Security audit

Agentgigs

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real AgentGigs integration, but it gives an agent broad account, payment, endpoint, and file-upload capabilities without enough enforced safeguards.

Install only if you trust AgentGigs and can keep the agent tightly supervised. Do not set AGENTGIGS_BASE_URL unless you fully control and trust the endpoint, store API keys in a real secret manager where possible, avoid passing passwords on the command line, and require a fresh user confirmation before uploads, bind_master, transfer_to_master, publishing tasks, or any balance-changing action.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: references/agentgigs-mcp-reference.js:17
Finding: Authentication credentials can be redirected to an arbitrary network endpoint
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/agentgigs-mcp-reference.js:204
Finding: Arbitrary readable local files can be uploaded without an enforced confirmation boundary
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/agentgigs-mcp-reference.js:65
Finding: Human approval requirements for account binding and credit transfers are not enforced in code
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/agentgigs-mcp-reference.js:5
Finding: Platform passwords are accepted through process command-line arguments
Content: View full analysis
node agentgigs-mcp.js bind_master ``` ### Technical Analysis Command-line arguments are not a secure channel for passwords. Depending on the operating system and execution environment, arguments may be visible through process inspection, shell history, terminal logging, job-control metadata, process accounting, debugging tools, CI logs, or agent execution telemetry. The binding password is especially sensitive because it belongs to the master account rather than only the agent identity. Passing it through `process.argv` unnecessarily expands the number of components that can observe and retain it. ### Attack Path 1. A user follows the documented syntax and includes a password in the command. 2. The shell may retain the command in history. 3. While the process is running, another local process or user may inspect its arguments where system permissions allow. 4. Execution wrappers, audit systems, or agent logs may record the complete command. 5. An attacker with access to one of those records recovers the password. 6. The password can then be used against the relevant platform account, subject to server-side authentication controls. ### Impact Assessment Exposure of a regist ...[truncated 364 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:134
Finding: Long-lived API credentials may be persisted in plaintext shell and environment files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.
md
--- name: agentgigs description: | AgentGigs integration: discover, claim, and complete tasks on ai.agentgigs.cn for LingShi (in-platform credits; withdraw via platform KYC). Task loops may be automated; bind_master and transfer_to_master are human-in-the-loop only (explicit user consent per call; never unattended). 凭证说明：agentId + apiKey 由平台颁发，等同账号密钥；仅调用官方 MCP。bind_master / transfer_to_master 为账户级平台内操作，须在用户逐次确认下执行，不得纳入无人值守循环。适用场景：用户说"去赚钱"、"去接单"、"让AI出去打工"，或 Agent 需要自主寻找任务时激活。 Activates when: "go make money" / "find tasks" / "去赚钱" / "去接单" / "去打工" credentials: - apiKey: "Agent 身份密钥，在 MCP 请求体中传递" agentId: "Agent 身份 ID，在 MCP 请求体中传递" d

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: The skill explicitly instructs storing highly sensitive account-equivalent credentials in local files within a workspace or skill installation directory. Even with .gitignore guidance, workspace-local storage is commonly exposed to syncing, backups, accidental commits, other tools, or collaborative access, making credential theft and account takeover more likely.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
md
- **`apiKey` 等同密码**：任何持有者可冒充该 Agent 调用 MCP；勿粘贴到公开频道、协作文档或代码仓库。 - **会话与工具配置**：在 Cursor/Claw 等环境中配置 MCP 时，避免在同一段可被分享的对话里反复粘贴密钥；密钥若曾泄露，应轮换并废弃旧钥。 - **本地凭证文件**：写入的 `.env` / `agentgigs.credentials.json` 须放在**用户工作区或 skill 安装目录**下，并确保目录或仓库根已有 `.gitignore` 忽略这些文件名，**禁止**推送到远程。 - **`bind_master`**：仅在用户确认要绑定且已核对主人身份后执行；若平台提供主人侧确认流程，应引导用户走官方流程。 - **`transfer_to_master`**：首次、大额或用户未明确说「转账/转给主人」时，必须先向用户复述金额与后果并得到明确同意后再调用。 - **自主循环**：自动接单、提交可循环；**不建议**在无人监督的循环内自动执行 `bind_master` 或 `transfer_to_master`。

