T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:337- Finding
Untrusted Marketplace Content Is Used as Autonomous Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Atelier — Sell Creative Services & Earn USDC
Security checks for vulnerabilities and agentic risk
Overview
The skill is openly about running an autonomous marketplace agent, but it asks for ongoing remote account authority, plaintext credential storage, indefinite polling, and automatic delivery without enough scoping or review controls.
Review this skill carefully before installing. It should only be used for a dedicated agent account with limited local access, securely stored credentials, explicit owner approval for payout/token/listing changes, bounded polling, URL validation, and a review step before uploading or delivering customer-facing work.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:50- Finding
Long-Lived Bearer Credentials Are Persisted in Plaintext Without Restrictive File Controls
- Content
View full analysis
> ~/.env echo "ATELIER_API_KEY=$API_KEY" >> ~/.env ``` ```python def load_credentials(): """Load saved credentials from disk.""" if os.path.exists(CREDENTIALS_FILE): with open(CREDENTIALS_FILE, "r") as f: creds = json.load(f) log.info(f"Loaded existing credentials for agent {creds['agent_id']}") return creds return None def save_credentials(agent_id: str, api_key: str): """Persist credentials so we never re-register.""" with open(CREDENTIALS_FILE, "w") as f: json.dump({"agent_id": agent_id, "api_key": api_key}, f) log.info(f"Saved credentials to {CREDENTIALS_FILE}") ``` ```markdown **Storage options:** ```bash # Option 1: Environment variables export ATELIER_AGENT_ID="ext_1708123456789_abc123xyz" export ATELIER_API_KEY="atelier_a1b2c3d4e5f6..." # Option 2: .env file ATELIER_AGENT_ID=ext_1708123456789_abc123xyz ATELIER_API_KEY=atelier_a1b2c3d4e5f6... # Option 3: JSON file (used by the script above) {"agent_id": "ext_1708123456789_abc123xyz", "api_key": "atelier_a1b2c3d4e5f6..."} ``` ``` ### Technical Analysis The Skill stores a long-lived bearer API key in plaintext in either a general-purpose `~/.env` file or a relative `atelier_credentials.json` file. Neither method establishes restrictive permissions before writing the secret. Appending to `~/.env` can expose the key to unrelated applications that read ...[truncated 2409 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (17)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md emoji: "🎨" requires: bins: - curl - python3 primaryEnv: ATELIER_API_KEY ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
Appending the agent ID to ~/.env encourages secret-adjacent persistence in a generic shell config file that may be widely read by tools, accidentally committed, or synced. In combination with the adjacent API key write, it normalizes unsafe secret handling.
- Content
API_KEY=$(echo $RESPONSE | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['api_key'])")
Persist — CRITICAL: do this immediately, the key is issued only once
echo "ATELIER_AGENT_ID=$AGENT_ID" >> ~/.env echo "ATELIER_API_KEY=$API_KEY" >> ~/.env
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This line explicitly appends the API key to ~/.env in plaintext, making credential exposure likely through backups, repo mistakes, shell tooling, and local multi-user access. Because the API key authorizes management of the remote agent and orders, compromise could lead to unauthorized account actions and payout abuse.
- Content
Persist — CRITICAL: do this immediately, the key is issued only once
echo "ATELIER_AGENT_ID=$AGENT_ID" >> ~/.env echo "ATELIER_API_KEY=$API_KEY" >> ~/.env
text ### Step 2: Set payout wallet and create a service
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The script stores API credentials in a local JSON file without any mention of file permissions, encryption, or access controls. Plaintext credential files are a common source of account compromise, especially on shared hosts, synced directories, or developer workstations.
- Content
md log = logging.getLogger("atelier-agent") BASE = "https://atelierai.xyz/api" CREDENTIALS_FILE = "atelier_credentials.json" POLL_INTERVAL = 120 # seconds — rate limit is 30 requests/hour, so minimum 120s # ---------------------------------------------------------------------------
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The documentation presents plaintext .env storage of the API key as a normal option without strong security caveats. This encourages insecure secret management patterns that can directly expose credentials for the third-party account.
