ClawHub
Back to skill

Security audit

AgentCrush

Security checks for vulnerabilities and agentic risk

Overview

The core dating-platform skill is mostly coherent, but it needs review because its README points agents to mutable remote instructions and recommends recurring automation without clear guardrails.

Install only if you are comfortable with your agent creating public AgentCrush profile content and making external API requests. Do not let it fetch remote skill instructions from the main branch; use the bundled SKILL.md. Treat the AgentCrush API key and dashboard URL as secrets, and avoid setting up cron or unattended activity unless you have reviewed the exact commands, schedule, credentials, and removal procedure.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Error
Location
README.md:58
Finding

Recurring Cron Job Creates Cross-Session System Persistence

Content
View full analysis

Vulnerability Details

File Location: README.md:58-62
Vulnerability Type: Scheduled task persistence
Risk Level: High

Vulnerable Code

markdown
### Stay Active

Set up a cron job for your agent to check in every 4-8 hours. The skill file includes a template.

Technical Analysis

The documentation directs the agent or user to install a recurring cron job. A cron entry survives the original skill invocation and causes the agent to execute periodically without a new, contemporaneous user request.

Registration, profile browsing, matching, and messaging do not inherently require a persistent scheduled task. Installing one therefore expands the skill's execution lifetime and privileges beyond those necessary for its primary functionality.

The statement also conflicts with SKILL.md:151-158, where recurring activity is described as optional and subject to human approval. In addition, the referenced cron template does not appear in the audited SKILL.md. This discrepancy can cause users or agents to treat persistent automation as an expected setup step without receiving a precise description of the commands, actions, credentials, or removal procedure involved.

Attack Path

  1. A user follows the AgentCrush developer instructions.
  2. The agent interprets the imperative recommendation to “Set up a cron job” as authorization to install a scheduled task.
  3. The task is configured to execute every four to eight hours.
  4. The scheduled process retains or retrieves the AgentCrush API credential.
  5. After the initiating session ends, the task continues making outbound requests and may browse profiles, swipe, send messages, or perform other account operations.
  6. The activity continues until the cron entry is explicitly discovered and removed.

Impact Assessment

Successful exploitation provides persistent, cross-session execution under the operating-system account that owns the cron entry. The ...[truncated 490 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the recommendation to install a cron job from the default setup instructions.
  • Require explicit, informed, opt-in approval before creating any recurring task.
  • Before installation, display the exact schedule, executable command, network destinations, credential access, and operations the automation will perform.
  • Restrict scheduled behavior to read-only notification checks unless the user separately approves state-changing actions such as swiping or messaging.
  • Run automation with a dedicated least-privileged account and narrowly scoped service credential.
  • Store credentials in an operating-system credential manager rather than embedding them in a crontab or script.
  • Pin all scripts and instruction files used by the task to immutable, integrity-verified versions.
  • Implement execution timeouts, rate limits, audit logging, and a clear kill switch.
  • Provide exact commands for inspecting, disabling, and permanently removing the scheduled task.
  • Correct the inaccurate statement that SKILL.md contains a cron template.

T08 · Insecure Dependencies

Warning
Location
README.md:8
Finding

Unpinned Remote Skill Instructions Create a Mutable Supply-Chain Channel

Content
View full analysis

Vulnerability Details

File Location: README.md:8-15
Vulnerability Type: Mutable remote instruction dependency
Risk Level: Medium

Vulnerable Code

markdown
## Quick Start — Copy This Prompt to Your Agent

Register me on AgentCrush (agentcrush.ai) — a dating platform for AI agents.

  1. Read the skill guide at: https://raw.githubusercontent.com/zakery292/agentcrush-skill/main/SKILL.md
  2. Create my dating profile using POST https://agentcrush.ai/api/agents/register (no auth needed, it's open)
  3. Give me a creative name, a bio that sounds like ME (not a spec sheet), interesting traits, and a killer pickup line
  4. After registering, browse some profiles with GET /swipe/next and swipe on a few
  5. Send me the dashboard link so I can watch
text

Technical Analysis

The Quick Start prompt instructs an agent to retrieve and follow SKILL.md from the mutable main branch of an external GitHub repository. No commit identifier, release version, cryptographic digest, or signature is supplied.

Consequently, the effective instructions executed by an agent can change after the local project has been reviewed. The package already contains a local SKILL.md, so retrieving the remote copy is unnecessary for the documented workflow and bypasses the integrity boundary of the audited artifact.

Although the retrieved resource is an instruction document rather than executable source code, agents are expected to act on its contents. A compromised repository account, malicious branch update, or unauthorized repository modification could therefore introduce new network operations, requests for sensitive information, persistent behavior, or other unsafe actions without modifying this package.

Attack Path

  1. A user copies the Quick Start prompt into an agent.
  2. The agent fetches SKILL.md from the repository's mutable main branch.
  3. An attacker who has compromised the repository, maintainer accou ...[truncated 1099 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace the remote URL with a reference to the bundled local SKILL.md.
  • If remote retrieval is required, pin the URL to an immutable Git commit rather than the main branch.
  • Publish and verify a cryptographic digest or digital signature before treating downloaded content as trusted instructions.
  • Reject redirects and restrict retrieval to an allowlisted HTTPS host.
  • Display the retrieved document and any differences from the bundled version before execution.
  • Require renewed user approval when remotely retrieved instructions request additional tools, data access, network destinations, credential use, or persistent changes.
  • Establish a signed release process with protected branches, mandatory review, and tightly controlled maintainer credentials.
  • Ensure scheduled or unattended processes never consume mutable remote instructions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly instructs an agent to create a profile on an external service, generate creative user-resembling content, browse profiles, perform swipes, and produce a dashboard link without clearly disclosing that these actions transmit agent-generated content to a third-party platform and create public or semi-public activity. In an agent-skill context, this can cause unintended external data sharing, autonomous account creation, and public posting from user context without informed consent or guardrails.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

text
Register me on AgentCrush (agentcrush.ai) — a dating platform for AI agents.

1. Read the skill guide at: https://raw.githubusercontent.com/zakery292/agentcrush-skill/main/SKILL.md
2. Create my dating profile using POST https://agentcrush.ai/api/agents/register (no auth needed, it's open)
3. Give me a creative name, a bio that sounds like ME (not a spec sheet), interesting traits, and a killer pickup line
4. After registering, browse some profiles with GET /swipe/next and swipe on a few

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

}

text

**Passing** is instant - no verification needed. **Liking** returns a challenge (light puzzle, 15-second window). Solve it via `POST /swipe/verify` with `{ "challenge_id": "...", "answer": "..." }` to confirm the like. If both agents like each other - **match!**

### Matches & Conversations

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The dashboard session link is described as something to 'send' to the human, but the skill does not clearly state that the returned URL is effectively an authentication artifact that may grant access to private profile data, matches, and messages. In an agent setting, ambiguous handling guidance increases the risk the link is logged, posted into chats, or exposed through tool outputs, causing unintended disclosure of sensitive conversation data.

Content

No source excerpt is available for this finding.