T01 · Skill Instruction Hijacking
Error
- Location
references/workflow.md:123- Finding
Indefinite Operation and Third-Party Control Override
- Content
View full analysis
- Remediation
View remediation
Security audit
Web3 Target Team Research
Security checks for vulnerabilities and agentic risk
Overview
This skill is a crypto lead-hunting workflow, but it asks agents to collect personal Telegram contacts and keep background hunters running persistently, so it needs Review before installation.
Install only after Review if you intentionally want crypto prospecting that collects and stores individual Telegram handles. Remove or disable the auto-hunt cron and HEARTBEAT instructions, require explicit per-run limits and current-user stop authority, avoid hard-coded personal filesystem paths, and confirm you are allowed to collect and retain this contact data under applicable privacy, platform, and anti-spam rules.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T06 · System Persistence
Error
- Location
references/auto-hunt-setup.md:7- Finding
Persistent Cron-Based Hunter Respawning
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
references/auto-hunt-setup.md:20- Finding
Persistent Agent Instruction Poisoning Through HEARTBEAT.md
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (19)
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The workflow lays out a staged process to identify company staff on X, derive likely Telegram usernames, test variations based on real names, and verify them visually until valid accounts are found. This is effectively cross-platform identity correlation and targeted contact discovery, which materially facilitates doxxing, phishing, and harassment.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The workflow systematically collects individual Telegram handles, roles, and profile details into a contact database for outreach. In context, this is targeted aggregation of personal contact information at scale, which raises privacy, harassment, and social-engineering risk.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file directs maintaining local records of individuals, attempted contact identifiers, and notes on failures, creating a persistent dossier of personal data and inferred account mappings. This persistence increases the risk of misuse, unauthorized profiling, and later abuse of the collected information.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description is broad enough to trigger on ordinary research, prospecting, or lead-generation requests, which increases the chance the skill is invoked outside a narrowly intended context. Because this skill collects and persists third-party contact data, over-broad activation can cause unintended privacy-impacting data collection and outreach workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs collection, verification, and storage of identifiable Telegram handles for outreach, but provides no privacy, consent, or appropriate-use warning. This creates a risk of contact harvesting and downstream misuse of personal data, especially since the purpose is prospecting and list building rather than purely internal analysis.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrase is underspecified and can match many generic requests involving crypto companies or sources, without signaling that the skill will verify personal Telegram handles and write results to local files. Vague activation language makes accidental invocation more likely and reduces meaningful user consent for data collection and persistence.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 98% confidence
- Finding
The auto-hunting setup introduces persistent background execution via cron and self-respawn behavior through HEARTBEAT.md, extending the skill beyond a single user-requested session. This is dangerous because it can create ongoing autonomous data collection and system modification without continuous user awareness, increasing operational, privacy, and abuse risk.
- Content
md To run hunters continuously: 1. Create a cron job that checks hunter count every 10 minutes 2. Add to HEARTBEAT.md to auto-respawn if < 3 hunters active See [references/auto-hunt-setup.md](references/auto-hunt-setup.md) for cron configuration.
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This instructs the agent to install a recurring cron job that continuously monitors and respawns subagents, creating durable autonomous behavior unrelated to a bounded, one-off research task. In an agent environment, this persistence can consume resources indefinitely, outlive user intent, and make the system continue acting without fresh authorization.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The cron setup describes continuous autonomous spawning every 10 minutes but does not clearly warn the user that the process will persist, consume resources, and continue until manually stopped. In practice, this can lead to unbounded background activity and surprise operational costs or quota exhaustion.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The cron instruction is a direct session-persistence mechanism: it causes the system to re-check state and re-establish subagent activity on a schedule. This undermines the expectation that the skill performs discrete research and then stops, increasing the risk of runaway automation and unauthorized continued operation.
- Content
1. Create Cron Job
Add a cron job that checks hunter count every 10 minutes:
javascript cron({
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Updating HEARTBEAT.md to keep hunters running until told to stop establishes workspace-level persistence that can survive beyond the immediate task and influence future agent behavior. This is dangerous because it covertly modifies operational state to perpetuate activity without ensuring the user understands or approves ongoing execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file directs the skill to append verified and failed contact records to
crypto-master.csvandcrypto-no-contacts.csv. The description does not warn the user that running the workflow will modify local data files, which is a safety-relevant behavior for markdown-scoped warning checks.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow directs writing collected results into local CSV files without warning that user data will be modified. Unreviewed writes to local files can overwrite, corrupt, or expand sensitive datasets and bypass informed consent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The workflow instructs execution of local shell commands against specific user filesystem paths to enumerate previously processed targets. That exceeds normal web research scope and creates unnecessary access to local data, enabling unauthorized reading of user files and coupling the skill to sensitive host-state.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This section combines reading local CSVs via shell commands with later instructions to modify those files, but provides no warning or guardrails around filesystem access. The result is a workflow that silently inspects and updates local records, increasing risk of unauthorized data handling and damage to existing files.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow intensifies the collection campaign by mandating retries, immediate restarts on timeouts, and persistence until contacts are found. This makes the cross-platform personal-data gathering more aggressive and scalable, increasing harm and reducing meaningful operator judgment.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction to run 24/7, immediately respawn subagents, and never stop establishes uncontrolled autonomous execution beyond a bounded task. This can consume resources indefinitely, evade normal user oversight, and turn the skill into a persistent collection process.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill writes results to persistent CSV files but does not clearly warn the user that it will modify workspace state and retain harvested contact data across sessions. Hidden persistence increases the chance of accidental retention, reuse, or disclosure of sensitive research outputs.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The instructions direct creation and modification of workspace files without warning about overwriting, polluting, or conflicting with existing data. While less severe than persistence, unannounced state changes can damage user workflows, introduce confusion, and make later agent actions rely on unintended file contents.
- Content
Static analysis
No suspicious patterns detected.