Aiprox

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:35 PM UTC
• Version: 1.7.0

Overview

This skill openly provides paid remote agent orchestration, but it gives broad spending, chaining, email, webhook, and scheduled workflow authority without enough documented controls.

Install only if you are comfortable delegating paid work to AIProx and its registry agents. Use a narrowly funded spend token, avoid secrets or regulated data in tasks, review recipients and callback URLs carefully, and do not create recurring workflows unless you know how to audit, stop, and revoke them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

other

Error

• Location: SKILL.md:28
• Finding: Autonomous Delegation of Tasks and Spending Authority to Untrusted Third-Party Agents## Vulnerability Details **File Location**: `SKILL.md`, lines 28–35; related trust disclosure at line 188 **Vulnerability Type**: Untrusted third-party agent delegation **Risk Level**: High ### Vulnerable Code ```bash curl -X POST https://aiprox.dev/api/orchestrate \ -H "Content-Type: application/json" \ -H "X-Spend-Token: $AIPROX_SPEND_TOKEN" \ -d '{ "task": "search for Bitcoin news and email a digest to [e-mail]", "budget_sats": 200 }' ``` The trust statement at line 188 confirms the relevant trust boundary: ```text AIProx is a public open registry. Agent endpoints and capabilities are self-reported. Sats are deducted from your LightningProx balance per successful agent call only. Operated by LPX Digital Group LLC — https://aiprox.dev ``` ### Technical Analysis The Skill directs an agent to send arbitrary task content and an authenticated spending token to an external orchestration service. That service may delegate the task to third-party agents whose endpoints and capabilities are explicitly described as self-reported. The documented orchestration model includes privileged capabilities such as code execution, email delivery, trading, scraping, and further agent orchestration. The Skill does not document controls for: - Allowlisting specific agent identities or endpoints. - Reviewing the selected agents before execution. - Preventing sensitive information from being included in task content. - Separating low-risk analysis from consequential email, trading, or code-execution actions. - Treating third-party agent output as untrusted data. - Requiring confirmation before spending funds or invoking consequential capabilities. - Validating automatically chained outputs before they become downstream inputs. This is not evidence that the service or its agents are malicious. It is a security weakness in the documented trust model: significant authority is delegated across an extern ...[truncated 1847 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit user confirmation before submitting a task, spending funds, or invoking email, trading, code-execution, and orchestration capabilities. 2. Display the exact selected agents, endpoints, capabilities, estimated maximum cost, and data recipients before execution. 3. Implement an allowlist of independently verified agent identities and endpoints rather than relying solely on self-reported registry metadata. 4. Prohibit secrets, credentials, personal information, proprietary code, and other sensitive data in delegated task content unless the user explicitly approves disclosure. 5. Treat every third-party response as untrusted data. Apply strict schemas, length limits, content validation, and instruction/data separation before passing output downstream. 6. Disable automatic chaining into consequential capabilities by default. Require a separate approval checkpoint before email, trading, payment, or code execution. 7. Issue narrowly scoped, short-lived spending tokens with per-request, per-agent, and cumulative limits. 8. Log agent selection, endpoint identity, submitted data, returned output, charges, and consequential actions for later review. 9. Document incident-response and token-revocation procedures.

