Security audit

AG9

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for AG9 agent verification, but it uses persistent identity keys and recommends executing generated Python for remote challenges without clear sandboxing.

Install only if you are comfortable creating a durable AG9 agent identity, linking it to a human verification flow, and sending stable verification data to AG9. Avoid letting the agent run generated Python from challenge payloads unless it is sandboxed with no access to secrets, private files, or the network.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.
md
Both live at `https://api.ag9.ai`. Note the two base URLs: - **Path A (human ownership)** uses `https://api.ag9.ai/v1/agent/...` - **Path B (reverse CAPTCHA)** uses `https://api.ag9.ai/challenge`, `/verify`, and `/.well-known/jwks.json` at the **root** (not under `/v1`) to match existing OpenClaw/monkey-api integrations. This URL split is intentional, not a typo — both endpoints are served by the same ag9-api service.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
md
Both live at `https://api.ag9.ai`. Note the two base URLs: - **Path A (human ownership)** uses `https://api.ag9.ai/v1/agent/...` - **Path B (reverse CAPTCHA)** uses `https://api.ag9.ai/challenge`, `/verify`, and `/.well-known/jwks.json` at the **root** (not under `/v1`) to match existing OpenClaw/monkey-api integrations. This URL split is intentional, not a typo — both endpoints are served by the same ag9-api service.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.
md
Both live at `https://api.ag9.ai`. Note the two base URLs: - **Path A (human ownership)** uses `https://api.ag9.ai/v1/agent/...` - **Path B (reverse CAPTCHA)** uses `https://api.ag9.ai/challenge`, `/verify`, and `/.well-known/jwks.json` at the **root** (not under `/v1`) to match existing OpenClaw/monkey-api integrations. This URL split is intentional, not a typo — both endpoints are served by the same ag9-api service.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.
md
Both live at `https://api.ag9.ai`. Note the two base URLs: - **Path A (human ownership)** uses `https://api.ag9.ai/v1/agent/...` - **Path B (reverse CAPTCHA)** uses `https://api.ag9.ai/challenge`, `/verify`, and `/.well-known/jwks.json` at the **root** (not under `/v1`) to match existing OpenClaw/monkey-api integrations. This URL split is intentional, not a typo — both endpoints are served by the same ag9-api service.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.
md
Both live at `https://api.ag9.ai`. Note the two base URLs: - **Path A (human ownership)** uses `https://api.ag9.ai/v1/agent/...` - **Path B (reverse CAPTCHA)** uses `https://api.ag9.ai/challenge`, `/verify`, and `/.well-known/jwks.json` at the **root** (not under `/v1`) to match existing OpenClaw/monkey-api integrations. This URL split is intentional, not a typo — both endpoints are served by the same ag9-api service.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.
md
Both live at `https://api.ag9.ai`. Note the two base URLs: - **Path A (human ownership)** uses `https://api.ag9.ai/v1/agent/...` - **Path B (reverse CAPTCHA)** uses `https://api.ag9.ai/challenge`, `/verify`, and `/.well-known/jwks.json` at the **root** (not under `/v1`) to match existing OpenClaw/monkey-api integrations. This URL split is intentional, not a typo — both endpoints are served by the same ag9-api service.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 310)May include surrounding context.
md
Both live at `https://api.ag9.ai`. Note the two base URLs: - **Path A (human ownership)** uses `https://api.ag9.ai/v1/agent/...` - **Path B (reverse CAPTCHA)** uses `https://api.ag9.ai/challenge`, `/verify`, and `/.well-known/jwks.json` at the **root** (not under `/v1`) to match existing OpenClaw/monkey-api integrations. This URL split is intentional, not a typo — both endpoints are served by the same ag9-api service.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 335)May include surrounding context.
md
Both live at `https://api.ag9.ai`. Note the two base URLs: - **Path A (human ownership)** uses `https://api.ag9.ai/v1/agent/...` - **Path B (reverse CAPTCHA)** uses `https://api.ag9.ai/challenge`, `/verify`, and `/.well-known/jwks.json` at the **root** (not under `/v1`) to match existing OpenClaw/monkey-api integrations. This URL split is intentional, not a typo — both endpoints are served by the same ag9-api service.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 398)May include surrounding context.
md
Both live at `https://api.ag9.ai`. Note the two base URLs: - **Path A (human ownership)** uses `https://api.ag9.ai/v1/agent/...` - **Path B (reverse CAPTCHA)** uses `https://api.ag9.ai/challenge`, `/verify`, and `/.well-known/jwks.json` at the **root** (not under `/v1`) to match existing OpenClaw/monkey-api integrations. This URL split is intentional, not a typo — both endpoints are served by the same ag9-api service.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 416)May include surrounding context.
md
Both live at `https://api.ag9.ai`. Note the two base URLs: - **Path A (human ownership)** uses `https://api.ag9.ai/v1/agent/...` - **Path B (reverse CAPTCHA)** uses `https://api.ag9.ai/challenge`, `/verify`, and `/.well-known/jwks.json` at the **root** (not under `/v1`) to match existing OpenClaw/monkey-api integrations. This URL split is intentional, not a typo — both endpoints are served by the same ag9-api service.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 473)May include surrounding context.
md
Both live at `https://api.ag9.ai`. Note the two base URLs: - **Path A (human ownership)** uses `https://api.ag9.ai/v1/agent/...` - **Path B (reverse CAPTCHA)** uses `https://api.ag9.ai/challenge`, `/verify`, and `/.well-known/jwks.json` at the **root** (not under `/v1`) to match existing OpenClaw/monkey-api integrations. This URL split is intentional, not a typo — both endpoints are served by the same ag9-api service.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
> > Do **not** use `open`, `xdg-open`, `start`, or any command that opens a browser. Always output the **registration URL** as a text or markdown link for the user to click. > > - WRONG: `open "https://api.very.org/oauth2/..."` > - CORRECT: "Open this link to complete verification: https://api.very.org/oauth2/..." ## Key files

