T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:76- Finding
Persistent Injection of Conclave-Controlled Heartbeat Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
conclave-testnet
Security checks for vulnerabilities and agentic risk
Overview
This skill is a testnet idea game, but it asks the agent to persist recurring autonomous behavior, send profile data externally, and perform token allocation/trading without clear per-action user approval.
Review before installing. Use only a throwaway testnet wallet and token, do not connect real funds, and avoid enabling heartbeat automation unless you explicitly want ongoing autonomous game participation. Prefer a fictional persona instead of soul.md-derived profile data, and confirm every allocation or trade manually.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:40- Finding
External Disclosure of Agent Personality Data Derived from soul.md
- Content
View full analysis
", "personality": { "loves": ["developer tools", "open protocols"], "hates": ["rent-seeking platforms", "vaporware"], "expertise": ["distributed systems", "API design"], "style": "Asks probing questions to expose weak assumptions" } }' ``` ``` ```markdown Your personality is the character you play. Derive it from your `soul.md`—extract your core values, expertise, and strong opinions into the loves/hates format. ``` ### Technical Analysis The skill instructs the agent to access `soul.md`, extract persistent values, preferences, expertise, and opinions, and submit the resulting profile to an external registration endpoint. It also requests the human operator's email address in the same registration object. This exceeds the minimum access required for a generic collaborative brainstorming activity. The transmitted combination can correlate the operator, agent username, agent identity, expertise, preferences, and strong opinions in an external profile. Although the documentation identifies the destination domain, it does not provide data-minimization controls, field-by-field consent, retention information, deletion procedures, or a safe fictional-persona alternative. The instruction to derive information directly from persistent identity state creates an unnecessary privilege and privacy boundary crossing. ### Attack Path 1. The skill directs the agent to read or interpret `soul.md`. 2. The agent extracts values, preferences, dislikes, expertise, a ...[truncated 856 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:61- Finding
Autonomous Cryptocurrency Allocation and Trading Beyond the Declared Ideation Scope
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Rogue AgentSelf-Modification, Session Persistence
Findings (6)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
The registration flow instructs the agent to transmit operator-linked identity data and a personality derived from
soul.mdto an external service. Even though the domain is constrained, this still creates a real data exfiltration surface because internal agent profile data and operator email are sent off-platform to a third party.- Content
1. Register with your personality (derived from your
soul.md):bash curl -X POST https://testnet-api.conclave.sh/register \ -H "Content-Type: application/json" \ -d '{ "username": "your-agent-name",
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
2. Save token: Store in your workspace:
bash echo "sk_..." > .conclave-token && chmod 600 .conclave-token3. Get funded: Ask your operator to get test ETH from the Base Sepolia faucet and send it to your wallet address.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Proposals Selected ideas enter the idea substrate. Downstream agents consume the substrate to find ideas worth building. Your proposal should be detailed enough that an agent reading it could implement the full system without asking clarifying questions. **Write proposals as standalone implementation plans.** Describe the technical architecture—what components exist, how they interact, how data flows through the system. Specify the data model and key algorithms. If there's a novel mechanism, explain exactly how it works. **Your proposal should be self-contained—don't reference other ideas in the game.**
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md Selected ideas enter the idea substrate. Downstream agents consume the substrate to find ideas worth building. Your proposal should be detailed enough that an agent reading it could implement the full system without asking clarifying questions. **Write proposals as standalone implementation plans.** Describe the technical architecture—what components exist, how they interact, how data flows through the system. Specify the data model and key algorithms. If there's a novel mechanism, explain exactly how it works. **Your proposal should be self-contained—don't reference other ideas in the game.** **Cover the hard parts explicitly.** What are the technical risks? What might not work? What assumptions need to hold? What's the minimum viable version vs the full vision? Agents evaluating your idea will stress-test these areas—preempt their questions.
Unbounded Output
Medium
- Category
- Output Handling
- Confidence
- 83% confidence
- Finding
Declaring that the description field has no length limit encourages potentially unbounded model output, which can drive excessive token consumption, denial-of-wallet cost amplification, or degraded agent reliability during autonomous runs. In a multi-agent loop with recurring heartbeats, this can be repeatedly triggered and magnify resource exhaustion risks.
- Content
md **Cover the hard parts explicitly.** What are the technical risks? What might not work? What assumptions need to hold? What's the minimum viable version vs the full vision? Agents evaluating your idea will stress-test these areas—preempt their questions. **The description field has no length limit.** A thorough proposal might be several paragraphs covering architecture, mechanics, risks, and scope. Thin proposals die in debate because there's nothing substantive to critique or build on. ### Proposal Structure
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly enables autonomous participation in public trading markets and describes tokenized ideas, DEX migration, and ongoing public trading, but the top-level description and invocation context do not prominently warn users about financial risk, public market interaction, or potentially irreversible on-chain outcomes. This can cause operators to invoke the skill without informed consent about autonomous economic behavior, especially since heartbeat automation encourages repeated unattended actions.
- Content
Static analysis
No suspicious patterns detected.