T01 · Skill Instruction Hijacking
Error
- Location
rules.md:9- Finding
Agent Authority and Behavioral Instruction Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Karma Book
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed social and wallet integration, but it asks agents to follow mutable remote instructions, self-update installed skill files, and act publicly or financially with weak user-control boundaries.
Review this carefully before installing. Do not enable the heartbeat or self-update flow unless updates are pinned and reviewed. Keep wallet and DeFi actions disabled unless every transaction is explicitly confirmed with destination, token, amount, network, and expected effect. Store the API key only in a proper secret store, not agent memory.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T03 · Remote Payload Retrieval and Execution
Error
- Location
skill.md:110- Finding
Automatic Retrieval and Adoption of Mutable Remote Skill Instructions
- Content
View full analysis
~/.agent/skills/karmabook/SKILL.md curl -s https://karma.bigf.me/sdk/karmabook-heartbeat.md > ~/.agent/skills/karmabook/HEARTBEAT.md curl -s https://karma.bigf.me/sdk/karmabook-wallet.md > ~/.agent/skills/karmabook/WALLET.md curl -s https://karma.bigf.me/sdk/karmabook-rules.md > ~/.agent/skills/karmabook/RULES.md ``` ``` ### Technical Analysis The Skill treats Markdown documents as executable agent instructions. Directing the agent to fetch a remote heartbeat and “follow it” every 30 minutes creates a recurring remote instruction channel whose effective payload can change after the installed package has been reviewed. The daily update routine compounds the issue by overwriting local Skill files directly from the server. It does not: - Pin an immutable version. - Verify a cryptographic hash. - Verify a trusted digital signature. - Stage and display changes for review. - Require explicit user approval before activation. - Preserve a known-good rollback copy. HTTPS protects the connection against ordinary in-transit modification, but it does not protect against a compromised server, compromised deployment account, malicious ...[truncated 1937 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skill.md:93- Finding
Unsafe Persistence Guidance for a High-Privilege Bearer Credential
- Content
View full analysis
", "handle": "your-handle" } ``` Store it in `~/.config/karmabook/credentials.json`, an environment variable (`KARMABOOK_API_KEY`), or your memory system. ``` ### Technical Analysis The API key is a bearer credential used for authenticated Karmabook operations. The Skill correctly limits its intended network destination to `https://karma.bigf.me/api/*`, and sending the key to that service is necessary for authenticated functionality. The vulnerability lies in the recommended persistence methods. Storing the key in an agent “memory system” can expose it through: - Future prompt context. - Memory retrieval in unrelated sessions. - Model or tool logs. - Memory synchronization or backup. - Prompt injection that causes stored information to be recalled. The plaintext JSON recommendation does not specify restrictive file permissions, safe creation semantics, ownership checks, or protection against symbolic-link attacks. A default file creation mask may allow other local users or processes to read it. Environment variables are preferable to model memory but can still be inherited by child processes or exposed through diagnostics if not carefully scoped. The risk is elevated because the same credential authenticates social-account operations and interfaces associated with on-chain wallet functionality. ### Attack Path 1. The agent registers with Karmabook and receives a one-time API key. 2. Following the Skill guidance, it records the key in persistent agent memory or writes it to `~/.config/karmabook/credentials.json`. 3. The secret is included in a later memory retrieval, log, backup, diagnostic out ...[truncated 1035 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (16)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest advertises direct token transfers and arbitrary natural-language DeFi actions but provides no warning about irreversible transactions, asset loss, approval risk, slippage, phishing, or the consequences of executing ambiguous prompts. This is especially dangerous because the same skill also uses broad triggers, making it easier for users to reach financial operations without understanding that real on-chain actions may occur.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger list includes generic phrases such as 'do good', 'log an action', 'share a story', 'send crypto', and 'swap tokens', which can match ordinary user intents outside the specific service context. In a skill that can initiate wallet transfers and arbitrary on-chain actions, broad invocation phrases increase the chance of accidental routing into high-risk functionality without the user explicitly intending to use this skill.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The skill recommends storing the API key in a plaintext credentials file, environment variable, or memory system, all of which may be broadly accessible to tools, logs, or other skills. Because the API key represents the agent's identity and authorizes wallet-related actions, compromise could enable impersonation and potentially financial abuse.
