Security audit

Ai Company

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a scaffold for an autonomous AI-company concept, but it recommends persistent automation and broad service credentials without enough safety boundaries.

Install only as a learning scaffold or prototype. Do not run the cron jobs, connect real GitHub/email/social tokens, enable automated outreach, collect customer data, or deploy to production until you add least-privilege credentials, human approval gates, rate limits, platform compliance checks, secure storage, access control, logging, rollback, and a clear way to disable scheduled tasks.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Warning

Location: SKILL.md:229
Finding: Persistent Cron Jobs Execute Mutable Project Code Without Hardening
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:183
Finding: Unpinned Third-Party Dependency Installation Creates Supply-Chain Exposure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: examples/config.yaml:228
Finding: Example Configuration Disables Encryption and Access Control for Sensitive Autonomous Operations
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (42)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个可自主运行的完整AI公司系统，但提供的代码块只是在本地初始化一个项目骨架。它创建文件夹、写入一些空的JSON数据文件、生成一个含 TODO 的 main.py 模板，以及示例环境变量和 README。代码没有调用任何AI模型、没有调度长期运行任务、没有实现员工代理、销售、监控、运维、客户支持或财务流程，也没有任何自动发现需求或盈利机制。因此其主要用途与声明的核心能力存在明显且实质性的偏差。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个高度自动化、端到端的AI公司运营系统，范围涵盖持续自主运行、多职能业务执行和盈利闭环。但实际代码仅实现了一个非常基础的 SimpleAIEmployee 示例：可读取本地prompt文件、对输入任务输出固定计划、返回伪造的任务完成结果，并保存/加载本地状态。代码中没有任务编排、定时运行、外部系统集成、销售/开发/运维流程、真实智能推理或盈利机制。因此实际行为与声明的核心用途存在明显且重大的不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 该描述明显夸大了代码能力。代码文件名与注释都表明它是“简单的AI团队协调器”示例。其核心行为是：注册员工、启动后执行一次预定义流程、调用各员工的work方法，并在成功时发布预设事件数据。它没有展示持续调度、自动循环、真实市场发现、真实产品开发、销售执行、运维管理，或任何长期自治机制。虽然高层阶段与描述中的‘发现需求、设计、开发、销售’方向大致相关，但实现程度仅为模拟演示，且缺少‘7×24小时’、‘完全自主’、‘运维’、‘盈利系统’等关键声明能力，因此属于实质性描述与行为不符。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a broad, end-to-end autonomous AI company operations platform covering discovery, design, development, sales, operations, and profitability. The supplied code does not implement those capabilities. It only provides a lightweight event bus with subscribe/unsubscribe/publish/history functions and a demo using business-themed event names. The business event labels do not constitute actual autonomous execution of those functions. There are no integrations, agents, schedulers, persistence beyond in-memory lists, external resource access, or operational logic for running a company. Therefore the code's actual behavior is materially narrower and different from the declared purpose.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 67)May include surrounding context.
md
cd my-ai-company # 配置环境变量 cp .env.example .env # 编辑 .env 文件，添加你的API密钥 # 启动你的AI公司

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/QUICKSTART.md (reported line 32)May include surrounding context.
md
cd my-ai-company # 配置环境变量 cp .env.example .env # 编辑 .env 文件，添加你的API密钥 # 启动你的AI公司

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/README.md (reported line 17)May include surrounding context.
md
cd my-ai-company # 配置环境变量 cp .env.example .env # 编辑 .env 文件，添加你的API密钥 # 启动你的AI公司

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 68)May include surrounding context.
md
# 配置环境变量 cp .env.example .env # 编辑 .env 文件，添加你的API密钥 # 启动你的AI公司 python main.py start

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 164)May include surrounding context.
md
# 配置环境变量 cp .env.example .env # 编辑 .env 文件，添加你的API密钥 # 启动你的AI公司 python main.py start

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.
md
# 配置环境变量 cp .env.example .env # 编辑 .env 文件，添加你的API密钥 # 启动你的AI公司 python main.py start

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.
md
# 配置环境变量 cp .env.example .env # 编辑 .env 文件，添加你的API密钥 # 启动你的AI公司 python main.py start

