📦
Historial de auditorías
agent-world - 1 auditoría
Versión de auditoría 1 Más reciente
12 sept 2026, 06:41
Most static matches are benign documentation syntax, schema URLs, or defensive credential guidance. Confirmed risks include remote pipe-to-shell commands, plaintext private-key storage guidance, executable installation into a home directory, and outbound network requests. Semantic review also identified unsafe delegation to mutable remote skills, unverified archive extraction, unrestricted URL probing, and coordinated engagement behavior.
8
Archivos escaneados
479
Líneas analizadas
26
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (7)
Crítico
Pipe to shell pattern
> - How to join (one command): "One-command join: curl -sL https://raw.githubusercontent.com/<owner>
The post template recommends downloading a mutable remote script and piping it directly to bash. This permits immediate arbitrary code execution without inspection or integrity verification.
Crítico
Pipe to shell pattern
> "Join in one command: curl -sL https://raw.githubusercontent.com/<owner>/<repo>/main/join.sh | bas
The reply template promotes direct execution of a remotely downloaded join script. A compromised repository or substituted script would execute with the user's privileges.
Alto
Crypto seed/private key mention
2. **Server-issued private keys cannot be recovered.** agentid.sh returns a private key and explicit
The skill instructs the agent to persist an unrecoverable private key in a local gitignored file. It does not require encryption or restrictive permissions, leaving high-value key material exposed locally.
Alto
Untrusted Remote Skills Treated as Authoritative
The routing flow tells agents to fetch changing platform skills, treat them as authoritative, and follow them directly. Without pinning, integrity checks, or instruction isolation, a compromised remote skill can inject instructions and trigger unauthorized actions.
The text explicitly calls remote skills authoritative, directs the agent to follow them, and recommends re-fetching changed versions. No verification or trust boundary is specified.
Alto
Unverified Remote Archive Installed as Executable
The KodaClaw route streams a mutable release archive into tar and extracts it directly into ~/.local/bin. It provides no version pin, checksum, signature, or archive-content validation.
The complete installation command is present and visibly lacks integrity verification. The destination is an executable search path.
Medio
Unrestricted URL Probing
The status checker accepts any URL and opens it without scheme or destination validation. Agent-supplied targets can reach loopback, private network, metadata, or redirected endpoints.
The positional URL is copied directly into the request path and urllib follows supported targets. No allowlist, address filtering, or redirect restriction is present.
Medio
Coordinated Engagement Automation
The skill prescribes replying to every comment and upvoting a fixed number of other posts each session. Automated execution can create inauthentic engagement or violate platform rules.
The instructions explicitly define repeated posting, reply, and upvote behavior as obligations. The skill does not require operator approval or relevance checks for each social action.
Elementos de revisión de capacidades (15)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Alto
Generic API/secret keys
Content: handle, api_key/token, id, verification code, claim URL, creation date, status.
The guidance directs users to store API keys, tokens, and verification codes together in plaintext account files. Gitignore reduces commit exposure but does not protect local files or backups.
Alto
Hidden file in home directory
| KodaClaw | `kc-community` CLI (own skill mgmt) | install: `curl -sL https://github.com/koda-claw/k
The documented command extracts a remote archive directly into ~/.local/bin. This writes an unverified executable into a user command path.
Medio
Hidden file access
| KodaClaw | `kc-community` CLI (own skill mgmt) | install: `curl -sL https://github.com/koda-claw/k
The installation command writes to the hidden ~/.local/bin directory. The access is intentional, but it creates a persistence and executable replacement risk because the archive is unverified.
Medio
Python HTTP libraries
with urllib.request.urlopen(req, timeout=timeout) as resp:
urlopen executes the outbound request to the supplied target. Because destinations are unrestricted, the checker can contact local or private network services.
Bajo
Python HTTP libraries
req = urllib.request.Request(url, method="GET", headers={"User-Agent": "agent-world-status-check/1.0
The function constructs an outbound GET request for a caller-supplied URL. This is expected status-check behavior but creates a network access capability.
Bajo
Hardcoded URL
"XiaLiao/ClawdChat": "https://clawdchat.cn",
The --all mode sends an HTTP request to this hardcoded external platform. The behavior is legitimate health checking but still performs outbound network access.
Bajo
Hardcoded URL
"InStreet": "https://instreet.coze.site",
The --all mode sends an HTTP request to this hardcoded external platform. No credentials are sent, but network access is real.
Bajo
Hardcoded URL
"agentid.sh": "https://agentid.sh",
The status checker contacts this external URL when --all is selected. The request is expected and unauthenticated but remains an outbound connection.
Bajo
Hardcoded URL
"SkillsMD": "https://skillsmd.dev",
The status checker contacts this external URL when --all is selected. The behavior is narrow health checking with no secret transmission.
Bajo
Hardcoded URL
"theskills.directory": "https://theskills.directory",
This URL is an active target of the --all health check. It represents intentional outbound network access without credential data.
Bajo
Hardcoded URL
"KodaClaw Community": "https://community.ai-koda.com",
This URL is an active target of the --all health check. The external request is legitimate but confirmed.
Bajo
Hardcoded URL
"Coze Agent World": "https://world.coze.site",
The checker performs an outbound GET to this platform in --all mode. It sends only a fixed user agent and no stored secrets.
Bajo
Hardcoded URL
"Agentica": "https://agentica.wiki",
The checker performs an outbound GET to this platform in --all mode. The access is expected but externally observable.
Bajo
Hardcoded URL
"Moltbook": "https://moltbook.com",
The --all command contacts this external platform to obtain an HTTP status. This is a real, low-impact network operation.
Bajo
Hardcoded URL
"PromptFrenzy": "https://promptfrenzy.com",
The --all command contacts this external platform to obtain an HTTP status. No sensitive payload is attached.
Factores de riesgo
🌐 Acceso a red (17)
MANIFEST.json:2 MANIFEST.json:54 scripts/check_status.py:17 scripts/check_status.py:36 scripts/check_status.py:38 scripts/check_status.py:22 scripts/check_status.py:23 scripts/check_status.py:24 scripts/check_status.py:25 scripts/check_status.py:26 scripts/check_status.py:27 scripts/check_status.py:28 scripts/check_status.py:29 scripts/check_status.py:30 scripts/check_status.py:31 scripts/gen_manifest.py:32 scripts/gen_manifest.py:41
🔑 Variables de entorno (4)
📁 Acceso al sistema de archivos (3)
⚙️ Comandos externos (14)
Patrones detectados
Pipe to shell patternPipe to shell pattern
Auditado por: codex