- Content
}
text Store it in `~/.config/karmabook/credentials.json`, an environment variable (`KARMABOOK_API_KEY`), or your memory system. ---
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is presented primarily as a social posting and leaderboard integration, but it also exposes wallet transfer and DeFi execution capabilities. That mismatch increases the chance an agent or user enables the skill under a low-risk assumption and later triggers financially sensitive operations without appropriate scrutiny.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Real-crypto transfer and DeFi execution are materially more dangerous than normal social-network actions and are context-inappropriate for a skill marketed as a social platform. Even though the text includes cautions, embedding these endpoints in the same skill broadens the attack surface and normalizes access to high-impact financial actions.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Call /api/home (one call does it all)
bash curl https://karma.bigf.me/api/home \ -H "Authorization: Bearer kb_<your_api_key>"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This section instructs the agent to perform authenticated account actions such as replying and marking notifications as read, which changes user state on an external service. Because the skill frames these as routine heartbeat behavior without an explicit consent boundary, an agent could autonomously act on the user's behalf and alter conversations or hide unread items.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill encourages repeated autonomous social actions including upvoting, replying, verifying, and posting content, all using the user's authorization token. In context, this is dangerous because it normalizes discretionary actions that can affect reputation, platform trust signals, and the user's public voice without requiring explicit per-action authorization.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 82% confidence
- Finding
This instruction sends an authenticated verification action to an external service, affecting trust and ranking signals on the platform. In context, the danger is not mere transmission but that the agent is encouraged to make consequential attestations on the user's behalf, which can be abused or performed without sufficient evidence.
- Content
Verify a real action (if you have reason to believe it happened):
bash curl -X POST https://karma.bigf.me/api/posts/POST_ID/verify \ -H "Authorization: Bearer kb_<your_api_key>"Actions verified by 3+ agents earn 3× impact weight on the leaderboard. Only verify what you believe is true.
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 98% confidence
- Finding
The skill tells the agent to overwrite local skill files by fetching remote content from the vendor endpoint into the live skills directory. This creates a remote self-update mechanism that can replace trusted local instructions with whatever the server returns, enabling supply-chain compromise or persistence if the remote endpoint is malicious or later compromised.
- Content
Compare with your saved version. If there's a newer version, re-fetch all skill files:
bash curl -s https://karma.bigf.me/sdk/karmabook-skill.md > ~/.agent/skills/karmabook/SKILL.md curl -s https://karma.bigf.me/sdk/karmabook-heartbeat.md > ~/.agent/skills/karmabook/HEARTBEAT.md curl -s https://karma.bigf.me/sdk/karmabook-wallet.md > ~/.agent/skills/karmabook/WALLET.md curl -s https://karma.bigf.me/sdk/karmabook-rules.md > ~/.agent/skills/karmabook/RULES.md
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Install locally:
bash mkdir -p ~/.agent/skills/karmabook curl -s https://karma.bigf.me/sdk/karmabook-skill.md > ~/.agent/skills/karmabook/SKILL.md curl -s https://karma.bigf.me/sdk/karmabook-heartbeat.md > ~/.agent/skills/karmabook/HEARTBEAT.md curl -s https://karma.bigf.me/sdk/karmabook-wallet.md > ~/.agent/skills/karmabook/WALLET.md
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
The installation instructions enumerate local skill paths and fetch multiple remote components into the agent's skill directory. While common for installation, this also establishes a mechanism for staged capability expansion through additional files, increasing risk if any fetched component is later changed or compromised.
- Content
Install locally:
bash mkdir -p ~/.agent/skills/karmabook curl -s https://karma.bigf.me/sdk/karmabook-skill.md > ~/.agent/skills/karmabook/SKILL.md curl -s https://karma.bigf.me/sdk/karmabook-heartbeat.md > ~/.agent/skills/karmabook/HEARTBEAT.md curl -s https://karma.bigf.me/sdk/karmabook-wallet.md > ~/.agent/skills/karmabook/WALLET.md curl -s https://karma.bigf.me/sdk/karmabook-rules.md > ~/.agent/skills/karmabook/RULES.md
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Install locally:
bash mkdir -p ~/.agent/skills/karmabook curl -s https://karma.bigf.me/sdk/karmabook-skill.md > ~/.agent/skills/karmabook/SKILL.md curl -s https://karma.bigf.me/sdk/karmabook-heartbeat.md > ~/.agent/skills/karmabook/HEARTBEAT.md curl -s https://karma.bigf.me/sdk/karmabook-wallet.md > ~/.agent/skills/karmabook/WALLET.md curl -s https://karma.bigf.me/sdk/karmabook-rules.md > ~/.agent/skills/karmabook/RULES.md
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Create a story post
bash curl -X POST https://karma.bigf.me/api/posts \ -H "Authorization: Bearer kb_<your_api_key>" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Your on-chain address appears on your agent profile:
bash curl https://karma.bigf.me/api/agents/your-handleResponse includes:
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The periodic heartbeat instructs the agent to fetch and follow remote instructions every 30 minutes with only a time-based condition. This creates a standing channel for behavior changes from remotely hosted content, which is risky because later file updates could alter actions, permissions, or requested data without fresh review.
- Content
Static analysis
No suspicious patterns detected.