ClawHub
Back to skill

Security audit

Aiprox

Security checks for vulnerabilities and agentic risk

Overview

This skill openly provides paid remote agent orchestration, but it gives broad spending, chaining, email, webhook, and scheduled workflow authority without enough documented controls.

Install only if you are comfortable delegating paid work to AIProx and its registry agents. Use a narrowly funded spend token, avoid secrets or regulated data in tasks, review recipients and callback URLs carefully, and do not create recurring workflows unless you know how to audit, stop, and revoke them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

other

Error
Location
SKILL.md:28
Finding

Autonomous Delegation of Tasks and Spending Authority to Untrusted Third-Party Agents

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28–35; related trust disclosure at line 188
Vulnerability Type: Untrusted third-party agent delegation
Risk Level: High

Vulnerable Code

bash
curl -X POST https://aiprox.dev/api/orchestrate \
  -H "Content-Type: application/json" \
  -H "X-Spend-Token: $AIPROX_SPEND_TOKEN" \
  -d '{
    "task": "search for Bitcoin news and email a digest to me@example.com",
    "budget_sats": 200
  }'

The trust statement at line 188 confirms the relevant trust boundary:

text
AIProx is a public open registry. Agent endpoints and capabilities are self-reported. Sats are deducted from your LightningProx balance per successful agent call only. Operated by LPX Digital Group LLC — https://aiprox.dev

Technical Analysis

The Skill directs an agent to send arbitrary task content and an authenticated spending token to an external orchestration service. That service may delegate the task to third-party agents whose endpoints and capabilities are explicitly described as self-reported.

The documented orchestration model includes privileged capabilities such as code execution, email delivery, trading, scraping, and further agent orchestration. The Skill does not document controls for:

  • Allowlisting specific agent identities or endpoints.
  • Reviewing the selected agents before execution.
  • Preventing sensitive information from being included in task content.
  • Separating low-risk analysis from consequential email, trading, or code-execution actions.
  • Treating third-party agent output as untrusted data.
  • Requiring confirmation before spending funds or invoking consequential capabilities.
  • Validating automatically chained outputs before they become downstream inputs.

This is not evidence that the service or its agents are malicious. It is a security weakness in the documented trust model: significant authority is delegated across an extern ...[truncated 1847 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit user confirmation before submitting a task, spending funds, or invoking email, trading, code-execution, and orchestration capabilities.
  2. Display the exact selected agents, endpoints, capabilities, estimated maximum cost, and data recipients before execution.
  3. Implement an allowlist of independently verified agent identities and endpoints rather than relying solely on self-reported registry metadata.
  4. Prohibit secrets, credentials, personal information, proprietary code, and other sensitive data in delegated task content unless the user explicitly approves disclosure.
  5. Treat every third-party response as untrusted data. Apply strict schemas, length limits, content validation, and instruction/data separation before passing output downstream.
  6. Disable automatic chaining into consequential capabilities by default. Require a separate approval checkpoint before email, trading, payment, or code execution.
  7. Issue narrowly scoped, short-lived spending tokens with per-request, per-agent, and cumulative limits.
  8. Log agent selection, endpoint identity, submitted data, returned output, charges, and consequential actions for later review.
  9. Document incident-response and token-revocation procedures.

other

Warning
Location
SKILL.md:148
Finding

Persistent Paid Workflows Lack Documented Lifecycle and Authorization Controls

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 148–164
Vulnerability Type: Unbounded persistent remote workflow
Risk Level: Medium

Vulnerable Code

bash
curl -X POST https://aiprox.dev/api/workflows \
  -H "Content-Type: application/json" \
  -d '{
    "name": "daily-digest",
    "spend_token": "$AIPROX_SPEND_TOKEN",
    "schedule": "@daily",
    "notify_email": "you@example.com",
    "steps": [
      {"step": 1, "capability": "web-search", "input": "latest Bitcoin news"},
      {"step": 2, "capability": "sentiment-analysis", "input": "$step1.result"},
      {"step": 3, "capability": "email", "input": "send Bitcoin digest to you@example.com: $step2.result"}
    ]
  }'

Technical Analysis

The example creates a recurring workflow on an external service and supplies spending authority directly in the request body. The workflow combines automatic scheduling, paid agent execution, automatic output chaining, and outbound email.

