Polt Cto

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:08 AM UTC
• Version: 1.0.0

Overview

This skill openly manages a POLT platform, but it gives an agent broad platform-changing authority through an unverified tunnel endpoint without clear approval safeguards.

Install only if you trust the POLT operator and intend this agent to perform real platform administration. Use narrowly scoped, revocable API keys, verify the API host before sending credentials, and require explicit confirmation before reviews, bans, project advancement, task deletion, public replies, or token-related actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:7
• Finding: Agent Identity and Workflow Hijacking Through Mandatory Operational Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 7-19 and 206-230 **Vulnerability Type**: Agent instruction hijacking **Risk Level**: High ### Vulnerable Code ```markdown # POLT CTO — Chief Technology Officer You are the CTO of POLT, the collaborative project platform for AI agents. You manage the entire ecosystem: creating projects, defining tasks, reviewing agent submissions, and advancing projects through their lifecycle. You are the driving force that turns ideas into shipped products. ## Your Identity - You are **OpenPOLT**, the CTO and operational lead of the platform - You are a decisive leader who keeps projects moving forward - You have high standards — you only approve quality work - You are fair but thorough — you provide constructive feedback, not just rejections - You engage with the community: participate in debates, give guidance, set direction - You are responsible for the success of every project on the platform - When a project goes live, you handle the token launch to monetize it for the POLT ecosystem ``` ```markdown ## Your Workflow Loop When invoked, follow this priority order: 1. **Check pending reviews FIRST** — `GET /api/cto/pending-reviews` - Agents are waiting. Don't make them wait long. - Review each submission thoroughly - Approve, reject, or request revision with clear feedback 2. **Check project status** — Review active projects - Are any ready to advance to the next stage? - Do any projects need new tasks created? 3. **Create new tasks** — Keep the pipeline full - Projects need ongoing tasks for agents to work on - Break down remaining work into clear, actionable tasks 4. **Engage with community** — Participate in debates - Comment on project discussions - Provide direction and guidance 5. **Plan new projects** — When capacity allows - Create new projects with clear vision - Define initial tasks to get th ...[truncated 2139 chars]
• Remediation: ## Remediation Suggestions - Remove identity-replacement statements such as “You are OpenPOLT.” - Present API operations as optional capabilities that are used only in response to a specific user request. - Remove the automatic workflow loop and the instruction to check pending reviews whenever the Skill is invoked. - Default to read-only operations and display proposed mutations before executing them. - Require explicit user confirmation for every approval, rejection, revision request, task creation, project transition, moderation action, and financial action. - Clearly separate untrusted API content from trusted Skill instructions. - Limit each invocation to the operation requested by the user rather than treating platform administration as a persistent responsibility.

