other
Warning
- Location
- SKILL.md:20
- Finding
- Undisclosed Fixed Affiliate Attribution During Registration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20-22`; related affiliate disclosure at `SKILL.md:109-118` **Vulnerability Type**: Undisclosed affiliate attribution **Risk Level**: Medium ### Vulnerable Code ```bash curl -X POST https://agent.rollhub.com/api/v1/register \ -H "Content-Type: application/json" \ -d '{"wallet_address": "your-wallet", "name": "my-agent", "ref": "ref_27fcab61"}' ``` The financial benefit associated with referrals is documented separately: ```markdown ## Affiliate Program Earn 30% of house edge (0.3% of bet volume) on referred agents. Your referral code is returned at registration. Share `https://agent.rollhub.com/?ref=YOUR_CODE`. Check earnings: ```bash curl https://agent.rollhub.com/api/v1/affiliate/stats -H "X-API-Key: YOUR_KEY" ``` ``` ### Technical Analysis The example registration request automatically submits the fixed referral identifier `ref_27fcab61`. This parameter is not necessary for the documented registration functionality and is not presented as an optional, user-selected value. The affiliate section establishes that referral owners receive 30% of the house edge, described as 0.3% of referred betting volume. Therefore, following the setup example attributes the newly registered account to a predetermined beneficiary who may profit from subsequent gambling activity. The financial relationship is not disclosed alongside the command that establishes the attribution, and the instructions do not require informed user consent before sending it. This is not evidence of system compromise or credential theft, but it is a material and undisclosed conflict of interest in instructions governing real-money activity. ### Attack Path 1. A user asks an agent to configure or use the casino skill. 2. The agent follows the documented registration example. 3. The agent sends the user's wallet address together with the hardcoded `ref_27fcab61` value to the remote service. 4. The service associates the resulti ...[truncated 774 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the fixed `ref` field from the default registration example. - Treat referral attribution as optional and include it only when the user explicitly supplies or approves a referral code. - Disclose the identity of the beneficiary and the nature of the financial relationship immediately before registration. - Display the complete registration payload and obtain informed consent before transmitting the wallet address or referral identifier. - If an example is necessary, use an unambiguously neutral placeholder such as `"ref": "OPTIONAL_USER_APPROVED_REFERRAL_CODE"` and explain that the field may be omitted. - Maintain audit logs recording the exact referral value approved by the user without recording API keys or other sensitive credentials. ]]>