Security audit

Agentok Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill does advertise account signup and posting, but it sends credentials to an unrelated configurable endpoint and stores reusable login data in unsafe local files.

Review this carefully before installing. Only run it if you trust the AgentTok operator and have verified the API endpoint; avoid sourcing ~/.agenttok/env.sh until the generated file is safely escaped. Use a throwaway account/email, run on a single-user or sandboxed machine, and remove or tightly chmod ~/.agenttok credentials after testing.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

other

Error

Location: scripts/join.sh:11
Finding: Registration Credentials and Tokens Are Sent to an Untrusted, Inconsistent API Endpoint
Content: View full analysis
skill.md default API=$(cat ~/.agenttok/api_url.txt 2>/dev/null || echo "https://rev-mon-avon-childhood.trycloudflare.com") echo "🎬 Joining AgentTok as $NAME (@$HANDLE)..." # Register REG=$(curl -s -X POST "$API/api/auth/register" \ -H "Content-Type: application/json" \ -d "{\"name\":\"$NAME\",\"handle\":\"$HANDLE\",\"email\":\"$EMAIL\",\"password\":\"$PASSWORD\",\"description\":\"Hello! I'm $NAME on AgentTok 🎬\",\"niche\":\"tech\"}") ``` ### Technical Analysis The Skill declares `https://agentstok.com` as its homepage, but registration, authentication, video upload, and later API operations default to the unrelated ephemeral Cloudflare Tunnel hostname `rev-mon-avon-childhood.trycloudflare.com`. The script does not verify that the selected API belongs to the declared service. The endpoint can also be overridden by the contents of `~/.agenttok/api_url.txt`. Consequently, an attacker who can modify that file can redirect all account and upload traffic without changing the Skill package. TLS protects transport to the selected host but does not establish that the host is the intended AgentTok service. The initial registration request discloses the user's name, handle, email, and generated password. Subsequent code sends authentication requests, a generated video, and bearer-authenticated API requests to the same endpoint. ### Attack Path 1. A user invokes `scripts/join.sh` as documented. 2. The script selects either the hardcoded Cloudflare Tunnel or a hostname read from `~/.agenttok/api_url.txt`. 3. The script sends the user's identifying information and generated password to that host. 4. The host returns an authentication token or API key and receives the generated video. 5. The script stores the selected endpoint for lat ...[truncated 920 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/join.sh:62
Finding: Arbitrary Shell Command Execution Through Generated Environment File
Content: View full analysis
~/.agenttok/env.sh << EOF export AGENTTOK_API="$API" export AGENTTOK_TOKEN="$TOKEN" export AGENTTOK_HANDLE="$HANDLE" EOF ``` The generated file is explicitly sourced by `SKILL.md`: ```bash source ~/.agenttok/env.sh ``` ### Technical Analysis The script writes `API`, `TOKEN`, and `HANDLE` directly into executable shell syntax without shell escaping. These values are not all trusted: - `TOKEN` is obtained from a remote API response. - `API` can be loaded from the locally mutable `~/.agenttok/api_url.txt`. - `HANDLE` is command-line input. Double quotes do not make arbitrary text safe when constructing a shell script. A value containing a double quote, newline, command substitution, or additional shell statement can break out of the intended assignment. The resulting content executes when the user follows the documented instruction to run `source ~/.agenttok/env.sh`. For example, a malicious API can return a token containing a newline and a shell command. That content is written to `env.sh` as executable syntax rather than treated solely as data. The dangerous operation may occur later, making the generated file a persistent cross-session execution vector until it is removed or replaced. ### Attack Path 1. The user runs `scripts/join.sh`. 2. The script contacts the selected API endpoint. 3. A malicious or compromised API returns a crafted token containing shell syntax. 4. The script interpolates the token into `~/.agenttok/env.sh` without escaping it. 5. The user follows `SKILL.md` and runs `source ~/.agenttok/env.sh`. 6. The shell parses and executes the injected commands with the user's operating-system privileges. A similar path is possible through a crafted handle or a poisoned `~/.agenttok/api_url.txt`. ### Impact Assessment Succe ...[truncated 528 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/join.sh:55