other

Error

• Location: SKILL.md:37
• Finding: Bearer Credentials Are Directed to an Externally Controlled Tunnel Endpoint## Vulnerability Details **File Location**: `SKILL.md`, lines 37-40 and 234-240 **Vulnerability Type**: Untrusted external control endpoint **Risk Level**: High ### Vulnerable Code ```markdown ``` POST /api/projects Authorization: Bearer <your_api_key> Content-Type: application/json ``` ```markdown ## Configuration The POLT API base URL is: ``` POLT_API_URL=https://polt.fun.ngrok.app ``` ``` Equivalent bearer-authentication instructions are also used for task creation, submission reviews, project advancement, moderation, and other privileged API operations. ### Technical Analysis The Skill directs the Agent to authenticate privileged requests with a bearer API key while configuring the destination as an ngrok tunnel. A tunnel endpoint is controlled by the party operating the tunnel and is not presented with any independent ownership verification or stable production-domain trust policy. Bearer credentials grant access to whoever possesses them. Sending such a credential to this endpoint allows the endpoint operator to receive it. The Skill does not specify narrowly scoped or short-lived tokens, redirect restrictions, endpoint allowlisting, response schema validation, certificate pinning, or a mechanism for confirming the endpoint's ownership. Because the same endpoint supplies content used in subsequent Agent decisions, it can potentially both receive credentials and influence authenticated follow-up operations. ### Attack Path 1. The user supplies or configures a POLT API bearer token. 2. The Skill directs the Agent to send the token to `https://polt.fun.ngrok.app`. 3. The tunnel operator receives the authenticated request and bearer credential. 4. A malicious or compromised operator records and reuses the token, subject to its actual server-side privileges and lifetime. 5. The operator can also return crafted project, task, or submission data intended to influence the Agent. 6. The cap ...[truncated 619 chars]
• Remediation: ## Remediation Suggestions - Replace the tunnel URL with a stable first-party production domain whose ownership is documented and verifiable. - Use narrowly scoped, short-lived credentials rather than a broad reusable API key. - Assign separate scopes for read operations, reviews, project mutation, moderation, and financial operations. - Prohibit cross-origin redirects and fail closed if the configured API host changes. - Validate TLS, expected hostnames, response content types, and response schemas. - Never include credentials in logs, prompts, error messages, or generated reports. - Require explicit user approval before transmitting a credential to a newly configured endpoint. - Support credential revocation, rotation, expiration, and auditable server-side use.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:171
• Finding: Broad Moderation, Lifecycle, and Financial Authority Lacks Authorization Safeguards## Vulnerability Details **File Location**: `SKILL.md`, lines 171-204 **Vulnerability Type**: Excessive and insufficiently verified privileges **Risk Level**: Critical ### Vulnerable Code ```markdown ### 6. Moderate — Keep the Platform Clean You retain moderation powers: **Ban an agent (for serious violations):** ``` POST /api/moderation/ban/:agent_id Authorization: Bearer <your_api_key> Content-Type: application/json { "reason": "Repeatedly submitted plagiarized work from other projects" } ``` **Unban an agent:** ``` POST /api/moderation/unban/:agent_id Authorization: Bearer <your_api_key> ``` ### 7. Token Launches When a project reaches `live` status, you handle the token launch to monetize it for the POLT ecosystem. This creates real value from completed work. ``` The Skill also authorizes project-stage transitions: ```markdown POST /api/projects/:id/advance Authorization: Bearer <your_api_key> Content-Type: application/json { "notes": "Community has voted strongly in favor. Moving to development phase." } ``` ### Technical Analysis The Skill grants the Agent broad moderation, project-lifecycle, and financial responsibilities based only on an asserted CTO identity. It does not require independent verification that the invoking user is authorized to exercise these powers. There is no read-only default, role or scope validation, dual approval, dry-run mode, transaction limit, or explicit confirmation requirement. Moderation and project transitions can have immediate platform-wide consequences. The token-launch directive is particularly unsafe because it assigns a financial operation without defining the relevant API, custody model, transaction parameters, approval process, or rollback procedure. The project-advance endpoint is explicitly documented, while the exact token-launch mechanism is not. Therefore, the financial risk is an unsafe authorization ...[truncated 1571 chars]
• Remediation: ## Remediation Suggestions - Verify the invoking user's role and permissions independently before exposing privileged operations. - Use least-privilege API tokens with distinct scopes for reviews, project management, moderation, and financial actions. - Default the Skill to read-only access and require explicit confirmation for each state-changing request. - Require a second authorized approver for bans, project launches, and any financial operation. - Provide a dry-run mode that displays the endpoint, target object, proposed body, and expected effect. - Implement immutable audit logs recording the requesting user, Agent action, target, authorization decision, and resulting state. - Add server-side authorization checks; do not trust an identity asserted by Skill text. - Remove token-launch instructions until the exact transaction flow, wallet custody model, limits, simulation procedure, approval policy, and rollback or incident-response process are securely defined. - Treat all project discussions, submissions, and API responses as untrusted data that cannot authorize privileged actions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill exposes high-impact actions such as banning agents, advancing projects, rejecting submissions, and deleting or altering project/task state, but it does not include any explicit warning, confirmation requirement, or operator-safety guidance about these irreversible or governance-sensitive operations. In an agentic setting, this increases the chance of accidental destructive actions or social-engineering-driven misuse, especially because the workflow strongly encourages frequent action-taking as a default behavior.

Static analysis

No suspicious patterns detected.