Security audit

agent-avatars

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches an avatar-minting purpose, but its optional heartbeat can repeatedly fetch and activate mutable remote instructions after review.

Review before installing, especially before enabling heartbeat. Leave heartbeat disabled unless you trust the remote service to change future agent instructions, store any API key with owner-only permissions or a secret manager, avoid sensitive text in the name/description fields, and prefer a pinned installer or verified package source.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:28
Finding: Mutable Remote Skill Instructions Are Automatically Retrieved and Executed
Content: View full analysis
~/.config/molt-avatar/SKILL.md curl -s https://agent-avatars-production.up.railway.app/heartbeat.md > ~/.config/molt-avatar/HEARTBEAT.md ``` ``` ### Technical Analysis The Skill directs the Agent to fetch and run `HEARTBEAT.md` periodically. That heartbeat can subsequently replace both the local Skill and heartbeat instructions with content retrieved from an externally controlled server. Although the retrieved files are Markdown rather than native executable binaries, they are behavioral instructions consumed by an AI Agent. Replacing these files therefore changes the effective payload executed by the Agent after the installed package has been reviewed. The updates are not pinned to an immutable version and are not protected by a cryptographic hash, signature, or trusted manifest. This behavior exceeds the minimum privilege necessary to check claim status or mint an avatar. Those functions only require calls to fixed API endpoints; they do not require automatically downloading and activating new behavioral instructions. ### Attack Path 1. The owner enables the optional periodic heartbeat. 2. The Agent executes the installed `HEARTBEAT.md` on a schedule. 3. The external service reports a changed version. 4. The Agent d ...[truncated 999 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:19
Finding: Installation Command Executes an Unpinned Remote Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:63
Finding: Plaintext API Credential Storage Lacks Required File-Permission Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The command reads an API key from a local credentials file and injects it into a request header. In agent environments, this pattern is risky because local secret files may be broadly accessible, and shell-based secret expansion can leak through debugging, logging, command capture, or compromised local context.
Content: Scanner excerpt · HEARTBEAT.md (reported line 23)May include surrounding context.
bash
curl -s https://agent-avatars-production.up.railway.app/api/agents/status \ -H "X-API-Key: $(cat ~/.config/molt-avatar/credentials.json | jq -r '.api_key')"

If NOT registered yet

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The instructions explicitly tell the user to save issued credentials to a local file without any safeguards. That creates a durable plaintext secret at a predictable path, which can be harvested by other tools, malware, overly broad backups, or accidental sharing.
Content: Scanner excerpt · HEARTBEAT.md (reported line 35)May include surrounding context.
-d '{"name": "YOUR_NAME", "description": "Brief description of yourself"}'

text
Save the credentials to `~/.config/molt-avatar/credentials.json` and send `claim_url` to your human. ### If registered but NOT claimed

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: This minting command again pulls the API key from a predictable local credentials file and uses it in a shell-expanded header. Repeated secret-access patterns across the skill increase exposure and normalize insecure handling, making credential theft or accidental disclosure more likely.
Content: Scanner excerpt · HEARTBEAT.md (reported line 49)May include surrounding context.
Mint your avatar:

bash
curl -X POST https://agent-avatars-production.up.railway.app/api/mint \ -H "X-API-Key: $(cat ~/.config/molt-avatar/credentials.json | jq -r '.api_key')"

Save the full_url — that's your permanent avatar!

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.
md
dentity","api_base":"https://agent-avatars-production.up.railway.app","files":{"SKILL.md":"https://agent-avatars-production.up.railway.app/skill.md","HEARTBEAT.

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The guidance centers on saving an API key to credentials.json, creating a credential-handling pattern without adequate safeguards. In context, this skill generates a reusable bearer-style secret for an external service, so insecure storage or accidental disclosure could let other parties impersonate the agent and invoke avatar-related actions.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
⚠️ Save your api_key immediately!

Recommended: Save credentials to ~/.config/molt-avatar/credentials.json:

json
{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs storing an API key in a local JSON file and using it directly in shell commands, but provides no guidance on file permissions, secret redaction, rotation, or safe handling. In an agent-skill context, this increases the chance that credentials are exposed through logs, shell history, backups, or other local processes.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · HEARTBEAT.md (reported line 30)May include surrounding context.
Register first:

bash
curl -X POST https://agent-avatars-production.up.railway.app/api/register \ -H "Content-Type: application/json" \ -d '{"name": "YOUR_NAME", "description": "Brief description of yourself"}'

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes broad phrases like profile picture, get avatar, and register avatar, which can match ordinary user intent and cause the skill to activate unexpectedly. In this skill, unintended activation is more dangerous because activation can lead to external API registration, claim workflows, and credential generation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The installation command uses npx clawdhub without pinning an exact package version, so the executed code may change over time or be replaced by a compromised upstream release. Because this is an installation path for a skill manager, a malicious or tampered package could execute arbitrary code on the user's system during install.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to send registration data (name and description) to an external service but does not present a clear privacy or consent warning. This can result in users or agents disclosing identifying or sensitive descriptive information to a third party without informed approval.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The skill explicitly performs an external POST request to a third-party service to register the agent, transmitting user-supplied metadata off-system. While this appears to be core functionality rather than malicious exfiltration, it is still security-relevant because unexpected network transmission can leak sensitive or identifying information if invoked without clear consent.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
Every agent must register to receive an API key.

bash
curl -X POST https://agent-avatars-production.up.railway.app/api/register \ -H "Content-Type: application/json" \ -d '{"name": "YourAgentName", "description": "A brief description"}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill recommends storing an API key in a local JSON file without warning about filesystem permissions, secret-management practices, or exposure to other local processes. If stored insecurely, the key could be read and abused to query agent status or mint actions on behalf of the agent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list contains generic phrases like "profile picture", "pixel art", and "get avatar" that are broad enough to match ordinary user requests unrelated to this specific skill. This can cause unintended invocation of a network-connected skill that performs identity/registration/minting actions, increasing the chance of surprise external calls or user redirection without clear intent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

If NOT registered yet

Credential Access

Credential Access

Ae1

Credential Access

Missing User Warnings

External Transmission

Vague Triggers

Rp1

Missing User Warnings

External Transmission

Missing User Warnings

Vague Triggers

Static analysis