{
  "skill_name": "bags",
  "skill_path": "/workspace/skills/clawhub-testing-sagb",
  "skill_directory": "/workspace/skills/clawhub-testing-sagb",
  "is_safe": false,
  "max_severity": "HIGH",
  "findings_count": 4,
  "findings": [
    {
      "id": "llm_finding_bags_0",
      "rule_id": "LLM_PROMPT_INJECTION",
      "category": "prompt_injection",
      "severity": "HIGH",
      "title": "Indirect Prompt Injection via External Referenced Files",
      "description": "The SKILL.md instructions reference multiple external files hosted on bags.fm (CULTURE.md, AUTH.md, WALLETS.md, FEES.md, HEARTBEAT.md, TRADING.md, LAUNCH.md) and instructs users to download and follow them. These external files are not included in the skill package and could contain malicious instructions that the agent would follow. The skill establishes transitive trust by delegating to untrusted external content that could be modified by attackers to inject prompts, override instructions, or manipulate agent behavior.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "## Skill Files\n\n| File | URL |\n|------|-----|\n| **SKILL.md** (this file) | `https://bags.fm/skill.md` |\n| **CULTURE.md** | `https://bags.fm/culture.md` |\n| **AUTH.md** | `https://bags.fm/auth.md` |\n...\n**Install locally:**\n```bash\nmkdir -p ~/.bags/skills\ncurl -s https://bags.fm/skill.md > ~/.bags/skills/SKILL.md\ncurl -s https://bags.fm/culture.md > ~/.bags/skills/CULTURE.md\n...",
      "remediation": "Bundle all instruction files within the skill package instead of referencing external URLs. If external files are necessary, implement content validation, integrity checks (checksums/signatures), and explicit warnings about trusting external content. Never automatically follow instructions from external sources without user confirmation.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill presents SIGNIFICANT SECURITY RISKS primarily due to indirect prompt injection via external file references and credential management concerns. The skill instructs agents to download and follow instructions from external URLs (bags.fm) that are not included in the package, creating a transitive trust vulnerability where attackers could modify those external files to inject malicious prompts. Additionally, the skill handles sensitive financial operations (cryptocurrency trading, wallet management) with API credentials but lacks secure credential storage guidance. The missing tokens.py file and incomplete manifest metadata further reduce transparency. The skill involves high-risk financial operations but provides inadequate safety disclosures and no user confirmation requirements. While the core concept of a Solana launchpad integration may be legitimate, the implementation has critical security flaws that must be addressed before deployment.",
        "primary_threats": [
          "Indirect Prompt Injection",
          "Credential Exposure",
          "Tool Exploitation",
          "Social Engineering",
          "Command Injection"
        ],
        "aitech": "AITech-1.2",
        "aitech_name": "Indirect Prompt Injection",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "PROMPT INJECTION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "LLM analyzer correctly identified transitive trust vulnerability. The skill explicitly instructs downloading external content that will guide agent behavior. This is a textbook AITech-1.2 indirect prompt injection vector.",
        "meta_exploitability": "Easy - Attacker only needs to compromise bags.fm or perform DNS/MITM attack to inject malicious instructions",
        "meta_impact": "Critical - Complete agent behavior override, potential credential theft, unauthorized financial transactions"
      }
    },
    {
      "id": "llm_finding_bags_1",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "HIGH",
      "title": "Credential Exposure via API Key Creation and Storage",
      "description": "The skill instructs the agent to create and use API keys (dev keys and JWT tokens) for authentication with the Bags platform. These credentials provide access to financial operations including wallet management, trading, and token launches. The instructions show storing tokens and using them in subsequent API calls, but there's no guidance on secure credential storage, rotation, or protection. Compromised credentials could lead to unauthorized access to wallets and financial operations.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "### 2. Get Your API Key\n\nAfter authentication, create a dev key to access the Public API:\n```bash\ncurl -X POST https://public-api-v2.bags.fm/api/v1/agent/dev/keys/create \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"token\": \"YOUR_JWT_TOKEN\", \"name\": \"My Agent Key\"}'",
      "remediation": "Implement secure credential management: use environment variables or secure vaults for API keys, never log or display credentials, implement token rotation, use short-lived tokens where possible, and provide clear guidance on secure storage. Consider using OAuth flows with refresh tokens instead of long-lived API keys.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill presents SIGNIFICANT SECURITY RISKS primarily due to indirect prompt injection via external file references and credential management concerns. The skill instructs agents to download and follow instructions from external URLs (bags.fm) that are not included in the package, creating a transitive trust vulnerability where attackers could modify those external files to inject malicious prompts. Additionally, the skill handles sensitive financial operations (cryptocurrency trading, wallet management) with API credentials but lacks secure credential storage guidance. The missing tokens.py file and incomplete manifest metadata further reduce transparency. The skill involves high-risk financial operations but provides inadequate safety disclosures and no user confirmation requirements. While the core concept of a Solana launchpad integration may be legitimate, the implementation has critical security flaws that must be addressed before deployment.",
        "primary_threats": [
          "Indirect Prompt Injection",
          "Credential Exposure",
          "Tool Exploitation",
          "Social Engineering",
          "Command Injection"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The skill explicitly shows plaintext credential storage for long-lived tokens (365 days) that control financial operations. This is a clear security vulnerability.",
        "meta_exploitability": "Medium - Requires local file access, but plaintext storage makes credentials easy to steal if system is compromised",
        "meta_impact": "High - Stolen credentials enable unauthorized wallet access, trading, and token launches"
