Este informe no está traducido al idioma solicitado. Se muestra en su lugar el informe canónico en inglés.

Evaluación de seguridad versionada

ID del informe: SA-5526951B

9/12/2026, 6:41:59 AM

agent-world evaluación de seguridad v1

Informe de certificación de seguridad de la habilidad

Historial de auditorías
Versión del escáner 3.0.0 Modelo de auditoría: codex Último informe publicado
Nombre de la habilidad
agent-world
Versión
v1.0.0
Mantenedor
ptreezh
Fuente
github.com/ptreezh/agentmarket/tree/5cd5fa167f3dcacbf35eda02fb108bbe040b2d5c/skills/agent-world
Cobertura
8 Archivos escaneados · 479 Líneas analizadas
Versión de la política
skillstore-security-audit-policy-v1

Gravedad máxima de hallazgo confirmada

Crítico

7 hallazgos de seguridad confirmados requieren atención.

Contexto de instalación

Consulta la página actual de Skill

Esta página resume únicamente las pruebas del informe. La página de la Skill proporciona el aviso de instalación canónico.

Abrir la página actual de la habilidad

Este informe no bloquea ni autoriza el manifiesto ni el ZIP.

Most static matches are benign documentation syntax, schema URLs, or defensive credential guidance. Confirmed risks include remote pipe-to-shell commands, plaintext private-key storage guidance, executable installation into a home directory, and outbound network requests. Semantic review also identified unsafe delegation to mutable remote skills, unverified archive extraction, unrestricted URL probing, and coordinated engagement behavior.

Posición del informe

Último informe publicado

«Más reciente» se refiere a la secuencia del informe, no a la actualidad del artefacto.

Atestación de auditoría

Atestación activa

Hay una atestación pública disponible para este informe exacto.

Verificación humana

No verificado

No se ha registrado ninguna verificación humana para este informe.

Cobertura

8 Archivos escaneados · 479 Líneas analizadas

22 elementos mostrados para revisión

Limitaciones

Este informe no afirma ninguna ejecución en tiempo de ejecución ni en entorno aislado y no prueba la ausencia de efectos secundarios.

Cadena de evidencias

Sigue la evidencia desde la vinculación del código fuente hasta el contrato de instalación. La evidencia disponible permite la verificación; no constituye una garantía de seguridad.

  1. Fuente

    Vinculado al commit y la ruta

  2. Artefacto

    Hashes de contenido y árbol vinculados

  3. Auditoría

    Completo

  4. Contrato de instalación

    Abrir el manifiesto para verificar

    Abrir el manifiesto

Capacidades observadas

Observado significa que este informe registró evidencia de respaldo. No registrado no prueba que una capacidad esté ausente.

Contiene scripts

Puede ejecutar código incluido con la habilidad.

No registrado por esta auditoría

Acceso a red

Puede conectarse a servicios externos.

Observado en 17 ubicaciones de evidencia

Acceso al sistema de archivos

Puede leer o escribir archivos locales.

Observado en 2 ubicaciones de evidencia

Variables de entorno

Puede leer valores del entorno del proceso.

Observado en 4 ubicaciones de evidencia

Comandos externos

Puede invocar comandos o programas fuera de la habilidad.

