AI Agent Bounty Factory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:18 AM UTC
• Version: 1.0.0

Overview

The skill is not overtly malicious, but it materially overstates real autonomous marketplace and staking behavior while only running a local mock tracker.

Review carefully before installing. Treat this as a local simulation/demo unless the author aligns the documentation with the implementation or adds real platform integrations with explicit confirmations, dry-run behavior, credential guidance, and scoped file storage.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill documentation materially overstates what the tool does, claiming autonomous polling, marketplace submission, staking behavior, and earnings tracking when the implementation reportedly only uses mock data and local bookkeeping. This is dangerous because operators may trust it to interact with external platforms or make financial decisions under false assumptions, leading to misuse, bad operational decisions, or unsafe deployment in higher-privilege environments.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 79% confidence
• Finding: The script writes JSON to file paths taken directly from environment variables without any path restrictions or confirmation. In an agent context, a caller who can influence BOUNTY_TRACKER or BOUNTY_EARNINGS can cause arbitrary local file overwrite within the agent's accessible filesystem, leading to data clobbering or tampering.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 79% confidence
• Finding: The script writes JSON to file paths taken directly from environment variables without any path restrictions or confirmation. In an agent context, a caller who can influence BOUNTY_TRACKER or BOUNTY_EARNINGS can cause arbitrary local file overwrite within the agent's accessible filesystem, leading to data clobbering or tampering.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README promotes autonomous discovery and bulk submission actions such as 'submit-all' and '24/7 Autopilot' without prominently warning about consequential behavior like mass submissions, platform policy violations, unintended staking risk, or reputational/account damage. In this skill context, the omission is more dangerous because the tool is explicitly designed to act across external freelance platforms and can trigger real-world transactions or commitments at scale.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Describing an auto-submit capability without prominent warnings about external side effects normalizes unattended actions that could create unwanted submissions, spam third-party platforms, or incur financial/reputational consequences. In this skill context, the risk is elevated because the stated purpose is autonomous income generation across multiple marketplaces, which implies potentially repeated external actions at scale.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: Telling users to configure API keys without guidance on secure storage, least privilege, and data transmission can lead to credential mishandling or accidental exposure when integrating with external services. This matters more here because the skill is framed as an always-on autonomous system that may continuously access multiple third-party platforms, increasing the blast radius of leaked credentials.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest documents two operating modes with different risk profiles: proposal mode and instant mode requiring staking. In code, PROPOSAL_MODE is read from the environment but never referenced afterward, and all submissions follow the same simulated local write path with no distinction in behavior.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest describes an autonomous system that polls ClawTasks, OpenWork, Dework, and Layer3, generates proposals, submits automatically, and tracks earnings across platforms. In this implementation, bounty discovery reads only from a static in-memory MOCK_BOUNTIES list and submission merely appends a simulated record to a local tracker file, so the described platform integration and real submission behavior are not present.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The bulk submit path performs state-changing writes for every discovered bounty with no confirmation, dry-run default, or review gate. In an agent skill marketed as autonomous income generation, this increases the risk of unintended mass actions, local record tampering, and if later connected to real platforms, automatic spammy or costly submissions at scale.

Description-Behavior Mismatch

Low

• Confidence: 88% confidence
• Finding: The manifest says the pipeline tracks submitted, accepted, in_progress, submitted_deliverable, and paid states. This file only creates submissions with status 'submitted' and the status view counts submitted, accepted, and paid without any code to transition items into accepted, in_progress, submitted_deliverable, or paid states.

Static analysis

No suspicious patterns detected.