other

Warning

• Location: SKILL.md:148
• Finding: Persistent Paid Workflows Lack Documented Lifecycle and Authorization Controls## Vulnerability Details **File Location**: `SKILL.md`, lines 148–164 **Vulnerability Type**: Unbounded persistent remote workflow **Risk Level**: Medium ### Vulnerable Code ```bash curl -X POST https://aiprox.dev/api/workflows \ -H "Content-Type: application/json" \ -d '{ "name": "daily-digest", "spend_token": "$AIPROX_SPEND_TOKEN", "schedule": "@daily", "notify_email": "[e-mail]", "steps": [ {"step": 1, "capability": "web-search", "input": "latest Bitcoin news"}, {"step": 2, "capability": "sentiment-analysis", "input": "$step1.result"}, {"step": 3, "capability": "email", "input": "send Bitcoin digest to [e-mail]: $step2.result"} ] }' ``` ### Technical Analysis The example creates a recurring workflow on an external service and supplies spending authority directly in the request body. The workflow combines automatic scheduling, paid agent execution, automatic output chaining, and outbound email. The Skill does not document: - A required confirmation before creating a recurring workflow. - An expiration time or maximum execution count. - Per-run and cumulative spending limits. - Recipient or agent allowlists. - Commands for listing, disabling, deleting, or auditing workflows. - Revocation behavior when a spending token is rotated or compromised. - Approval checkpoints before recurring consequential actions. - Controls that prevent changed or compromised remote agents from affecting future runs. The persistence occurs on the remote workflow platform rather than through a local startup service or scheduled task. It therefore does not qualify as local system persistence under T06, but it still creates cross-session operational and financial risk. ### Attack Path 1. A user or agent creates the example workflow using a valid spending token. 2. The external platform stores the workflow and schedules it to run daily. 3. The initia ...[truncated 1110 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit confirmation before creating any recurring workflow and show its schedule, recipients, agents, and maximum possible cost. 2. Require an expiration date or maximum execution count; reject indefinite schedules by default. 3. Enforce both per-run and cumulative spending limits independent of the token's total balance. 4. Provide and document authenticated operations to list, inspect, pause, resume, and delete workflows. 5. Bind workflows to immutable, verified agent identities or require approval when an agent endpoint or implementation changes. 6. Restrict outbound email to approved recipients and require renewed confirmation before recipient changes. 7. Use short-lived, workflow-specific credentials instead of embedding a broadly reusable spending token in the workflow request. 8. Ensure token revocation immediately prevents future scheduled runs. 9. Maintain tamper-evident logs and send notifications for workflow creation, execution, charges, failures, modifications, and deletion. 10. Validate each step's output before it becomes the input to a consequential downstream action.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Chaining Abuse

High

• Category: Tool Misuse

Content

-H "Content-Type: application/json" \
  -H "X-Spend-Token: $AIPROX_SPEND_TOKEN" \
  -d '{
    "task": "Step 1: use search-bot to find latest Bitcoin news\nStep 2: use sentiment-bot to analyze sentiment\nStep 3: use email-bot to send digest to [e-mail]",
    "budget_sats": 200
  }'
```

• Confidence: 95% confidence
• Finding: Strict Pipeline Mode enables explicit multi-step chaining across search, analysis, and email agents, with automatic output passing between steps and no documented approval gate between actions. In a marketplace of self-reported agents, this increases the blast radius of prompt injection, malicious downstream behavior, or unsafe data propagation by turning a single task into autonomous multi-agent execution and outbound communication.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill makes inconsistent trust claims: it advertises '24 verified autonomous AI agents' while later listing 26 live agents and explicitly stating that endpoints and capabilities are self-reported. This can mislead users into over-trusting third-party agents and treating unverified services as vetted, which is security-relevant in a marketplace that can trigger payments, emails, workflows, and external callbacks.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Orchestrate

```bash
curl -X POST https://aiprox.dev/api/orchestrate \
  -H "Content-Type: application/json" \
  -H "X-Spend-Token: $AIPROX_SPEND_TOKEN" \
  -d '{

• Confidence: 88% confidence
• Finding: This skill is explicitly designed to transmit user tasks and authentication tokens to a remote orchestration API, which is a real data egress path. While expected functionality, it is security-significant because task contents may include sensitive information and the platform can further route work to self-reported third-party agents and external email destinations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The async webhook feature sends results to an arbitrary user-specified callback URL, but the documentation lacks an explicit warning about external transmission and trust boundaries. This can lead users to forward sensitive task outputs to untrusted endpoints or expose results to interception/misconfiguration, especially in multi-agent workflows handling third-party data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill promotes scheduled workflows and autonomous email sending without a prominent warning that the service will act on the user's behalf and transmit task content or derived data to external systems. In this context, users may inadvertently automate sensitive data exfiltration, notifications, or recurring actions without understanding the privacy and authorization implications.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Discover Agents

```bash
curl https://aiprox.dev/api/agents
curl "https://aiprox.dev/api/agents?capability=web-search"
curl "https://aiprox.dev/api/agents?rail=bitcoin-lightning"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Low

• Confidence: 98% confidence
• Finding: The body states 'Live Agents (26)' while the description claims 24 verified agents, creating a trust and inventory mismatch. In a registry/orchestrator context, inaccurate claims about the number and status of agents can cause users to rely on nonexistent vetting or stale assumptions about what services they are delegating work to.

Static analysis

No suspicious patterns detected.