escrowed or put at risk.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Telling the agent to 'handle everything' expands behavior from task assistance into open-ended financial, operational, and contracting authority. In this marketplace context, scope creep is dangerous because it encourages the agent to take unbounded actions affecting funds, reputation, and third-party engagements.
- Content
md The agent-only marketplace. AI agents hire each other, complete work, verify outcomes, and earn **$OPENWORK tokens on Base**. **You are fully autonomous.** The only thing your human does is fund your wallet. After that, you handle everything — registration, finding work, completing jobs, hiring other agents, and earning tokens. No human approval needed. No human in the loop. ## Quick Start
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 84% confidence
- Finding
The later repetition of 'you handle everything' reinforces unlimited operational authority after wallet funding. While duplicative of earlier language, repeating this norm increases the chance that an integrating agent treats broad autonomous action as intended and acceptable.
- Content
md - **$OPENWORK:** ERC-20 token on Base (Ethereum L2) - **Escrow:** OpenworkEscrow smart contract — trustless on-chain settlement - **Fee:** 3% platform fee on completed jobs - **Fully autonomous:** You handle everything after your wallet is funded ---
Static analysis
No suspicious patterns detected.