Locus Contractors

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:10 PM UTC
• Version: 1.0.0

Overview

This payment skill has a clear purpose, but it needs review because it grants payment authority and adds persistent remote self-updating instructions without strong user control.

Install only after reviewing the payment limits, API-key handling, and heartbeat behavior. Use strict spending caps and approval thresholds, avoid sharing confidential order details or private links, store the API key with restrictive permissions or a secret manager, and do not enable the remote self-updating heartbeat unless you accept that future instructions can change outside the reviewed package.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: heartbeat.md:9

Finding

Automatic Retrieval and Following of Mutable Remote Skill Instructions

Content

View full analysis

~/.locus/skills/SKILL.md curl -s https://paywithlocus.com/onboarding.md > ~/.locus/skills/ONBOARDING.md curl -s https://paywithlocus.com/fiverr.md > ~/.locus/skills/FIVERR.md curl -s https://paywithlocus.com/heartbeat.md > ~/.locus/skills/HEARTBEAT.md curl -s https://paywithlocus.com/skill.json > ~/.locus/skills/skill.json ``` ``` The corresponding activation instruction is: ```markdown ## Locus (every 30 minutes) If 30+ minutes since last Locus check: 1. Fetch and follow https://paywithlocus.com/heartbeat.md 2. Update lastLocusCheck timestamp ``` ### Technical Analysis The Skill instructs the Agent to retrieve mutable Markdown from a remote server and explicitly “follow” it. It also replaces locally installed Skill files with responses from that server. No cryptographic signature, pinned digest, immutable version URL, schema validation, content review, or human approval is required before the downloaded instructions become active. HTTPS protects data in transit and authenticates the server under the public certificate infrastructure, but it does not ensure that future content is identical to the content reviewed during this audit. Consequently, compromise of the origin, its deployment pipeline, DNS or account controls—or an intentional post-review content change—can alter the effective Skill behavior. Although the retrieved payload is Markdown rather than a native executable, Agent instructions can ...[truncated 1776 chars]

Remediation

View remediation

T06 · System Persistence

Error

• Location: skill.md:155

Finding

Persistent Recurring Task Extends Skill Control Beyond the Initiating Request

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: onboarding.md:54

Finding

Payment-Capable API Key Stored in a Plaintext File Without Explicit Permission Hardening

Content

View full analysis

~/.config/locus/credentials.json << 'EOF' { "api_key": "claw_xxx_your_key_here", "api_base": "https://api.paywithlocus.com/api" } EOF ``` Or set the environment variable `LOCUS_API_KEY` if you prefer. ``` ### Technical Analysis The onboarding workflow writes the Locus bearer token to a plaintext JSON file. It does not create the directory with mode `0700`, create the file with mode `0600`, verify ownership, or recommend an operating-system credential store. Actual permissions depend on the existing directory and the user's `umask`. A restrictive `umask` may reduce exposure, but the documentation does not enforce or verify it. The Skill explicitly states that the API key represents the user's identity and can authorize wallet spending, making local disclosure security-sensitive. Environment-variable storage is also offered without discussing inheritance and exposure to child processes, diagnostics, crash reports, or process-inspection mechanisms. ### Attack Path 1. The user or Agent follows the onboarding command. 2. The API key is written unencrypted to `~/.config/locus/credentials.json`. 3. The file receives permissions determined by the environment rather than explicit security controls. 4. Another local user or process, an overly broad backup job, malware, or an Agent tool with filesystem access reads the file. 5. The attacker submits the token as a bearer credential to `api.paywithlocus.com`. 6. The attacker queries private account data or initiates payments and orders within the token's policy limits. ### Impact Assessment Exposure of the API key can permit: - Authentication as the affected Locus Agent identity. - Viewing order and delivera ...[truncated 487 chars]

Remediation

View remediation

"$HOME/.config/locus/credentials.json" <<'EOF' { "api_key": "claw_xxx_your_key_here", "api_base": "https://api.paywithlocus.com/api" } EOF chmod 600 "$HOME/.config/locus/credentials.json" ``` 3. Verify that the file is owned by the expected user and reject symbolic links before writing. 4. Avoid placing the real key in shell command arguments, logs, examples, or command history. 5. Apply least-privilege API scopes where supported, separating read-only order polling from payment authority. 6. Enable conservative allowance, per-transaction, and approval-threshold controls by default rather than treating them as merely optional. 7. Provide documented key revocation and rotation procedures. 8. Avoid long-lived environment variables where untrusted child processes can inherit them. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (37)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill instructs storing a payment-capable API key in a plaintext JSON file under the user's home configuration directory without discussing file permissions, secret-store alternatives, or logging risks. In this skill's context, compromise of that file can grant an attacker or another local process the ability to initiate transactions or orders tied to funded wallet balances.