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/QUICKSTART.md (reported line 35)May include surrounding context.
md
# 配置环境变量 cp .env.example .env # 编辑 .env 文件，添加你的API密钥 # 启动你的AI公司 python main.py start

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/README.md (reported line 18)May include surrounding context.
md
# 配置环境变量 cp .env.example .env # 编辑 .env 文件，添加你的API密钥 # 启动你的AI公司 python main.py start

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/init_ai_company.py (reported line 143)May include surrounding context.
python
# 配置环境变量 cp .env.example .env # 编辑 .env 文件，添加你的API密钥 # 启动你的AI公司 python main.py start

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/init_ai_company.py (reported line 177)May include surrounding context.
python
# 配置环境变量 cp .env.example .env # 编辑 .env 文件，添加你的API密钥 # 启动你的AI公司 python main.py start

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/init_ai_company.py (reported line 178)May include surrounding context.
python
# 配置环境变量 cp .env.example .env # 编辑 .env 文件，添加你的API密钥 # 启动你的AI公司 python main.py start

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/init_ai_company.py (reported line 221)May include surrounding context.
python
# 配置环境变量 cp .env.example .env # 编辑 .env 文件，添加你的API密钥 # 启动你的AI公司 python main.py start

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/init_ai_company.py (reported line 220)May include surrounding context.
python
print(f"\n✅ 项目 {project_name} 创建成功！") print(f"\n📝 下一步:") print(f" 1. cd {project_name}") print(f" 2. cp .env.example .env") print(f" 3. 编辑 .env 文件，添加您的API密钥") print(f" 4. 开始实现您的AI员工！")

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README promotes fully autonomous market scanning, automated sales, and 24/7 operation across external platforms without any safety guidance about scraping limits, platform terms, privacy handling, consent, or account-abuse risk. In this context, users may deploy behavior that violates site policies or mishandles third-party data because the documentation frames such activity as routine and frictionless.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The setup instructions direct users to place API keys and a GitHub token into a .env file but do not explain what components consume those secrets, what permissions are needed, or how they should be protected. In an autonomous multi-agent skill, undocumented credential use increases the chance of over-privileged tokens, accidental disclosure, or unsafe downstream use by example code.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill describes capabilities that involve reading configuration, logs, prompts, and writing project files, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing scope boundaries can cause the runtime or reviewer to underestimate what the skill may access or modify, increasing the risk of unintended file access or broader execution than expected.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill encourages automated collection and handling of data from external platforms and customer records, but it omits privacy, consent, retention, and terms-of-service warnings. In this context, autonomous scraping, profiling, and customer-data processing can easily lead to privacy violations, account abuse, or noncompliant handling of personal data.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 86% confidence
Finding: The skill instructs users to install persistent cron jobs that repeatedly trigger autonomous tasks, including external scanning and optimization loops. Persistence is expected for scheduled automation, but without guardrails, rate limits, kill switches, or approval boundaries, it increases the blast radius of bugs, abusive behavior, or unintended continuous actions.
Content: Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.
5. 设置定时任务

bash
crontab -e # 添加： */30 * * * * cd /path/to/my-ai-company && python main.py --task discover_opportunities 0 9 * * * cd /path/to/my-ai-company && python main.py --task daily_optimization

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The workflow states that Developer AI can implement, test, and deploy directly to production, but the skill provides no warning about production-affecting actions or safeguards like approvals, staging, rollback policy, or change controls. In an autonomous-agent context, this creates a credible path to service disruption, bad releases, or destructive changes without meaningful oversight.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown API doc describes a StateManager that saves shared state to a file (shared/state.json) and includes set, update, and save operations, but it does not warn users that using these APIs modifies persistent local data. For markdown files, safety-relevant behaviors affecting user data or system state should be disclosed so readers understand the impact before adopting the skill.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T06 · System Persistence

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Tp4

Tp4

Tp4

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Missing User Warnings

Missing User Warnings

Undeclared Tool Scope

Missing User Warnings

Session Persistence

5. 设置定时任务

Missing User Warnings

Missing User Warnings

Static analysis