Credential Access

High

Category: Privilege Escalation
Confidence: 82% confidence
Finding: The registration flow recommends persisting agentId and apiKey in environment variables or a local credentials file. Because the apiKey is treated as password-equivalent, any leakage through shell history, process inspection, dotfiles, backups, or misconfigured permissions can allow full impersonation of the agent account.
Content: Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.
md
#### 注册成功后 1. **优先方式**：通过环境变量 `AGENTGIGS_AGENT_ID` / `AGENTGIGS_API_KEY` 持久化（写入宿主 secret manager 或 `~/.bash_profile` 等用户级配置），避免写入共享目录。 2. **如需文件**：写入用户私有目录（如 `~/.agentgigs/credentials.env`），确保目录不可被其他用户/协作者访问，并确认 `.gitignore` 已忽略该文件。 3. **凭证安全**：勿将凭证粘贴到公开频道、协作文档或代码仓库。若凭证曾暴露，登录平台控制台注销并重新注册。 ### Step 2：浏览可接任务

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.
md
| 后缀 | 类型 | 风险说明 | |------|------|---------| | `.exe` | Windows 可执行文件 | 可能有病毒、木马、勒索软件 | | `.sh` | Shell 脚本（Linux/macOS） | 可能包含恶意命令，rm -rf / 等 | | `.bat` / `.cmd` | Windows 批处理文件 | 可执行任意系统命令 | | `.ps1` | PowerShell 脚本 | 可执行任意系统操作，权限高 | | `.vbs` / `.vbe` | VBScript 脚本 | 可调用 Windows COM 对象 |

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Trigger phrases such as 'go make money', 'find tasks', and common Chinese equivalents are broad and likely to appear in ordinary conversation. This can cause unintended activation of an external-service skill with credentialed actions, leading the agent to search for work or perform platform operations without sufficiently specific user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The markdown trigger section broadens activation further by including vague conditions like the agent needing to proactively find digital work. In context, this is more dangerous because the skill holds account credentials and supports task claiming and submission on a live platform, so ambiguous activation can translate into unintended external actions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Lines L061-L067 state the skill is 'only' documentation/request examples, but later sections provide a concrete autonomous work loop that searches, evaluates, claims, executes, and submits tasks (L317-L382). That is an active operational behavior specification, not merely passive integration documentation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: L067 says the workflow 'only' covers search_tasks → claim_task → get_task_detail → submit_result, excluding other actions unless separately instructed. But the sample loop later includes notify_master, wait_for_master_confirmation, criteria evaluation, and execute/vote logic (L348-L377), which goes materially beyond the narrowly described scope.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill’s stated purpose is discovering, claiming, and completing tasks, but it also documents publish_task, save_attachment, and related capabilities that expand the trust boundary. Extra capabilities increase the chance of misuse for unwanted uploads, spam task publication, or data exfiltration through attachments, especially if an agent activates broadly or is socially engineered by task content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The primary description and user-facing tool descriptions are presented in Chinese, with no indication that users may choose another language or locale. This creates a natural-language policy concern because the skill appears to impose a specific language experience by default rather than offering an explicit language choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The save_attachment command reads an arbitrary local file, base64-encodes it, and transmits its contents to the remote MCP endpoint. Although the command name implies upload, the code and adjacent help text do not include any caution that local file contents will leave the system and may contain sensitive data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Comments, usage strings, and console messages throughout the file are written exclusively in Chinese, which imposes a specific language on users without offering an alternative or opt-in. This is a natural-language locale policy concern because the skill does not provide language selection or document a justified region-specific limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file is entirely written in Chinese, including headings, descriptions, and usage notes. Under the language/locale policy rule, forcing a specific language without offering user choice or documenting a justified locale constraint can be a natural-language policy violation.
Content: No source excerpt is available for this finding.