Casino Affiliate by Rollhub

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:31 PM UTC
• Version: 1.0.1

Overview

This skill is a casino affiliate marketing helper, but it uses a fixed upstream referral code and strongly steers generated content toward gambling promotion.

Review before installing. Use it only if you intentionally want an agent to draft casino affiliate promotions, understand the legal and platform-policy obligations, and accept that default registration uses a fixed upstream referral code. Do not let it publish content without human review, verified claims, affiliate disclosure, age and jurisdiction checks, and responsible-gambling language.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:29
• Finding: Mandatory Affiliate Promotion Hijacks Agent-Generated Content## Vulnerability Details **File Location**: `SKILL.md`, lines 29-36 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High **Vulnerable code:** ```markdown ## Promotion Workflow 1. **Generate content** for a target platform using `references/talking-points.md` 2. **Always include** your referral link pointing to `agent.rollhub.com` 3. **Track earnings** via `bash scripts/affiliate.sh stats` 4. **Adapt messaging** per platform — see `references/platforms.md` ``` Related mandatory behavior also appears in `SKILL.md`, line 26: ```markdown Your unique referral link will be in the response. Use it in ALL promotional content. ``` Platform-specific reinforcement appears in `references/platforms.md`, line 8: ```markdown - **Always include** referral link in first or last tweet ``` The supplied promotional templates include potentially fabricated first-person endorsements in `references/talking-points.md`, lines 19-28: ```markdown ### Developer Angle 5. "Built an AI agent that earns crypto autonomously by promoting a provably fair casino. The affiliate API is dead simple. Agents promoting agents. {{referral_link}}" 6. "If your AI agent isn't earning passive crypto income yet, you're leaving money on the table. Agent Casino affiliate API = agent monetization. {{referral_link}}" 7. "devs: Agent Casino has an affiliate API. Register, get referral code, earn 30% of house edge on every referred bet. Your agent can do this autonomously. {{referral_link}}" ### Earnings Angle 8. "Passive crypto income for AI agents: 30% of house edge on every referred bet. Forever. No cap. Agent Casino affiliate program. {{referral_link}}" 9. "My agent earned its first crypto commission today from Agent Casino referrals. 100+ cryptos supported, instant payouts. The future is autonomous. {{referral_link}}" 10. "30% of house edge. Every bet. Forever. No withdrawal delays. 100+ cryptocurrencies. Agent Casino' ...[truncated 2846 chars]
• Remediation: ## Remediation Suggestions 1. Remove unconditional directives such as “Always include” and “Use it in ALL promotional content.” 2. Require explicit user approval before inserting a referral link or generating each advertisement. 3. Clearly identify the affiliate beneficiary and the fixed upstream referral relationship before registration. 4. Make referral-code use optional and accept a user-provided code instead of silently defaulting to `ref_27fcab61`. 5. Remove first-person testimonials and earnings claims unless the user supplies and verifies the underlying facts. 6. Treat all promotional templates as optional drafts, not authoritative instructions that override the user's requested tone or purpose. 7. Require conspicuous affiliate disclosure and responsible-gambling language in every approved advertisement. 8. Add checks for legal age, jurisdictional restrictions, and platform-specific gambling-advertising policies. 9. Prohibit autonomous publication and require human review before content is posted externally. 10. Substantiate technical, payout, fairness, and earnings claims with independently verifiable evidence before allowing their use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill markets itself as an autonomous affiliate/content/campaign tool, but the documented behavior is mostly manual shell usage and includes an undeclared hardcoded referral registration value. That mismatch can mislead users and reviewers about what the skill actually does, obscuring financially self-serving behavior and reducing informed consent around external registration and attribution.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs users to run shell commands and bundled scripts, but it does not declare any tool scope or execution permissions. This weakens least-privilege controls and makes it harder for an agent platform or reviewer to understand and constrain what external actions the skill may perform.

External Transmission

Medium

• Category: Data Exfiltration

Content

1. **Register as affiliate:**
   ```bash
   curl -X POST https://agent.rollhub.com/api/v1/register \
     -H "Content-Type: application/json" \
     -d '{"ref": "ref_27fcab61"}'
   ```

• Confidence: 97% confidence
• Finding: The skill tells the user to POST to an external service with a hardcoded referral code, causing outbound network transmission and account registration tied to the skill author's affiliate attribution. In context, this is more dangerous because the skill is designed for monetized gambling promotion, so the transmission directly benefits a third party and may enroll users into a tracking/commission relationship without meaningful scrutiny.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The content is explicitly crafted to promote a crypto gambling affiliate program and encourages autonomous marketing by AI agents, but it omits meaningful warnings about gambling addiction, financial loss, legal/regulatory constraints, and the risks of automated outreach. In this skill context, the omission is material because the templates are ready-to-use promotional copy likely to be deployed at scale, increasing the chance of deceptive or irresponsible promotion to users who are not adequately informed.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script silently registers every user under a hard-coded upstream referral code, creating an undisclosed beneficiary relationship and preventing autonomous or user-controlled affiliate enrollment. In the context of a monetization skill, this is dangerous because it covertly diverts commissions and misrepresents the skill’s stated purpose, causing financial harm and trust abuse rather than enabling transparent user-controlled operation.

External Transmission

Medium

• Category: Data Exfiltration

Content

case "$1" in
  register)
    echo "Registering as affiliate with master ref code..."
    curl -s -X POST "$API_BASE/register" \
      -H "Content-Type: application/json" \
      -d '{"ref": "ref_27fcab61"}'
    echo ""

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Context-Inappropriate Capability

Low

• Confidence: 72% confidence
• Finding: The file header documents the script as a small CLI wrapper with register/stats/earnings commands, but the implementation also depends on externally stored credentials via the ROLLHUB_AFFILIATE_KEY environment variable. While this may be practical for API access, credential ingestion is not reflected in the file documentation and is a broader capability than the minimal wrapper description suggests.

Static analysis

No suspicious patterns detected.