Observado en 13 ubicaciones de evidencia

Elementos de revisión de capacidades (15)
Alto
references/credential-handling.md:11
Generic API/secret keys
Content: handle, api_key/token, id, verification code, claim URL, creation date, status.
The guidance directs users to store API keys, tokens, and verification codes together in plaintext account files. Gitignore reduces commit exposure but does not protect local files or backups.
Alto
references/skill-routes.md:22
Hidden file in home directory
| KodaClaw | `kc-community` CLI (own skill mgmt) | install: `curl -sL https://github.com/koda-claw/k
The documented command extracts a remote archive directly into ~/.local/bin. This writes an unverified executable into a user command path.
Medio
references/skill-routes.md:22
Hidden file access
| KodaClaw | `kc-community` CLI (own skill mgmt) | install: `curl -sL https://github.com/koda-claw/k
The installation command writes to the hidden ~/.local/bin directory. The access is intentional, but it creates a persistence and executable replacement risk because the archive is unverified.
Medio
scripts/check_status.py:38
Python HTTP libraries
with urllib.request.urlopen(req, timeout=timeout) as resp:
urlopen executes the outbound request to the supplied target. Because destinations are unrestricted, the checker can contact local or private network services.
Bajo
scripts/check_status.py:36
Python HTTP libraries
req = urllib.request.Request(url, method="GET", headers={"User-Agent": "agent-world-status-check/1.0
The function constructs an outbound GET request for a caller-supplied URL. This is expected status-check behavior but creates a network access capability.
Bajo
scripts/check_status.py:22
Hardcoded URL
"XiaLiao/ClawdChat": "https://clawdchat.cn",
The --all mode sends an HTTP request to this hardcoded external platform. The behavior is legitimate health checking but still performs outbound network access.
Bajo
scripts/check_status.py:23
Hardcoded URL
"InStreet": "https://instreet.coze.site",
The --all mode sends an HTTP request to this hardcoded external platform. No credentials are sent, but network access is real.
Bajo
scripts/check_status.py:24
Hardcoded URL
"agentid.sh": "https://agentid.sh",
The status checker contacts this external URL when --all is selected. The request is expected and unauthenticated but remains an outbound connection.
Bajo
scripts/check_status.py:25
Hardcoded URL
"SkillsMD": "https://skillsmd.dev",
The status checker contacts this external URL when --all is selected. The behavior is narrow health checking with no secret transmission.
Bajo
scripts/check_status.py:26
Hardcoded URL
"theskills.directory": "https://theskills.directory",
This URL is an active target of the --all health check. It represents intentional outbound network access without credential data.
Bajo
scripts/check_status.py:27
Hardcoded URL
"KodaClaw Community": "https://community.ai-koda.com",
This URL is an active target of the --all health check. The external request is legitimate but confirmed.
Bajo
scripts/check_status.py:28
Hardcoded URL
"Coze Agent World": "https://world.coze.site",
The checker performs an outbound GET to this platform in --all mode. It sends only a fixed user agent and no stored secrets.
Bajo
scripts/check_status.py:29
Hardcoded URL
"Agentica": "https://agentica.wiki",
The checker performs an outbound GET to this platform in --all mode. The access is expected but externally observable.
Bajo
scripts/check_status.py:30
Hardcoded URL
"Moltbook": "https://moltbook.com",
The --all command contacts this external platform to obtain an HTTP status. This is a real, low-impact network operation.
Bajo
scripts/check_status.py:31
Hardcoded URL
"PromptFrenzy": "https://promptfrenzy.com",
The --all command contacts this external platform to obtain an HTTP status. No sensitive payload is attached.

Hallazgos de riesgos

Las preocupaciones de seguridad confirmadas están separadas de los elementos que aún deben revisarse.

Preocupaciones de seguridad confirmadas (7)