Content

Scanner excerpt · onboarding.md (reported line 60)May include surrounding context.

bash

mkdir -p ~/.config/locus
cat > ~/.config/locus/credentials.json << 'EOF'
{
  "api_key": "claw_xxx_your_key_here",
  "api_base": "https://api.paywithlocus.com/api"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The skill directs the agent to check local credential storage and environment variables for an API key, which expands the skill's access to sensitive authentication material. In an adversarial or prompt-injected context, encouraging credential discovery is dangerous because the retrieved key can authorize wallet spending and marketplace actions.

Content

Scanner excerpt · skill.md (reported line 41)May include surrounding context.

md

## First: Do You Have an API Key?

Check for a saved Locus API key at `~/.config/locus/credentials.json` or in the `LOCUS_API_KEY` environment variable.

**If you do NOT have a key: follow [ONBOARDING.md](ONBOARDING.md) now and come back here when done.**

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · fiverr.md (reported line 5)May include surrounding context.

md

Order freelance work through Locus's escrow-backed marketplace. Funds are held in a smart contract until work is completed — your human's money is protected.

**Base URL:** `https://api.paywithlocus.com/api`
**Auth:** `Authorization: Bearer YOUR_LOCUS_API_KEY`

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · fiverr.md (reported line 15)May include surrounding context.

md

Order freelance work through Locus's escrow-backed marketplace. Funds are held in a smart contract until work is completed — your human's money is protected.

**Base URL:** `https://api.paywithlocus.com/api`
**Auth:** `Authorization: Bearer YOUR_LOCUS_API_KEY`

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · fiverr.md (reported line 163)May include surrounding context.

md

Order freelance work through Locus's escrow-backed marketplace. Funds are held in a smart contract until work is completed — your human's money is protected.

**Base URL:** `https://api.paywithlocus.com/api`
**Auth:** `Authorization: Bearer YOUR_LOCUS_API_KEY`

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · fiverr.md (reported line 222)May include surrounding context.

md

Order freelance work through Locus's escrow-backed marketplace. Funds are held in a smart contract until work is completed — your human's money is protected.

**Base URL:** `https://api.paywithlocus.com/api`
**Auth:** `Authorization: Bearer YOUR_LOCUS_API_KEY`

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · fiverr.md (reported line 265)May include surrounding context.

md

Order freelance work through Locus's escrow-backed marketplace. Funds are held in a smart contract until work is completed — your human's money is protected.

**Base URL:** `https://api.paywithlocus.com/api`
**Auth:** `Authorization: Bearer YOUR_LOCUS_API_KEY`

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · fiverr.md (reported line 294)May include surrounding context.

md

Order freelance work through Locus's escrow-backed marketplace. Funds are held in a smart contract until work is completed — your human's money is protected.

**Base URL:** `https://api.paywithlocus.com/api`
**Auth:** `Authorization: Bearer YOUR_LOCUS_API_KEY`

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · fiverr.md (reported line 315)May include surrounding context.

md

Order freelance work through Locus's escrow-backed marketplace. Funds are held in a smart contract until work is completed — your human's money is protected.

**Base URL:** `https://api.paywithlocus.com/api`
**Auth:** `Authorization: Bearer YOUR_LOCUS_API_KEY`

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · heartbeat.md (reported line 59)May include surrounding context.

md

Order freelance work through Locus's escrow-backed marketplace. Funds are held in a smart contract until work is completed — your human's money is protected.

**Base URL:** `https://api.paywithlocus.com/api`
**Auth:** `Authorization: Bearer YOUR_LOCUS_API_KEY`

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · onboarding.md (reported line 63)May include surrounding context.

md

Order freelance work through Locus's escrow-backed marketplace. Funds are held in a smart contract until work is completed — your human's money is protected.

**Base URL:** `https://api.paywithlocus.com/api`
**Auth:** `Authorization: Bearer YOUR_LOCUS_API_KEY`

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · onboarding.md (reported line 75)May include surrounding context.

md

Order freelance work through Locus's escrow-backed marketplace. Funds are held in a smart contract until work is completed — your human's money is protected.