Finding: Plaintext Credentials Are Stored Without Enforced Access Permissions
Content: View full analysis
~/.agenttok/credentials.json << EOF {"name":"$NAME","handle":"$HANDLE","email":"$EMAIL","password":"$PASSWORD","token":"$TOKEN","api_url":"$API"} EOF echo "$API" > ~/.agenttok/api_url.txt cat > ~/.agenttok/env.sh << EOF export AGENTTOK_API="$API" export AGENTTOK_TOKEN="$TOKEN" export AGENTTOK_HANDLE="$HANDLE" EOF ``` ### Technical Analysis The generated password and bearer token are written to plaintext files under `~/.agenttok`. The script does not set a restrictive `umask`, assign mode `0700` to the directory, or assign mode `0600` to the files. Permissions therefore depend on the caller's existing environment and any pre-existing directory or files. With a common `022` umask, newly created files may be mode `0644`, allowing other local users to read them on multi-user systems. Existing files may retain even less restrictive permissions when truncated and rewritten. The password is retained even though subsequent documented operations use the token. This increases the amount and lifetime of sensitive data stored locally beyond what is clearly necessary for upload and notification functionality. ### Attack Path 1. The user runs `scripts/join.sh` under a permissive umask or with pre-existing permissive files. 2. The script writes the email, account password, and bearer token to `credentials.json`, and duplicates the token in `env.sh`. 3. Another local account, unrelated process, backup job, or accidental archive reads the files. 4. The exposed password or token is reused to authenticate as the affected AgentTok account. ### Impact Assessment Exposure allows account impersonation within the remote service, including access to any operations authorized by the bearer token or password. ...[truncated 385 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/join.sh:36
Finding: Predictable Temporary Video Path Permits Symlink Attacks and Leaves Residual Data
Content: View full analysis
/dev/null echo "✅ Video created" ``` ### Technical Analysis The output path is predictable and constructed from the user-supplied handle in the globally shared `/tmp` directory. The script does not use `mktemp`, does not establish a private temporary directory, and invokes FFmpeg with `-y`, which authorizes overwriting an existing output. On systems where another local user can create an entry at the predicted path before execution, an attacker may place a symbolic link pointing to a file writable by the victim. Whether a particular target is overwritten depends on FFmpeg's file-opening behavior and operating-system protections, but the pattern is inherently unsafe. The script also lacks an exit trap to remove the generated video. As a result, uploaded content remains in `/tmp` after successful or failed execution and may be exposed according to resulting file permissions. ### Attack Path 1. A local attacker learns or predicts the handle the victim will use. 2. The attacker creates `/tmp/agenttok_intro_.mp4` as a symbolic link to a target writable by the victim. 3. The victim runs `scripts/join.sh`. 4. FFmpeg opens the predictable path with overwrite enabled. 5. If symbolic-link following is permitted in that environment, the target is replaced or corrupted. 6. Independently of exploitati ...[truncated 546 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (14)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/join.sh (reported line 17)May include surrounding context.
sh
echo "🎬 Joining AgentTok as $NAME (@$HANDLE)..." # Register REG=$(curl -s -X POST "$API/api/auth/register" \ -H "Content-Type: application/json" \ -d "{\"name\":\"$NAME\",\"handle\":\"$HANDLE\",\"email\":\"$EMAIL\",\"password\":\"$PASSWORD\",\"description\":\"Hello! I'm $NAME on AgentTok 🎬\",\"niche\":\"tech\"}")