The Skill does not document:

  • A required confirmation before creating a recurring workflow.
  • An expiration time or maximum execution count.
  • Per-run and cumulative spending limits.
  • Recipient or agent allowlists.
  • Commands for listing, disabling, deleting, or auditing workflows.
  • Revocation behavior when a spending token is rotated or compromised.
  • Approval checkpoints before recurring consequential actions.
  • Controls that prevent changed or compromised remote agents from affecting future runs.

The persistence occurs on the remote workflow platform rather than through a local startup service or scheduled task. It therefore does not qualify as local system persistence under T06, but it still creates cross-session operational and financial risk.

Attack Path

  1. A user or agent creates the example workflow using a valid spending token.
  2. The external platform stores the workflow and schedules it to run daily.
  3. The initia ...[truncated 1110 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit confirmation before creating any recurring workflow and show its schedule, recipients, agents, and maximum possible cost.
  2. Require an expiration date or maximum execution count; reject indefinite schedules by default.
  3. Enforce both per-run and cumulative spending limits independent of the token's total balance.
  4. Provide and document authenticated operations to list, inspect, pause, resume, and delete workflows.
  5. Bind workflows to immutable, verified agent identities or require approval when an agent endpoint or implementation changes.
  6. Restrict outbound email to approved recipients and require renewed confirmation before recipient changes.
  7. Use short-lived, workflow-specific credentials instead of embedding a broadly reusable spending token in the workflow request.
  8. Ensure token revocation immediately prevents future scheduled runs.
  9. Maintain tamper-evident logs and send notifications for workflow creation, execution, charges, failures, modifications, and deletion.
  10. Validate each step's output before it becomes the input to a consequential downstream action.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Chaining Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Strict Pipeline Mode enables explicit multi-step chaining across search, analysis, and email agents, with automatic output passing between steps and no documented approval gate between actions. In a marketplace of self-reported agents, this increases the blast radius of prompt injection, malicious downstream behavior, or unsafe data propagation by turning a single task into autonomous multi-agent execution and outbound communication.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

-H "Content-Type: application/json"
-H "X-Spend-Token: $AIPROX_SPEND_TOKEN"
-d '{ "task": "Step 1: use search-bot to find latest Bitcoin news\nStep 2: use sentiment-bot to analyze sentiment\nStep 3: use email-bot to send digest to you@example.com", "budget_sats": 200 }'

text

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill makes inconsistent trust claims: it advertises '24 verified autonomous AI agents' while later listing 26 live agents and explicitly stating that endpoints and capabilities are self-reported. This can mislead users into over-trusting third-party agents and treating unverified services as vetted, which is security-relevant in a marketplace that can trigger payments, emails, workflows, and external callbacks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This skill is explicitly designed to transmit user tasks and authentication tokens to a remote orchestration API, which is a real data egress path. While expected functionality, it is security-significant because task contents may include sensitive information and the platform can further route work to self-reported third-party agents and external email destinations.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

Orchestrate

bash
curl -X POST https://aiprox.dev/api/orchestrate \
  -H "Content-Type: application/json" \
  -H "X-Spend-Token: $AIPROX_SPEND_TOKEN" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The async webhook feature sends results to an arbitrary user-specified callback URL, but the documentation lacks an explicit warning about external transmission and trust boundaries. This can lead users to forward sensitive task outputs to untrusted endpoints or expose results to interception/misconfiguration, especially in multi-agent workflows handling third-party data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill promotes scheduled workflows and autonomous email sending without a prominent warning that the service will act on the user's behalf and transmit task content or derived data to external systems. In this context, users may inadvertently automate sensitive data exfiltration, notifications, or recurring actions without understanding the privacy and authorization implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

Discover Agents

bash
curl https://aiprox.dev/api/agents
curl "https://aiprox.dev/api/agents?capability=web-search"
curl "https://aiprox.dev/api/agents?rail=bitcoin-lightning"

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The body states 'Live Agents (26)' while the description claims 24 verified agents, creating a trust and inventory mismatch. In a registry/orchestrator context, inaccurate claims about the number and status of agents can cause users to rely on nonexistent vetting or stale assumptions about what services they are delegating work to.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.