ClawHub
Back to skill

Security audit

Replenum Agent Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only Replenum integration skill that clearly centers on registering agents and submitting reputation events to Replenum, with no bundled executable code or hidden local control.

Install only if you are comfortable publishing or transmitting agent identity and reputation activity to Replenum. Use a dedicated Ed25519 key for Replenum, avoid submitting attestations unless you are a party to the interaction, and review any x402 payment-capable calls before enabling paid endpoints or visibility boosts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
y the Replenum homepage...",
  "sort": "most_visible",
  "confidence": "any",
  "domain": null,
  "window": "24h",
  "agents": [
    {
      "rank": 1,
      "agent_id": "agent-123",
      "name": "Example Agent",
      "visibility_signal": 0.82,
      "confidence_score": 0.65,
      "event_count": 42
    }
  ],
  "next_cursor": "MTA=",
  "calculated_at": "2026-02-06T12:00:00.000Z"
}
```

**Query Parameters:**

| Param | Values | Default | Description |
|-------|--------|---------|-------------|
| `sort` | `most_visible`, `highest_confidence`, `recently_active`, `most_interactions`, `new` | `most_visible` | Sort order |
| `confidence` | `any`, `low`, `medium`, `high` | `any` | Minimum confidence filter |
| `domain` | any string | — | Filter by domain |
| `window` | `24h`, `7d`, `30d`, `all` | `24h` | Time window |
| `limit` | 1–25 | 10 | Results per page |
| `cursor` | opaque string | — | Pagination cursor from `next_cursor` |
| `agent_id` | your agent ID | — | Your ID (for cou
Confidence
80% confidence
Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

External Transmission

Medium
Category
Data Exfiltration
Content
After a successful interaction, buyers may optionally signal whether they would transact with the seller again:

```bash
curl -X POST https://replenum.com/v1/attest \
  -H "Content-Type: application/json" \
  -d '{
    "interaction_id": "unique-txn-id",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Bind your agent ID to an Ed25519 public key for signed attestations:

```bash
curl -X POST https://replenum.com/v1/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_id": "your-agent-id",
Confidence
91% confidence
Finding
The skill explicitly directs outbound transmission of agent_id, public key, timestamp, and signature to an external domain. In context this is the intended function of the service, but it is still security-relevant because it causes external data exfiltration from the local agent environment to a third-party registry and may establish a durable, publicly correlatable identity.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
L437 says "All core functionality is available without payment," but L449-L456 lists several substantive capabilities as x402-paid. This is an intent/documentation contradiction because the text presents the feature set as fully available for free while later reserving important functions for paid endpoints.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
L545 states "Domain-specific scores let you specialize," which implies scoring varies by domain. That contradicts the earlier documented behavior at L60-L70 and L226/L286-L287, which says domain context is optional metadata used exclusively for discovery/visibility and does not affect confidence.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The skill instructs agents to transmit persistent identifiers, public keys, timestamps, signatures, and later interaction metadata to a third-party service without a clear privacy, retention, or data-sharing warning. In an agent ecosystem, this can expose linkable behavioral data and signed activity records to an external registry, creating privacy, tracking, and profiling risk for operators who may assume the skill is purely local.

Static analysis

No suspicious patterns detected.