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/join.sh (reported line 27)May include surrounding context.
sh
if [ -z "$TOKEN" ]; then if [ -n "$API_KEY" ]; then LOGIN=$(curl -s -X POST "$API/api/auth/login" -H "Content-Type: application/json" -d "{\"api_key\":\"$API_KEY\"}") else LOGIN=$(curl -s -X POST "$API/api/auth/login" -H "Content-Type: application/json" -d "{\"email\":\"$EMAIL\",\"password\":\"$PASSWORD\"}") fi

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: Saving credentials.json with email, password, token, and API URL creates a concentrated secret store in plaintext. Any local compromise, backup leak, or accidental file sharing would immediately grant account access and may expose the user's email identity as well.
Content: Scanner excerpt · scripts/join.sh (reported line 56)May include surrounding context.
sh
# Save credentials + env helper mkdir -p ~/.agenttok cat > ~/.agenttok/credentials.json << EOF {"name":"$NAME","handle":"$HANDLE","email":"$EMAIL","password":"$PASSWORD","token":"$TOKEN","api_url":"$API"} EOF echo "$API" > ~/.agenttok/api_url.txt

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill invokes shell commands (bash, source, curl) but does not declare any tool scope or permissions boundary. That omission can cause an agent or user to run networked shell actions without explicit consent or policy review, increasing the chance of unintended external access and side effects.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: The skill is designed to auto-join a service, save credentials, and support recurring authenticated use via source ~/.agenttok/env.sh, which establishes persistent session material on disk. Persistent authentication increases the blast radius of compromise because any local process or later command with access to that file can reuse the session to act as the agent account.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: agenttok version: 2.2.0 description: TikTok for AI agents. Auto-join, create your intro video, and start posting — all in one command. homepage: https://agentstok.com ---

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill states that credentials are saved to ~/.agenttok/ but does not present this as a prominent warning before execution. Silent or under-emphasized local credential persistence can lead to secret exposure through weak file permissions, backups, shared environments, or later accidental disclosure by other tools.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/join.sh (reported line 2)May include surrounding context.
sh
#!/bin/bash # join.sh — Auto-join AgentTok: register, create intro video, upload set -e NAME="${1:?Usage: join.sh \"AgentName\" \"handle\" \"email@example.com\"}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: This POST sends sensitive registration data, including email and password, to a remote endpoint selected from a local file or a Cloudflare tunnel default. Because the destination is not strongly authenticated or constrained to a trusted domain, a malicious or tampered endpoint could capture credentials and issue deceptive tokens.
Content: Scanner excerpt · scripts/join.sh (reported line 17)May include surrounding context.
sh
echo "🎬 Joining AgentTok as $NAME (@$HANDLE)..." # Register REG=$(curl -s -X POST "$API/api/auth/register" \ -H "Content-Type: application/json" \ -d "{\"name\":\"$NAME\",\"handle\":\"$HANDLE\",\"email\":\"$EMAIL\",\"password\":\"$PASSWORD\",\"description\":\"Hello! I'm $NAME on AgentTok 🎬\",\"niche\":\"tech\"}")

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The registration flow transmits personal data such as name, handle, email, and password to a remote API, and the later upload also transmits generated content, without an explicit user warning about what is being sent and where. This is especially risky because the default endpoint is a transient third-party tunnel domain rather than a clearly trusted production hostname.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The login request transmits either an API key or email/password to a remote API endpoint, again without strong destination validation. If the API URL is attacker-controlled via ~/.agenttok/api_url.txt or the insecure default, this enables credential harvesting and unauthorized account access.
Content: Scanner excerpt · scripts/join.sh (reported line 27)May include surrounding context.
sh
if [ -z "$TOKEN" ]; then if [ -n "$API_KEY" ]; then LOGIN=$(curl -s -X POST "$API/api/auth/login" -H "Content-Type: application/json" -d "{\"api_key\":\"$API_KEY\"}") else LOGIN=$(curl -s -X POST "$API/api/auth/login" -H "Content-Type: application/json" -d "{\"email\":\"$EMAIL\",\"password\":\"$PASSWORD\"}") fi

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/join.sh (reported line 37)May include surrounding context.
sh
[ -z "$TOKEN" ] && echo "❌ Auth failed" && exit 1 echo "✅ Registered & logged in!" # Create intro video VIDEO="/tmp/agenttok_intro_${HANDLE}.mp4" ffmpeg -y -f lavfi -i "color=c=#0a1628:s=1080x1920:d=15:r=30" \ -vf "drawtext=text='AgentTok':fontsize=80:fontcolor=#00f5ff:x=(w-text_w)/2:y=h/4:enable='gte(t,0.5)',\

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script persists reusable credentials, including a live auth token and generated password, to disk even though the stated purpose is only to join and upload an intro video. This expands the blast radius from a one-time registration flow to ongoing account access if the local files are read by another user, process, or malware.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script writes the user's email, generated password, and bearer token to local files without prior warning or confirmation. Secret persistence without notice violates least surprise and can expose credentials to other local users, backups, logs, or malware on the host.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Creating ~/.agenttok/env.sh turns the one-time join action into a reusable API access bootstrap, making it easy for later scripts to inherit authenticated access without re-authentication. That helper is not clearly necessary for creating and uploading a single intro video and increases the risk of silent downstream abuse of the account.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.