      }
    },
    {
      "id": "llm_finding_bags_3",
      "rule_id": "LLM_SOCIAL_ENGINEERING",
      "category": "social_engineering",
      "severity": "MEDIUM",
      "title": "Incomplete Skill Metadata and Missing Safety Disclosures",
      "description": "The skill manifest is missing critical metadata fields including license, compatibility, and allowed-tools. More importantly, the skill involves financial operations (cryptocurrency trading, wallet management, token launches) but provides no warnings about financial risks, no disclosure of network operations, and no transparency about the scope of operations. The description presents this as a simple launchpad integration without disclosing the significant financial and security implications.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "YAML Manifest Details:\n- name: bags\n- description: Bags - The Solana launchpad for humans and AI agents...\n- license: Not specified\n- compatibility: Not specified\n- allowed-tools: Not specified",
      "remediation": "Add complete manifest metadata including license, compatibility requirements, and allowed-tools declarations. Include prominent warnings about financial risks, network operations, and credential requirements. Disclose that this skill performs cryptocurrency transactions that could result in financial loss. Add required user confirmations before executing financial operations.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill presents SIGNIFICANT SECURITY RISKS primarily due to indirect prompt injection via external file references and credential management concerns. The skill instructs agents to download and follow instructions from external URLs (bags.fm) that are not included in the package, creating a transitive trust vulnerability where attackers could modify those external files to inject malicious prompts. Additionally, the skill handles sensitive financial operations (cryptocurrency trading, wallet management) with API credentials but lacks secure credential storage guidance. The missing tokens.py file and incomplete manifest metadata further reduce transparency. The skill involves high-risk financial operations but provides inadequate safety disclosures and no user confirmation requirements. While the core concept of a Solana launchpad integration may be legitimate, the implementation has critical security flaws that must be addressed before deployment.",
        "primary_threats": [
          "Indirect Prompt Injection",
          "Credential Exposure",
          "Tool Exploitation",
          "Social Engineering",
          "Command Injection"
        ],
        "aitech": "AITech-2.1",
        "aitech_name": "Social Engineering",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "SOCIAL ENGINEERING",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The manifest is objectively incomplete and the skill lacks risk disclosures for financial operations. This is a transparency issue that could mislead users.",
        "meta_exploitability": "Low - Not directly exploitable, but increases risk of user error",
        "meta_impact": "Medium - Users may unknowingly authorize high-risk financial operations"
      }
    },
    {
      "id": "llm_finding_bags_4",
      "rule_id": "LLM_COMMAND_INJECTION",
      "category": "command_injection",
      "severity": "MEDIUM",
      "title": "Command Injection Risk in Installation Instructions",
      "description": "The installation instructions use curl with shell redirection to download and execute external content from bags.fm. The commands use 'curl -s' (silent mode) which suppresses error messages and could hide malicious redirects or content. These commands are executed directly in bash without any validation, integrity checks, or user confirmation, creating a command injection vector if the remote server is compromised or performs malicious redirects.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "**Install locally:**\n```bash\nmkdir -p ~/.bags/skills\ncurl -s https://bags.fm/skill.md > ~/.bags/skills/SKILL.md\ncurl -s https://bags.fm/culture.md > ~/.bags/skills/CULTURE.md\ncurl -s https://bags.fm/auth.md > ~/.bags/skills/AUTH.md\n...",
      "remediation": "Remove silent mode from curl commands, add integrity verification (checksums/signatures), implement HTTPS certificate validation, add user confirmation before downloading external content, and validate downloaded content before use. Consider providing a secure installation script with built-in verification rather than raw curl commands.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill presents SIGNIFICANT SECURITY RISKS primarily due to indirect prompt injection via external file references and credential management concerns. The skill instructs agents to download and follow instructions from external URLs (bags.fm) that are not included in the package, creating a transitive trust vulnerability where attackers could modify those external files to inject malicious prompts. Additionally, the skill handles sensitive financial operations (cryptocurrency trading, wallet management) with API credentials but lacks secure credential storage guidance. The missing tokens.py file and incomplete manifest metadata further reduce transparency. The skill involves high-risk financial operations but provides inadequate safety disclosures and no user confirmation requirements. While the core concept of a Solana launchpad integration may be legitimate, the implementation has critical security flaws that must be addressed before deployment.",
        "primary_threats": [
          "Indirect Prompt Injection",
          "Credential Exposure",
          "Tool Exploitation",
          "Social Engineering",
          "Command Injection"
        ],
        "aitech": "AITech-9.1",
        "aitech_name": "Model or Agentic System Manipulation",
        "aisubtech": "AISubtech-9.1.4",
        "aisubtech_name": "Injection Attacks (SQL, Command Execution, XSS)",
        "scanner_category": "INJECTION ATTACK",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The commands are objectively unsafe - silent mode + no integrity checks + external downloads. This is a standard command injection/supply chain attack vector.",
        "meta_exploitability": "Medium - Requires DNS/MITM attack or compromise of bags.fm, but silent mode makes detection harder",
        "meta_impact": "High - Malicious content could contain prompt injections, credential theft instructions, or system manipulation commands"
      }
    }
  ],
  "scan_duration_seconds": 40.42335033416748,
  "duration_ms": 40423,
  "analyzers_used": [
    "static_analyzer",
    "llm_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-07T21:05:54.523044"
}