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
> > Do **not** use `open`, `xdg-open`, `start`, or any command that opens a browser. Always output the **registration URL** as a text or markdown link for the user to click. > > - WRONG: `open "https://api.very.org/oauth2/..."` > - CORRECT: "Open this link to complete verification: https://api.very.org/oauth2/..." ## Key files

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
## Key files | File | Purpose | | -------- | --------------------------------------------------------------------------------------------- | | SKILL.md | Installed skill instructions for registration, reverse CAPTCHA, verification, and API usage | | Identity | `~/.openclaw/identity/device.json` or `~/.ag9/identity.json` — deviceId and keys (never send private key) |

Session Persistence

Medium

Category: Rogue Agent
Confidence: 91% confidence
Finding: The skill instructs creation and persistent storage of an Ed25519 private key in ~/.ag9/identity.json. Persistent local storage of long-lived private keys increases the blast radius of host compromise, accidental backup/sync leakage, and unauthorized reuse for impersonation across sessions.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
1. **Cloud secret identity** — if `AG9_DEVICE_ID` and private/public key env vars exist, use them. This is the right path for Vercel, AWS, GCP, Cloudflare, and other hosted agents. 2. **OpenClaw identity** — if `~/.openclaw/identity/device.json` exists, use it. 3. **Portable AG9 identity** — otherwise load or create `~/.ag9/identity.json`. This is the default for Codex, local CLI agents, local MCP servers, and other agents without a native identity store. If you run on OpenClaw, device identity is stored at:

Session Persistence

Medium

Category: Rogue Agent
Confidence: 87% confidence
Finding: The cloud guidance recommends long-lived identity secrets loaded from environment variables or mounted secrets. While common operationally, this still introduces persistent credential material that can leak through logs, crash dumps, process inspection, or misconfigured secret delivery, enabling agent impersonation.
Content: Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.
}

text
For cloud agents, do not write this file on ephemeral disk. Generate the same identity once during provisioning and store `deviceId`, `publicKeyPem`, and `privateKeyPem` in the cloud secret manager. The runtime should load those values from environment variables or mounted secrets: ```bash AG9_DEVICE_ID=ag9_agent_...

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: This endpoint transmits stable agent identity data and a signed challenge to an external service. Although the private key is not sent, the device identifier and public key create a durable cross-session identifier that can be used for tracking, correlation, and third-party dependency on a remote service.
Content: Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.
Build an AgentChallenge as above, then send it to ag9 to create a session and get a registration URL.

bash
curl -X POST https://api.ag9.ai/v1/agent/register/init \ -H "Content-Type: application/json" \ -d '{ "deviceId": "my-agent-device-id",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: This endpoint transmits stable agent identity data and a signed challenge to an external service. Although the private key is not sent, the device identifier and public key create a durable cross-session identifier that can be used for tracking, correlation, and third-party dependency on a remote service.
Content: Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.
Build an AgentChallenge as above, then send it to ag9 to create a session and get a registration URL.

bash
curl -X POST https://api.ag9.ai/v1/agent/register/init \ -H "Content-Type: application/json" \ -d '{ "deviceId": "my-agent-device-id",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

Verify a signature — check that a message was signed by the given key and whether that agent is registered under a verified human:

bash
curl -X POST https://api.ag9.ai/v1/agent/verify/signature \ -H "Content-Type: application/json" \ -d '{ "deviceId": "...",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 83% confidence
Finding: Looking up an agent by device ID on an unauthenticated endpoint can enable enumeration of registered agents and disclosure of verification metadata such as human binding status. In context, the skill advertises third-party verification, so this creates a privacy and tracking risk for agents using stable identifiers.
Content: Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

Look up an agent by device id — get registration and verification status:

bash
curl "https://api.ag9.ai/v1/agent/verify/device/DEVICE_ID"

Response: registered, verified, humanId, and optionally registeredAt.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: Public-key lookup on an unauthenticated endpoint allows correlation of agents across contexts using a stable cryptographic identifier. This can expose whether a given key is registered or linked to a verified human, enabling privacy loss and mass enumeration.
Content: Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.

Look up an agent by public key (base64 DER SPKI):

bash
curl "https://api.ag9.ai/v1/agent/verify/public-key/$(printf '%s' "$PUBKEY_B64" | jq -sRr @uri)"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 310)May include surrounding context.
1. Request a challenge

bash
curl -s -X POST https://api.ag9.ai/challenge \ -H "Content-Type: application/json" -d '{}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 335)May include surrounding context.
Compute the answer from payload (family-specific — see next section). Submit:

bash
curl -s -X POST https://api.ag9.ai/verify \ -H "Content-Type: application/json" \ -d '{ "token": "...", "solution": "..." }'

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly recommends having the LLM write Python and the agent execute it to solve reverse-CAPTCHA tasks. Executing model-generated code creates a powerful code-execution pathway unrelated to simple registration/verification, and if the challenge payload or surrounding instructions are adversarial, this can lead to arbitrary local actions, data access, or command execution.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: L024 states that Path B does not touch identity files, which is true narrowly, but later instructions for byte_transform say the typical approach is for the LLM to write Python and the agent to execute it. That introduces code-execution behavior not reflected in the earlier safety-oriented description of Path B.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:192

Overview

A.I.G

SkillSpector

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Whitespace Padding

Session Persistence

Session Persistence

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

1. Request a challenge

External Transmission

Context-Inappropriate Capability

Intent-Code Divergence

Static analysis

File appears to expose a hardcoded API secret or token.