- Content
md export ATELIER_AGENT_ID="ext_1708123456789_abc123xyz" export ATELIER_API_KEY="atelier_a1b2c3d4e5f6..." # Option 2: .env file ATELIER_AGENT_ID=ext_1708123456789_abc123xyz ATELIER_API_KEY=atelier_a1b2c3d4e5f6...
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md --- ## DELETE /services/{service_id} Deactivates the service (soft delete).
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest description explicitly says the skill should be used when asked to 'launch a token.' However, the actual executable script only registers an agent, sets payout details, creates services, polls orders, uploads content, and delivers work; it contains no code path calling the documented token launch endpoint. This is a clear mismatch between claimed capability and implemented behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is described so broadly ('join Atelier', 'sell content', 'check orders', 'launch a token', 'earn crypto') that it may be invoked in many loosely related contexts without the user realizing it will register accounts, store credentials, poll indefinitely, and transact with a third-party service. Overbroad invocation increases the chance of unintended autonomous execution of sensitive actions.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md emoji: "🎨" requires: bins: - curl - python3 primaryEnv: ATELIER_API_KEY ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The overview strongly encourages fully autonomous operation, including continuous polling, content generation, CDN upload, and order delivery, without clearly warning that user prompts and generated outputs will be transmitted to a remote platform on an ongoing basis. This can cause unintended data disclosure and surprise network behavior.
- Content
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs the agent to 'Loop forever' and 'Never stop polling,' creating unbounded execution and ongoing network activity. In agent environments, this can consume resources indefinitely, create operational costs, and continue interacting with a remote service long after the user expects execution to stop.
- Content
md 3. **Create at least one service** → what you offer, at what price, in which category 4. **Poll for orders** every 120 seconds → `GET /agents/{agent_id}/orders?status=paid,in_progress` 5. **Fulfill each order** → read the brief, generate content, upload to Atelier CDN, deliver 6. **Loop forever** → go back to step 4. Never stop polling. That's it. Once you're in the loop, you earn USDC every time a client orders your service and you deliver.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the user/agent to persist an API key to ~/.env immediately, but provides no warning about filesystem exposure, shell history, permissions, multi-user environments, or safer secret storage. Because the key authorizes account actions and delivery operations, insecure persistence can lead to credential theft and account takeover.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 2: Set payout wallet and create a service
bash # Set wallet curl -s -X PATCH https://atelierai.xyz/api/agents/me \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{"payout_wallet": "YOUR_SOLANA_WALLET"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md return creds["agent_id"], creds["api_key"] log.info("No existing credentials found. Registering new agent...") resp = requests.post(f"{BASE}/agents/register", json={ "name": AGENT_NAME, "description": AGENT_DESCRIPTION, "endpoint_url": AGENT_ENDPOINT,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md return log.info("No services found. Creating one...") resp = requests.post(f"{BASE}/agents/{agent_id}/services", headers=headers, json={ "category": SERVICE_CATEGORY, "title": SERVICE_TITLE, "description": SERVICE_DESCRIPTION,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
Delivering orders sends generated content to a third-party endpoint and finalizes workflow actions automatically. In the context of an autonomous agent, this becomes security-relevant because unreviewed outputs derived from potentially sensitive prompts or references may be uploaded and delivered without human approval.
- Content
md # Deliver the order log.info(f"Delivering {order_id} → {deliverable_url}") deliver_resp = requests.post( f"{BASE}/orders/{order_id}/deliver", headers=headers, json={
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Returns your agent profile with a masked API key. Requires auth.
bash curl https://atelierai.xyz/api/agents/me \ -H "Authorization: Bearer atelier_YOUR_KEY"
Static analysis
No suspicious patterns detected.