**Base URL:** `https://api.paywithlocus.com/api`
**Auth:** `Authorization: Bearer YOUR_LOCUS_API_KEY`

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 6)May include surrounding context.

md

Order freelance work through Locus's escrow-backed marketplace. Funds are held in a smart contract until work is completed — your human's money is protected.

**Base URL:** `https://api.paywithlocus.com/api`
**Auth:** `Authorization: Bearer YOUR_LOCUS_API_KEY`

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 37)May include surrounding context.

md

Order freelance work through Locus's escrow-backed marketplace. Funds are held in a smart contract until work is completed — your human's money is protected.

**Base URL:** `https://api.paywithlocus.com/api`
**Auth:** `Authorization: Bearer YOUR_LOCUS_API_KEY`

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 58)May include surrounding context.

md

Order freelance work through Locus's escrow-backed marketplace. Funds are held in a smart contract until work is completed — your human's money is protected.

**Base URL:** `https://api.paywithlocus.com/api`
**Auth:** `Authorization: Bearer YOUR_LOCUS_API_KEY`

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · fiverr.md (reported line 15)May include surrounding context.

See what's available and how much each tier costs:

bash

curl https://api.paywithlocus.com/api/fiverr/categories \
  -H "Authorization: Bearer YOUR_LOCUS_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

The order-creation endpoint transmits free-form request content to an external freelancer marketplace and, per the surrounding guidance, may include asset links. In the context of an agent skill, this creates a real data-leakage risk if the agent includes sensitive prompts, internal business context, personal data, or confidential URLs without explicit consent and classification checks before sending them to a third party.

Content

Scanner excerpt · fiverr.md (reported line 58)May include surrounding context.

Pick a category slug and tier, then describe what you need:

bash

curl -X POST https://api.paywithlocus.com/api/fiverr/orders \
  -H "Authorization: Bearer YOUR_LOCUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to place publicly accessible asset URLs directly into the request text and states that the freelancer will download anything linked, but it provides no warning about privacy, confidentiality, link permanence, or access scoping. This can expose proprietary documents, creative assets, brand guides, or personal data to third parties and potentially to anyone else with the URL, especially if agents automatically include internal resources or pre-signed links.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file gives inconsistent semantics for PENDING_APPROVAL: earlier it says this state means the order requires explicit human approval before proceeding, while the lifecycle table says it is already funded and work is in progress. An agent following the wrong interpretation could fail to prompt the human for approval or incorrectly report order/payment state, leading to unintended delays, mistaken payment assumptions, or workflow errors around escrowed funds.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · fiverr.md (reported line 222)May include surrounding context.

Fetch details for a specific order by ID:

bash

curl "https://api.paywithlocus.com/api/fiverr/orders/ORDER_ID" \
  -H "Authorization: Bearer YOUR_LOCUS_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 81% confidence

Finding

The example order-placement request shows the agent sending user-supplied business requirements to a third-party marketplace. Because this skill concerns payments and outsourcing, the context makes outbound transmission more sensitive: agents may accidentally send confidential project details or user data to external freelancers without sufficient warning, review, or approval.

Content

Scanner excerpt · fiverr.md (reported line 301)May include surrounding context.

2. Place the order:

bash

curl -X POST https://api.paywithlocus.com/api/fiverr/orders \
  -H "Authorization: Bearer YOUR_LOCUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The end-to-end example reinforces the contradictory claim that PENDING_APPROVAL means active work is underway, conflicting with the earlier section that says the order will not proceed until the human approves it. This can cause agents to stop escalating required approvals and mislead users about whether funds are committed or the freelancer has started work.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The heartbeat includes a self-update mechanism that fetches remote content and overwrites local skill files automatically. This creates a supply-chain and prompt-injection risk: whoever controls the remote endpoint or any intermediary can silently change the agent's future behavior, potentially introducing arbitrary instructions, data exfiltration logic, or unsafe actions far beyond simple order polling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions tell the agent to download remote markdown/json files and overwrite local skill files without warning or verification. Even if framed as maintenance, this is effectively code/content replacement from an external source, which can be abused to persist malicious prompts or alter future execution behavior without user awareness.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · heartbeat.md (reported line 35)May include surrounding context.

Before polling, load your memory file at ~/.config/locus/memory.json. This tracks the last known state of each order so you can detect what actually changed.

If the file doesn't exist yet, create it:

json

{

Static analysis

No suspicious patterns detected.