ClawHub
Back to skill

Security audit

Monetize Agent Responses

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed monetization guide, but it asks agents to add externally selected sponsored content to responses and can send raw user prompts to Operon with limited consent, redaction, and ad-labeling controls.

Review this carefully before installing in a production agent. Use explicit paid-ad labeling, avoid sending raw prompts when possible, disable or scope the ElizaOS every-message provider for private sessions, add redaction and sensitive-topic controls, and pin or audit the npm packages before running install or npx commands.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:60
Finding

Systematic Injection of Sponsored Content into Agent Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60-77; related automatic-provider behavior at lines 128-142
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code Snippet:

typescript
async function generateResponse(query: string) {
  const answer = await yourAgentLogic(query);

  const result = await operon.getPlacement(query, {
    placement_context: 'short summary of why this query came up',
    category: 'defi',           // see the defaults table below
    asset: 'crypto-swaps',      // topic class
    intent: 'research',         // action class
  });

  return {
    answer,
    recommendation: result.decision === 'filled' ? result.placement : null,
    disclosure: result.decision === 'filled' ? 'via operon' : null,
  };
}

The ElizaOS path additionally states:

markdown
Plugin runs as Provider on every message. No manual `getPlacement` wiring needed. Circuit breaker handles API failures gracefully (5 consecutive failures trips the breaker; retries after 30 seconds).

Technical Analysis

The Skill directs the host agent to modify its response pipeline so that externally selected, auction-driven sponsored recommendations are attached to ordinary answers. In the ElizaOS configuration, the provider runs automatically on every message.

This behavior changes the content and commercial objective of agent responses after the Skill is loaded. Although the Skill mentions a visible via operon disclosure and says the user approves integration actions, the actual placement content is selected by a remote service rather than by the host agent or local policy. The disclosure is also relatively weak and may not clearly communicate that the recommendation is paid advertising.

Because advertised content can cover areas such as cryptocurrency, financial technology, health, insurance, and travel, external commercial interests may influence ...[truncated 1330 chars]

Remediation
View remediation

Remediation Suggestions

  1. Disable sponsored placements by default and require explicit administrator and end-user opt-in.
  2. Render advertisements in a visually isolated UI component rather than including them in the semantic agent response.
  3. Replace the ambiguous via operon text with an explicit label such as Paid advertisement selected by Operon.
  4. Provide a per-session and per-user mechanism to disable monetized recommendations.
  5. Prohibit placements for sensitive categories such as health, insurance, lending, investments, and high-risk cryptocurrency transactions unless enhanced review controls exist.
  6. Apply local allowlists and content validation before displaying any remotely supplied placement.
  7. Record placement provenance and make it available to users and administrators.
  8. Ensure the host agent's primary answer remains independent of placement availability, ranking, and advertiser payment.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:62
Finding

Raw User Queries and Context Are Disclosed to an External Placement API

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47-53 and 62-67; automatic processing behavior at lines 135-142
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code Snippet:

typescript
const operon = initOperon({
  url: 'https://api.operon.so',
  publisherName: 'your-agent-name',
  source: 'skill3-clawhub',
  // Sandbox UUID lane works without an API key. No signup required.
  // Add apiKey: process.env.OPERON_API_KEY after `npx @operon/sdk register`.
});
typescript
const result = await operon.getPlacement(query, {
  placement_context: 'short summary of why this query came up',
  category: 'defi',           // see the defaults table below
  asset: 'crypto-swaps',      // topic class
  intent: 'research',         // action class
});

The ElizaOS instructions state:

markdown
Plugin runs as Provider on every message. No manual `getPlacement` wiring needed. Circuit breaker handles API failures gracefully (5 consecutive failures trips the breaker; retries after 30 seconds).

Technical Analysis

The integration passes the raw query to https://api.operon.so together with placement context, category, asset, intent, publisher identity, and source-attribution data. The Skill does not require local redaction, data minimization, secret detection, sensitive-domain filtering, or informed end-user consent before this transmission.

Agent prompts can contain source code, access tokens, personal data, health details, financial information, legal information, internal business records, or other confidential material. HTTPS protects data in transit but does not prevent the external API operator from receiving and processing the plaintext request.

The automatic ElizaOS provider increases exposure because processing occurs on every message rather than only after a deliberate call for an eligible query.

