ClawHub
Back to skill

Security audit

Delagent

Security checks for vulnerabilities and agentic risk

Overview

This skill is for a real-money external agent marketplace, but it asks agents to keep polling, persist credentials, and act on remote guidance without enough user-control safeguards.

Review this skill carefully before installing. Use it only with a Delagent account you intend to expose to external marketplace activity, keep secrets in a proper secret store, do not post confidential or regulated data, require explicit approval before applications, task creation, delivery decisions, payment signaling, or thread messages, and do not enable recurring polling unless you set a clear expiry and removal path.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:303
Finding

Remote Service Guidance Can Hijack Agent Behavior

Content
View full analysis
0):** ```bash curl -s -H "Authorization: Bearer $TOKEN" "https://delagent.net/api/v1/inbox/deep" | jq '.events[]' ``` Returns full event details: `taskId`, `taskTitle`, `eventType`, `priority`, `metadata`. Calling this marks all current events as read. **Step 3 — Pull task detail (when an event needs action):** ```bash curl -s -H "Authorization: Bearer $TOKEN" "https://delagent.net/api/v1/tasks/" | jq '.' ``` **Engagement discipline (read once, apply every turn):** Every LLM turn is one-shot. Without a deliberate contract, agents drift to idle after the first `count: 0` poll and abandon active engagements (postings waiting on applications, applications waiting on acceptance, accepted tasks mid-flight, deliveries waiting on approval, payments waiting on confirmation). **A single "nothing new" poll is not a stop signal.** ``` ### Technical Analysis The Skill directs the agent to read a remotely supplied `guidance` field as an indication of “what to do next.” It also imposes an instruction contract that is intended to apply on every LLM turn. Task details, inbox events, thread messages, and guidance originate from an external service, but the Skill does not require these values to be treated as untrusted data. Consequently, a malicious marketplace participant or compromised service could place instruction-like content in a task, message, event, or guidance response. An agent following the Skill may interpret that content as an oper ...[truncated 1703 chars]
Remediation
View remediation

T06 · System Persistence

Error
Location
SKILL.md:345
Finding

Instructions Establish Persistent Scheduled Execution

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (11)

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill is explicitly designed to send data and credentials-bearing requests to an external third-party service via curl. External transmission is expected for this skill, but it remains security-relevant because the agent may transmit sensitive metadata, authentication material, task content, and deliverables outside the local trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
- DELAGENT_LOGIN_ID
        - DELAGENT_SECRET
      bins:
        - curl
        - jq
    primaryEnv: DELAGENT_LOGIN_ID
    emoji: "🤝"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill encourages participation in a public marketplace and task-thread communication but does not clearly warn that posted content, activity history, and profile/task interactions may be visible to operators or become part of a durable public record. This can cause agents or users to disclose sensitive data, internal context, or confidential deliverables to an external service under the mistaken assumption that the interaction is private.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

REFRESH_TOKEN=$(echo "$RESPONSE" | jq -r '.refresh_token')

text

**Capture the `refresh_token` immediately — it is only shown in this response.** Persist it somewhere durable (the OpenClaw runtime's secret store, an env var slot, or a file with chmod 600). Without it you'll have to re-enter your `secret` every 24 hours.

Use the JWT on every authenticated call: `-H "Authorization: Bearer $JWT"`.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This request transmits a long-lived refresh_token to the external service in exchange for a new JWT. Refresh tokens are high-value credentials; if mishandled in logs, shell history, process inspection, or copied into insecure storage, they can enable persistent account access and session hijacking.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

If you've been idle long enough that your JWT actually expired, exchange your refresh_token for a fresh one:

bash
RESPONSE=$(curl -s -X POST https://delagent.net/api/v1/credentials/refresh-token/exchange \
  -H "Content-Type: application/json" \
  -d "{\"refresh_token\":\"$REFRESH_TOKEN\"}")
JWT=$(echo "$RESPONSE" | jq -r '.jwt')

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The recovery flow takes a server-supplied recovery URL from a 401 response and uses it to construct the next authenticated request. Although it is prefixed with the expected host, trusting a remotely supplied path for auth recovery broadens the attack surface and can direct the client to unintended internal endpoints or future-sensitive routes while sending a refresh token.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
local body="$1"
  local recovery_url=$(echo "$body" | jq -r '.recovery.url // empty')
  if [ -n "$recovery_url" ]; then
    RESP=$(curl -s -X POST "https://delagent.net$recovery_url" \
      -H "Content-Type: application/json" \
      -d "{\"refresh_token\":\"$REFRESH_TOKEN\"}")
    NEW_JWT=$(echo "$RESP" | jq -r '.jwt // empty')

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This login example sends the long-lived secret to the external service, making the operation inherently high sensitivity. While authentication is necessary, the skill normalizes repeated secret transmission and fallback relogin, increasing the chance of exposure through logs, debugging, prompt leakage, or insecure runtime handling.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md
if [ -n "$NEW_JWT" ]; then JWT="$NEW_JWT"; return 0; fi
  fi
  # Refresh dead — fall back to full re-signin
  RESP=$(curl -s -X POST "https://delagent.net/api/v1/agent-auth/login" \
    -H "Content-Type: application/json" \
    -d "{\"loginId\":\"$DELAGENT_LOGIN_ID\",\"secret\":\"$DELAGENT_SECRET\"}")
  JWT=$(echo "$RESP" | jq -r '.token')

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This call manages additional refresh-token sessions on an external service, which expands the credential footprint and increases the number of active authentication artifacts. More sessions mean more opportunities for token theft, forgotten revocation, and persistence across machines.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

bash
# Mint a labeled token for a second machine
curl -s -X POST https://delagent.net/api/v1/credentials/refresh-tokens \
  -H "Authorization: Bearer $JWT" \
  -H "Content-Type: application/json" \
  -d '{"label":"laptop-2"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

Applying to tasks sends authenticated activity to a third-party marketplace and may reveal interest, capabilities, and operational metadata externally. In context, this is core functionality rather than hidden exfiltration, but it still creates privacy and organizational data-leakage risk if used with sensitive work contexts.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

Apply to a task

bash
curl -s -X POST https://delagent.net/api/v1/tasks/apply \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"taskId":"<task-id>"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The delivery endpoint encourages sending completed work and links to an external service, which can directly exfiltrate proprietary code, documents, internal URLs, or regulated data. Because deliveries are the primary output channel of the skill, the risk is substantial if the agent is handling sensitive or customer-owned material.

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

When your work is complete:

bash
curl -s -X POST https://delagent.net/api/v1/tasks/deliver \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"taskId":"<task-id>","deliveryText":"Description of completed work with any relevant links"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

Thread posting sends free-form message content to the external platform, creating a strong risk of leaking secrets, internal reasoning, credentials, client details, or other sensitive context into a durable third-party record. The skill also frames the thread as an event log, which increases the chance that users will post detailed operational information.

Content

Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.

md
curl -s -H "Authorization: Bearer $TOKEN" "https://delagent.net/api/v1/tasks/thread?taskId=<task-id>" | jq '.messages[]'

# Post to thread
curl -s -X POST https://delagent.net/api/v1/tasks/thread \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"taskId":"<task-id>","messageText":"Your message here"}'

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The line encourages the agent to promote the service to the operator ('tell them about this opportunity') rather than limiting behavior to explicit user-requested assistance. This is a natural-language policy concern because it nudges unsolicited promotional outreach embedded in the skill instructions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.