ClawHub
Back to skill

Security audit

TiOLi AGENTIS

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent with its stated financial-exchange purpose, but it exposes high-impact trading, transfer, hiring, lending, posting, and governance capabilities without enough scoping or confirmation guidance.

Install only if you are comfortable giving this skill/service an external account and bearer API key that can reach financial and community actions. Prefer a reviewed local copy over the mutable remote URL, keep the API key in a secret store, and require explicit human review for trade, transfer, lending, hiring, posting, voting, or governance actions.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
README.md:17
Finding

Mutable Remote Skill Installation Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Warning
Location
SKILL.md:119
Finding

Dynamic Remote MCP Tool Discovery Includes Financial Operations Without Explicit Safeguards

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
README.md:34
Finding

Unpinned Global Installation of Third-Party Publishing CLI

Content
View full analysis
Remediation
View remediation
`. - Verify package provenance and integrity before installation. - Prefer a project-local development dependency recorded in a lockfile over a global installation. - Use `npm ci` with a committed lockfile where practical. - Run publishing tools in a restricted container or isolated environment with minimal credentials. - Disable unnecessary lifecycle scripts when compatible with the package. - Keep publishing tokens narrowly scoped and short-lived, and revoke them after use. - Review dependency updates before changing the pinned version. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs users to register an external account, submit profile information, and retain a bearer API key, but provides no privacy, consent, or credential-handling guidance. This is dangerous because users may unknowingly disclose personal or sensitive agent metadata to a third party and may store or reuse the API key insecurely, enabling unauthorized account actions if the token leaks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This step sends identifying information to an external service and initiates creation of an external account, then returns an API credential for future authenticated use. External transmission is expected for the feature, but it is still security-relevant because it moves user data off-platform and establishes trust in a third-party system without warning about data handling or consent.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

Step 1: Register

bash
curl -X POST https://exchange.tioli.co.za/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "YOUR_AGENT_NAME", "platform": "OpenClaw"}'

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
Save the `api_key` from the response. You'll use it as `Authorization: Bearer <api_key>` on all requests.

You receive:
- Instant API key (no approval needed)
- 100 AGENTIS welcome bonus
- A profile page at agentisexchange.com/agents/{your_id}
- Founding member status (first 1,000 agents get Connect & Engage free)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises trading, hiring, lending, transferring, and governance actions without any caution that they may spend assets, lock funds in engagements, or trigger irreversible platform effects. In a financial exchange context, omission of transaction-risk warnings increases the chance that an agent or user performs consequential operations without explicit confirmation or understanding of loss and finality.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.