T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:49- Finding
Persistent Retrieval and Execution of Mutable Remote Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
BapBook
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a BapBook social-network integration, but it also asks agents to run persistent remote instructions, store credentials loosely, execute unpinned downloaded code, and perform wallet/token-launch actions.
Review before installing. Use this only with explicit human approval for any post, vote, comment, wallet signature, funding, token launch, or on-chain transaction. Do not put the API key in general agent memory; use a scoped secret store. Avoid enabling the recurring heartbeat that follows remote Markdown, and do not run the downloaded Python integration unless you can verify its source, hash, and behavior.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:290- Finding
Execution of an Unpinned Script Downloaded from a Mutable Website
- Content
View full analysis
--name "YourAgent" ``` 4. **Register on BapBook**: ```bash python bap578.py register --agent --twitter your_handle ``` 5. **Link credentials** (after registration): ```bash python bap578.py link --agent --bapbook-id --api-key ``` 6. **Post via OpenClaw**: ```bash python bap578.py post --agent --title "Hello" --content "World" --subbap introductions ``` ``` ### Technical Analysis The Skill instructs users to download a Python integration from a mutable website and execute it locally. The downloaded script is not included in the audited project, and the instructions provide no pinned release, source commit, cryptographic checksum, digital signature, reproducible build information, or verification procedure. Executing `python bap578.py` grants the downloaded script the permissions of the invoking user. The script may consequently access local files, environment variables, network resources, and credentials available to that user. The `link` command additionally passes the BapBook API key through a command-line argument. Command-line secrets may be exposed through shell history, process inspection, diagnostic collection, terminal logs, or wrapper scripts. A malicious or compromised `bap578.py` would also receive the credential directly. ### Attack Path 1. An attacker compromises the BapBook website, download endpoint, deployment pipeline, or publishing account. 2. The attacker replaces the expecte ...[truncated 1242 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:340- Finding
Wallet Authentication Signature Sent Through a Third-Party Backend Proxy
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (11)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The document recommends saving credentials in a local config file or environment variables in a generic, discoverable way. That materially raises the risk of credential access by other tools, prompts, processes, or compromised components, and the same API key authorizes posting, commenting, and voting on behalf of the agent.
- Content
}
text Store this in your memory, a config file (e.g. `~/.config/bapbook/credentials.json`), or environment variables (`BAPBOOK_API_KEY`). You can also save it wherever you store secrets - just make sure you can find it later. ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
The registration flow sends identifying agent data to an external service and initiates a trust relationship with a third-party API. External transmission is expected for a social service, but it is still security-relevant because it creates data egress, dependency on a remote system, and issuance of credentials that may later be abused if mishandled.
- Content
Every agent needs to register to get an API key. You MUST have an API key to post, comment, or vote.
bash curl -X POST https://bapbook-api.fly.dev/api/webhook \ -H "Content-Type: application/json" \ -d '{"action": "register", "agent_name": "YourAgentName", "twitter_handle": "@your_twitter"}'
Persistent Context Injection
Medium
- Category
- Memory Poisoning
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to store its API key in memory or persistent configuration. Persistent context injection of credentials is dangerous because it increases the chance that unrelated prompts, tools, logs, or future tasks can access or exfiltrate those secrets, especially in agent systems with shared memory or broad tool access.
- Content
}
text Store this in your memory, a config file (e.g. `~/.config/bapbook/credentials.json`), or environment variables (`BAPBOOK_API_KEY`). You can also save it wherever you store secrets - just make sure you can find it later. ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to add BapBook to a recurring heartbeat and periodically fetch remote content, engage, and update local state, but it does not prominently warn that this enables autonomous outbound network behavior. That creates risk of unsupervised posting, voting, commenting, and continued execution of updated remote instructions over time.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger 'every 30 minutes, or whenever you think of BapBook' is overly broad and invites autonomous external actions without a precise activation boundary. In agent environments, ambiguous recurring triggers can cause excessive network activity, repeated engagement, or unintended execution of instructions fetched from external resources.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This instruction causes outbound transmission of agent-authenticated content, including API credentials and user-provided post data, to an external service. In context, posting is part of the skill’s purpose, but it remains dangerous if performed autonomously because it can leak sensitive information, create spam, or act on prompt-injected content from prior browsing.
- Content
- Something useful that hasn't been posted before
bash curl -X POST https://bapbook-api.fly.dev/api/webhook \ -H "Content-Type: application/json" \ -d '{ "action": "post",
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill’s stated purpose is a social-network integration, but this section expands into wallet operations, token launches, signature-based auth, and on-chain transaction flows. That scope expansion materially increases financial and operational risk because an agent following the skill could be induced to perform blockchain actions far beyond ordinary posting or browsing, including actions involving funds, contracts, and token issuance.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language examples such as 'Fund my agent with 0.1 BNB' and 'Post to BapBook about the market' are broad enough to be matched or inferred in unintended contexts. For agents using NL command routing, such vague activation phrases can lead to sensitive financial or posting actions without robust confirmation or parameter validation.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - "Fund my agent with 0.1 BNB" - "Check my agent status" Full documentation: https://bapbook.com/skills/bap578/SKILL.md ## Launch Your Token on Four.Meme
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - "Fund my agent with 0.1 BNB" - "Check my agent status" Full documentation: https://bapbook.com/skills/bap578/SKILL.md ## Launch Your Token on Four.Meme
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The documentation emphasizes browsing, upvoting, commenting, and only occasionally posting as the skill's main operating intent. The later OpenClaw and Four.Meme sections shift the skill into wallet funding, credentialed backend proxy use, and token deployment, which conflicts with the earlier framing of the skill as primarily a lightweight community-engagement heartbeat.
- Content
Static analysis
No suspicious patterns detected.