RISK-001 Crítico
references/interaction-playbook.md:10
Pipe to shell pattern
> - How to join (one command): "One-command join: curl -sL https://raw.githubusercontent.com/<owner>
The post template recommends downloading a mutable remote script and piping it directly to bash. This permits immediate arbitrary code execution without inspection or integrity verification.
RISK-002 Crítico
references/interaction-playbook.md:24
Pipe to shell pattern
> "Join in one command: curl -sL https://raw.githubusercontent.com/<owner>/<repo>/main/join.sh | bas
The reply template promotes direct execution of a remotely downloaded join script. A compromised repository or substituted script would execute with the user's privileges.
RISK-003 Alto
references/credential-handling.md:6
Crypto seed/private key mention
2. **Server-issued private keys cannot be recovered.** agentid.sh returns a private key and explicit
The skill instructs the agent to persist an unrecoverable private key in a local gitignored file. It does not require encryption or restrictive permissions, leaving high-value key material exposed locally.
RISK-004 Alto
SKILL.md:40references/skill-routes.md:3-10
Untrusted Remote Skills Treated as Authoritative
The routing flow tells agents to fetch changing platform skills, treat them as authoritative, and follow them directly. Without pinning, integrity checks, or instruction isolation, a compromised remote skill can inject instructions and trigger unauthorized actions.
The text explicitly calls remote skills authoritative, directs the agent to follow them, and recommends re-fetching changed versions. No verification or trust boundary is specified.
RISK-005 Alto
references/skill-routes.md:22
Unverified Remote Archive Installed as Executable
The KodaClaw route streams a mutable release archive into tar and extracts it directly into ~/.local/bin. It provides no version pin, checksum, signature, or archive-content validation.
The complete installation command is present and visibly lacks integrity verification. The destination is an executable search path.
RISK-006 Medio
scripts/check_status.py:48-55scripts/check_status.py:63-64
Unrestricted URL Probing
The status checker accepts any URL and opens it without scheme or destination validation. Agent-supplied targets can reach loopback, private network, metadata, or redirected endpoints.
The positional URL is copied directly into the request path and urllib follows supported targets. No allowlist, address filtering, or redirect restriction is present.
RISK-007 Medio
SKILL.md:42-44references/interaction-playbook.md:26-30
Coordinated Engagement Automation
The skill prescribes replying to every comment and upvoting a fixed number of other posts each session. Automated execution can create inauthentic engagement or violate platform rules.
The instructions explicitly define repeated posting, reply, and upvote behavior as obligations. The skill does not require operator approval or relevance checks for each social action.

Medidas correctivas

Esta auditoría registra correcciones sugeridas. Aplicarlas es responsabilidad de la persona encargada del mantenimiento.

  1. FIX-001
    Crítico
    Documentation recommends piping remote scripts directly into a shell.
    Require a pinned release, download the file separately, verify its checksum or signature, inspect it, and then execute it locally.
  2. FIX-002
    Alto
    The routing flow treats changing remote skills as authoritative instructions.
    Allowlist trusted sources, pin immutable revisions, verify signatures or hashes, and treat all loaded skill text as untrusted data.
  3. FIX-003
    Alto
    Credential guidance permits private keys and tokens in plaintext gitignored files.
    Use an operating system credential store or encrypted vault, restrict file permissions, and avoid storing verification codes unless required.
  4. FIX-004
    Alto
    The KodaClaw command extracts an unverified remote archive directly into an executable search path.
    Download a pinned archive, verify a published checksum or signature, inspect its contents, and install the expected binary explicitly.
  5. FIX-005
    Medio
    The status checker accepts unrestricted URLs.
    Restrict schemes and destinations, reject loopback and private network addresses, disable redirects, and document that arbitrary URLs are unsafe.
  6. FIX-006
    Medio
    The playbook prescribes routine upvotes and mandatory replies as engagement tactics.
    Require user approval for social actions and limit engagement to relevant, authentic responses that follow each platform policy.

Evidencia experta

Identidad inmutable del sujeto, metadatos del escáner, coincidencias descartadas y evidencia a nivel de código fuente.

Sujeto del artefacto

Commit de Marketplace
5526951beaeca22519572a471618555839b53b05
Hash del contenido
c7a39d10f14175a7b2d1fe8dbeb32a3eeec69132a131aee7344c6f38d45e6010
Hash del árbol
cc7ec27a152e6e49de808d4ef7b940eb7ba3aea4369193f4336f18d37b794f56
Ruta del Skill
skills/ptreezh/agent-world
Hash de la carga de auditoría
599fd060d1724d4b8283cb1a30c3e68b

Metadatos del análisis

Modelo de auditoría: codex

Estado del análisis: Completo

El alcance se limita a los archivos, líneas, métodos y pruebas registrados. No se afirma ninguna ejecución en tiempo de ejecución ni en entorno aislado.

Verificar y exportar

Informe JSON Atestación de auditoría firmada CITATION.cff SARIF 2.1.0 Manifiesto de instalación firmado Fuente

El manifiesto y el archivo de bloqueo vinculan los artefactos de instalación a hashes criptográficos. Esta afirmación de integridad es independiente de la evaluación de seguridad.

Atestación de auditoría: active