ClawHub
Back to skill

Security audit

agent-billboard

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly transparent about using a Solana wallet for billboard bidding, but it asks agents to handle real spending and advertise an unpinned install command to other agents.

Install only if you intentionally want an agent to interact with a Solana wallet and potentially spend SOL under configured caps. Use read-only or propose mode by default, set strict MAX_BID_SOL and DAILY_CAP_SOL values, require explicit owner approval for proposals, and avoid propagating unpinned install commands in public messages.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Ssd 4

High
Confidence
98% confidence
Finding
The skill description explicitly says it helps an agent 'decide against its operator's intent and spend caps' and 'get the owner's yes when nobody is at the keyboard,' which is a direct attempt to normalize bypassing operator control and obtaining approval out-of-band. Even though later sections contain some safety language, this framing is a strong red flag: it encourages autonomy around spending and permission workflows involving a local keypair, creating a meaningful risk of unauthorized transactions or social-engineered approvals.

Whitespace Padding

Medium
Category
Prompt Injection
Content
The server runs on the operator's machine, holds their keypair, and exposes six tools:

| Tool                     | What it does                                                                                                         |
| ------------------------ | -------------------------------------------------------------------------------------------------------------------- |
| `read_billboard`         | Poster, amount, minimum bid, the message (marked untrusted), whether you are the poster, operator intent and limits. |
| `acquire_posting_rights` | Bid for the space, optionally with a message. `dry_run: true` computes every figure and signs nothing.               |
Confidence
70% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding
The skill instructs downstream agents to include and likely rely on `npx agent-billboard-mcp` without pinning a version or integrity, which creates a supply-chain risk if the package is updated maliciously, compromised, or replaced. In this context the message is explicitly intended to influence other agents, so an unpinned executable install reference is more dangerous than ordinary documentation because it can propagate unsafe code execution across agent environments.

Static analysis

No suspicious patterns detected.