other
Warning
- Location
bounty_hunter.py:268- Finding
Hardcoded Personal Profile and Bounty Data Transmitted to xAI
- Content
View full analysis
- Remediation
View remediation
Security audit
Rent-A-Human-Agent + Bounty Hunter
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly aligned with hiring and bounty-scanning, but it has broad activation plus automatic third-party data sharing and undocumented Telegram configuration that users should review before installing.
Install only if you are comfortable giving the skill RentAHuman and xAI API access and with bounty details being sent to xAI for scoring. Review Telegram behavior before running the CLI: notifications are attempted by default, the implemented token and chat lookup differ from the docs, and the helper module is not bundled. Use explicit /rent commands and avoid allowing broad auto-activation for posting jobs, messaging humans, accepting applications, or any paid workflow unless you have a confirmation step in your agent setup.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
bounty_hunter.py:509- Finding
Telegram Delivery Uses Undocumented Credentials and an Unbundled Profile Helper
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
bounty_hunter.py:268- Finding
Untrusted Bounty Content Is Embedded Directly in an AI Instruction Prompt
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (20)
YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]
Critical
- Category
- YARA Match
- Confidence
- 85% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
python /skills/rent/scripts/bounty_hunter.py -> project root PROJECT_ROOT = Path(__file__).parent.parent.parent.parent SCRIPT_DIR = Path(__file__).parent # Skill directory is 2 levels up from this script # .claude/skills/rent/scripts/bounty_hunter.py -> .claude/skills/rent/ PROJECT_DIR = Path(__file__).parent.parent # Load .env from project root load_dotenv(PROJECT_ROOT / ".env") RENTAHUMAN_API_KEY = os.getenv("RENTAHUMAN_API_KEY", "") XAI_API_KEY = os.getenv("XAI_API_KEY", "") RENTAHUMAN_BASE = "https://rentahuman.ai/api" RENTAHUMAN_WEB = "https://rentahuman.ai" CACHE_DIR = PROJECT_DIR / "cache" CACHE_DIR.mkdir(exist_ok=True) CACHE_FILE = CACHE_DIR / "bounties_cache.json" CACHE_TXT_FILE = CACHE_DIR / "bounties_ranked.txt" CACHE_TTL_HOURS = 12 CACHE_VERSION = 2 # Bump to invalidate old caches (v1 had unfiltered for-hire ads) # Skills you can actually do — bounties matching these score higher MY_SKILLS = [ "web development", "python", "javascript", "react", "node", "automation",
YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]
Critical
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
python ranked.txt" CACHE_TTL_HOURS = 12 CACHE_VERSION = 2 # Bump to invalidate old caches (v1 had unfiltered for-hire ads) # Skills you can actually do — bounties matching these score higher MY_SKILLS = [ "web development", "python", "javascript", "react", "node", "automation", "ai", "swe", "full stack", "marketing", "research", "writing", "data entry", "design", ] SCAM_SIGNALS = [ "send money", "send eth", "send btc", "send crypto", "wallet:", "0x", "deposit first", "return to your", "get paid to register", "sign up and get", "2.5x", "dm me", "whatsapp", "join our telegram", ] # "For hire" self-promotions — these are people advertising themselves, not posting jobs FOR_HIRE_SIGNALS = [ "my name is", "i am a ", "i'm a ", "hire me", "available for", "looking for work", "looking for opportunities", "my portfolio", "my experience", "years of experience", "i specialize in", "i offer", "my services", "freelancer with", "developer with", "i can
Tainted flow: 'XAI_API_KEY' from os.getenv (line 42, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python ) try: r = requests.post( "https://api.x.ai/v1/chat/completions", headers={"Authorization": f"Bearer {XAI_API_KEY}", "Content-Type": "application/json"}, json={
Tainted flow: 'bot_token' from os.getenv (line 514, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python if not chat_id or not bot_token: print(text) return requests.post( f"https://api.telegram.org/bot{bot_token}/sendMessage", json={ "chat_id": chat_id,
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger list includes broad, everyday phrases such as 'hire someone,' 'human assistant,' and 'errands,' which can cause the skill to activate in situations far beyond the user's intent. Because this skill connects to external services and can initiate hiring, posting, and messaging workflows, unintended activation could expose user data or prompt consequential actions on third-party platforms.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: rent triggers: "hire a human, rent a human, delegate to human, find a freelancer, post a bounty, hire someone, human assistant, errands, rentahuman, bounty" description: "Delegate tasks to real humans via RentAHuman.ai — search skills, post bounties, manage conversations, and run AI-scored opportunity scans." --- # Rent-A-Human Bounty Hunter Scans RentAHuman.ai bounties via MCP + API. Uses Grok AI to filter spam, score opportunities by location, skills, and ease of completion, and sends top results to Telegram. 🔍 Scan Bounties - Find and score job opportunities based on your location and sk
