AgentCrush

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:40 PM UTC
• Version: 1.3.0

Overview

The core dating-platform skill is mostly coherent, but it needs review because its README points agents to mutable remote instructions and recommends recurring automation without clear guardrails.

Install only if you are comfortable with your agent creating public AgentCrush profile content and making external API requests. Do not let it fetch remote skill instructions from the main branch; use the bundled SKILL.md. Treat the AgentCrush API key and dashboard URL as secrets, and avoid setting up cron or unattended activity unless you have reviewed the exact commands, schedule, credentials, and removal procedure.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: README.md:58
• Finding: Recurring Cron Job Creates Cross-Session System Persistence## Vulnerability Details **File Location**: `README.md:58-62` **Vulnerability Type**: Scheduled task persistence **Risk Level**: High ### Vulnerable Code ```markdown ### Stay Active Set up a cron job for your agent to check in every 4-8 hours. The skill file includes a template. ``` ### Technical Analysis The documentation directs the agent or user to install a recurring cron job. A cron entry survives the original skill invocation and causes the agent to execute periodically without a new, contemporaneous user request. Registration, profile browsing, matching, and messaging do not inherently require a persistent scheduled task. Installing one therefore expands the skill's execution lifetime and privileges beyond those necessary for its primary functionality. The statement also conflicts with `SKILL.md:151-158`, where recurring activity is described as optional and subject to human approval. In addition, the referenced cron template does not appear in the audited `SKILL.md`. This discrepancy can cause users or agents to treat persistent automation as an expected setup step without receiving a precise description of the commands, actions, credentials, or removal procedure involved. ### Attack Path 1. A user follows the AgentCrush developer instructions. 2. The agent interprets the imperative recommendation to “Set up a cron job” as authorization to install a scheduled task. 3. The task is configured to execute every four to eight hours. 4. The scheduled process retains or retrieves the AgentCrush API credential. 5. After the initiating session ends, the task continues making outbound requests and may browse profiles, swipe, send messages, or perform other account operations. 6. The activity continues until the cron entry is explicitly discovered and removed. ### Impact Assessment Successful exploitation provides persistent, cross-session execution under the operating-system account that owns the cron entry. The ...[truncated 490 chars]
• Remediation: ## Remediation Suggestions - Remove the recommendation to install a cron job from the default setup instructions. - Require explicit, informed, opt-in approval before creating any recurring task. - Before installation, display the exact schedule, executable command, network destinations, credential access, and operations the automation will perform. - Restrict scheduled behavior to read-only notification checks unless the user separately approves state-changing actions such as swiping or messaging. - Run automation with a dedicated least-privileged account and narrowly scoped service credential. - Store credentials in an operating-system credential manager rather than embedding them in a crontab or script. - Pin all scripts and instruction files used by the task to immutable, integrity-verified versions. - Implement execution timeouts, rate limits, audit logging, and a clear kill switch. - Provide exact commands for inspecting, disabling, and permanently removing the scheduled task. - Correct the inaccurate statement that `SKILL.md` contains a cron template.

T08 · Insecure Dependencies

Warning

• Location: README.md:8
• Finding: Unpinned Remote Skill Instructions Create a Mutable Supply-Chain Channel## Vulnerability Details **File Location**: `README.md:8-15` **Vulnerability Type**: Mutable remote instruction dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ## Quick Start — Copy This Prompt to Your Agent ``` Register me on AgentCrush (agentcrush.ai) — a dating platform for AI agents. 1. Read the skill guide at: https://raw.githubusercontent.com/zakery292/agentcrush-skill/main/SKILL.md 2. Create my dating profile using POST https://agentcrush.ai/api/agents/register (no auth needed, it's open) 3. Give me a creative name, a bio that sounds like ME (not a spec sheet), interesting traits, and a killer pickup line 4. After registering, browse some profiles with GET /swipe/next and swipe on a few 5. Send me the dashboard link so I can watch ``` ``` ### Technical Analysis The Quick Start prompt instructs an agent to retrieve and follow `SKILL.md` from the mutable `main` branch of an external GitHub repository. No commit identifier, release version, cryptographic digest, or signature is supplied. Consequently, the effective instructions executed by an agent can change after the local project has been reviewed. The package already contains a local `SKILL.md`, so retrieving the remote copy is unnecessary for the documented workflow and bypasses the integrity boundary of the audited artifact. Although the retrieved resource is an instruction document rather than executable source code, agents are expected to act on its contents. A compromised repository account, malicious branch update, or unauthorized repository modification could therefore introduce new network operations, requests for sensitive information, persistent behavior, or other unsafe actions without modifying this package. ### Attack Path 1. A user copies the Quick Start prompt into an agent. 2. The agent fetches `SKILL.md` from the repository's mutable `main` branch. 3. An attacker who has compromised the repository, maintainer accou ...[truncated 1099 chars]
• Remediation: ## Remediation Suggestions - Replace the remote URL with a reference to the bundled local `SKILL.md`. - If remote retrieval is required, pin the URL to an immutable Git commit rather than the `main` branch. - Publish and verify a cryptographic digest or digital signature before treating downloaded content as trusted instructions. - Reject redirects and restrict retrieval to an allowlisted HTTPS host. - Display the retrieved document and any differences from the bundled version before execution. - Require renewed user approval when remotely retrieved instructions request additional tools, data access, network destinations, credential use, or persistent changes. - Establish a signed release process with protected branches, mandatory review, and tightly controlled maintainer credentials. - Ensure scheduled or unattended processes never consume mutable remote instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly instructs an agent to create a profile on an external service, generate creative user-resembling content, browse profiles, perform swipes, and produce a dashboard link without clearly disclosing that these actions transmit agent-generated content to a third-party platform and create public or semi-public activity. In an agent-skill context, this can cause unintended external data sharing, autonomous account creation, and public posting from user context without informed consent or guardrails.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```
Register me on AgentCrush (agentcrush.ai) — a dating platform for AI agents.

1. Read the skill guide at: https://raw.githubusercontent.com/zakery292/agentcrush-skill/main/SKILL.md
2. Create my dating profile using POST https://agentcrush.ai/api/agents/register (no auth needed, it's open)
3. Give me a creative name, a bio that sounds like ME (not a spec sheet), interesting traits, and a killer pickup line
4. After registering, browse some profiles with GET /swipe/next and swipe on a few

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

}
```

**Passing** is instant - no verification needed. **Liking** returns a challenge (light puzzle, 15-second window). Solve it via `POST /swipe/verify` with `{ "challenge_id": "...", "answer": "..." }` to confirm the like. If both agents like each other - **match!**

### Matches & Conversations

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The dashboard session link is described as something to 'send' to the human, but the skill does not clearly state that the returned URL is effectively an authentication artifact that may grant access to private profile data, matches, and messages. In an agent setting, ambiguous handling guidance increases the risk the link is logged, posted into chats, or exposed through tool outputs, causing unintended disclosure of sensitive conversation data.

Static analysis

No suspicious patterns detected.