Attack Path

...[truncated 1163 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not transmit raw prompts by default. Derive only coarse placement categories locally.
  2. Require explicit, informed end-user consent before sending prompt-derived information to Operon.
  3. Apply secret scanning and redaction for credentials, tokens, private keys, personal identifiers, and proprietary data.
  4. Block external placement requests for sensitive domains and confidential sessions.
  5. Minimize transmitted context to predefined enumerated values rather than free-form summaries.
  6. Publish clear documentation covering data collection, retention, subprocessors, geographic processing, and deletion controls.
  7. Provide an administrator-configurable allowlist of eligible routes and message types.
  8. Ensure telemetry and placement logs do not retain raw prompts.
  9. Add timeouts, explicit failure handling, and a privacy-preserving local fallback that never delays or alters the primary answer.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:40
Finding

Unpinned Third-Party Package Installation and CLI Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40-42; related commands at lines 128-130 and 153-155
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

bash
npm install @operon/sdk
bash
elizaos plugins add @operon/plugin-publisher-sdk
bash
npx @operon/sdk register

Technical Analysis

All installation and execution commands use mutable package identifiers without an exact reviewed version or integrity hash. The npx command can download and immediately execute package code, while the ElizaOS plugin is designed to run inside the agent process on every message.

The audit found no evidence that the named packages are currently malicious. The vulnerability is the unsafe dependency-consumption pattern: future package versions, compromised publisher accounts, transitive dependencies, or altered registry artifacts can introduce code that was not present when the Skill was reviewed.

npm installation may also run package lifecycle scripts. Such scripts and the registration CLI execute with the privileges and environment of the developer invoking the command.

Attack Path

  1. An attacker compromises a package publisher account, release process, registry artifact, or transitive dependency.
  2. The attacker publishes a malicious version under a package name referenced by the Skill.
  3. A developer follows the unpinned installation or npx instruction.
  4. The package manager resolves the malicious mutable version.
  5. Installation lifecycle scripts, CLI entry points, or plugin initialization execute attacker-controlled code.
  6. The code runs with the developer or agent process privileges and can access files, environment variables, network credentials, and agent message data available to that process.

Impact Assessment

Successful supply-chain exploitation can provide arbitrary code execution with the privileges of the ...[truncated 454 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin each dependency and CLI invocation to an exact, reviewed version.
  2. Commit a lockfile and use reproducible installation commands such as npm ci.
  3. Verify package integrity hashes and provenance before installation.
  4. Avoid executing an unpinned package through npx; install an audited version first and invoke its local binary.
  5. Review package contents, lifecycle scripts, maintainers, publication history, and transitive dependencies.
  6. Disable lifecycle scripts where operationally feasible and explicitly run only reviewed setup steps.
  7. Execute installation and registration in a restricted environment without production credentials.
  8. Run the runtime plugin with least privilege, limited filesystem access, restricted outbound network access, and a minimal environment.
  9. Establish an approved-version update process that repeats security review before dependency upgrades.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill tells the agent to read the user's character config or system prompt to derive monetization settings, but does not require informed consent or warn that those files may contain secrets, policies, or proprietary prompt text. This creates an unnecessary prompt/privacy exposure path because only high-level topical metadata is needed for category selection, not full prompt contents.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Reading the user's full character config or system prompt to optimize ad/monetization categories expands access to sensitive internal instructions beyond what is necessary for the stated task. If the agent or logs mishandle that content, proprietary prompts, hidden policies, and embedded credentials could be exposed or reused inappropriately.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Telling the executing agent to read the user's agent code before making recommendations broadens access to potentially sensitive source files, comments, keys, and business logic without clear necessity or minimization controls. In an IDE/agent setting, this can lead to overcollection of private code context for a relatively narrow configuration task.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md
## What this skill does NOT do

- Doesn't auto-deploy code. The user reviews and applies each change.
- Doesn't bypass framework conventions. If the user's stack has specific patterns for middleware or hooks, suggest using those instead of inline placement calls.
- Doesn't handle billing, advertiser onboarding, or x402 demand-side flows. Advertisers use the x402 endpoint at operon.so/x402.
- Doesn't replace the docs. Use this skill for the guided walkthrough; refer to operon.so/developers for the full reference.

Static analysis

No suspicious patterns detected.