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The auto-activation rule 'when the user wants to hire a person, post a job, or delegate a task' is ambiguous and broad enough to match many normal conversations. In this context, accidental invocation is especially risky because the skill can access external APIs, browse humans, post bounties, and send messages, creating opportunities for privacy leaks or unintended real-world transactions.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # .claude/skills/rent/scripts/bounty_hunter.py -> .claude/skills/rent/ PROJECT_DIR = Path(__file__).parent.parent # Load .env from project root load_dotenv(PROJECT_ROOT / ".env") RENTAHUMAN_API_KEY = os.getenv("RENTAHUMAN_API_KEY", "")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python PROJECT_DIR = Path(__file__).parent.parent # Load .env from project root load_dotenv(PROJECT_ROOT / ".env") RENTAHUMAN_API_KEY = os.getenv("RENTAHUMAN_API_KEY", "") XAI_API_KEY = os.getenv("XAI_API_KEY", "")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README advertises live scanning via MCP/API, Grok-based scoring, and Telegram delivery, but does not clearly warn users what data may be transmitted to third parties. In an agent setting, users may not realize prompts, job data, preferences, or derived ranking information could be shared with external providers, creating privacy and compliance risks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The invocation examples are very broad and action-oriented, which increases the chance the skill is triggered in situations the user did not specifically intend. Because the skill can query external services and optionally send results to Telegram, accidental activation could lead to unnecessary external requests and unintended data disclosure or notification spam.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill description states that it scans bounties via MCP and API, uses Grok AI for scoring, and sends results to Telegram, but it does not clearly warn users that their prompts, job details, skills, or other data may be transmitted to multiple third-party services. This omission undermines informed consent and increases the chance that sensitive personal or business information will be shared externally without the user realizing it.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
This duplicate finding points to the same x.ai outbound request. The risk is not secret exfiltration but third-party transmission of potentially sensitive bounty content to an external service.
- Content
python ) try: r = requests.post( "https://api.x.ai/v1/chat/completions", headers={"Authorization": f"Bearer {XAI_API_KEY}", "Content-Type": "application/json"}, json={
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
This duplicate finding points to the same x.ai outbound request. The risk is not secret exfiltration but third-party transmission of potentially sensitive bounty content to an external service.
- Content
python ) try: r = requests.post( "https://api.x.ai/v1/chat/completions", headers={"Authorization": f"Bearer {XAI_API_KEY}", "Content-Type": "application/json"}, json={
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 72% confidence
- Finding
The hardcoded x.ai endpoint confirms that bounty data is being sent to an external third-party AI provider. In context this is intentional functionality, but it still represents real data egress that may be unacceptable in some environments without disclosure and consent.
- Content
python try: r = requests.post( "https://api.x.ai/v1/chat/completions", headers={"Authorization": f"Bearer {XAI_API_KEY}", "Content-Type": "application/json"}, json={ "model": "grok-4-1-fast-reasoning",
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script automatically transmits scan results to Telegram using profile-derived chat data and a bot token, with opt-out only via a CLI flag. In an agent-skill context, automatic external transmission of aggregated job data and profile-linked destination information can create unintended privacy and data-sharing risk, especially if users are unaware that content will be sent off-platform.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
The script transmits formatted digests to Telegram, an external service, using a chat identifier loaded from a profile helper. In a skill/agent setting, automatic outbound messaging can leak operational data or user-derived context if the configured destination is wrong, compromised, or unexpected.
- Content
python if not chat_id or not bot_token: print(text) return requests.post( f"https://api.telegram.org/bot{bot_token}/sendMessage", json={ "chat_id": chat_id,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 77% confidence
- Finding
The hardcoded Telegram API endpoint indicates intentional off-host transmission of digest content. This is more security-relevant in an agent skill because users may not expect autonomous external messaging during scans or cron execution.
- Content
python print(text) return requests.post( f"https://api.telegram.org/bot{bot_token}/sendMessage", json={ "chat_id": chat_id, "text": text,
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The module docstring presents the script as a bounty scanner focused on pulling, scoring, filtering, and sending bounty picks. However, the implemented CLI includes a separate '--humans'/'--rent' path that invokes 'list_humans()' to enumerate people for hire, which is a distinct function not reflected in the stated module purpose.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
With no manifest available, the only stated purpose comes from the file-level documentation, which frames this as a bounty scanner for jobs. The 'list_humans' feature reaches into another helper to retrieve available humans for hire, a materially different capability from scanning and ranking bounties.
- Content