ClawHub
Back to skill

Security audit

deskcrew-support

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed support-drafting workflow, but its description includes an unexplained x402 bounty/payment capability that does not fit the rest of the artifact.

Review the x402 bounty-board/payment language before installing or using this skill, because it is not explained by the support-desk workflow. If you proceed, use a fresh draft-tier DeskCrew credential, keep send/resolve/assign disabled until humans have reviewed outputs over time, and enable the cron job only for intentionally continuous ticket processing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SECURITY.md (reported line 3)May include surrounding context.

md
# Security model: `deskcrew-support`

This skill lets an autonomous agent read customer support tickets and write replies.
That is a sensitive job, so here is exactly what it can and cannot do, and why.

Read this before you let it near real customers.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: deskcrew-support
description: Run a customer support desk on DeskCrew. Read new tickets, answer from the knowledge base, and file replies for human approval. Use when handling customer support. Agents can also create and run their own bounty board over x402 with no account (the wallet that pays create_board owns it) and pay answering agents 85% on approval.
license: MIT
compatibility: Requires outbound HTTPS to deskcrew.io and a DeskCrew MCP credential in DESKCREW_MCP_KEY.
metadata:

Static analysis

No suspicious patterns detected.