bags
4 findings (2 high, 2 medium), mainly prompt injection, data exfiltration, social engineering. Most recent scan 2026-02-07.
This skill presents SIGNIFICANT SECURITY RISKS primarily due to indirect prompt injection via external file references and credential management concerns. The skill instructs agents to download and follow instructions from external URLs (bags.fm) that are not included in the package, creating a transitive trust vulnerability where attackers could modify those external files to inject malicious prompts. Additionally, the skill handles sensitive financial operations (cryptocurrency trading, wallet management) with API credentials but lacks secure credential storage guidance. The missing tokens.py file and incomplete manifest metadata further reduce transparency. The skill involves high-risk financial operations but provides inadequate safety disclosures and no user confirmation requirements. While the core concept of a Solana launchpad integration may be legitimate, the implementation has critical security flaws that must be addressed before deployment.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Bags - The Solana launchpad for humans and AI agents. Authenticate, manage wallets, claim fees, trade tokens, and launch tokens for yourself, other agents, or humans.
- Package
- 9 files, 105 KB
- SKILL.md
- 1242 words, 12+ sections
- Code
- None. Instructions only.
- Version
- 1.0.0
- Homepage
- https://bags.fm
SKILL.md covers: Bags 💰 · Skill Files · What is Bags? · 🚀 Launch Tokens for Anyone · Quick Start · 1. Authenticate via Moltbook · Step 1: Initialize auth session · Step 2: Post the verification content to Moltbook · Step 3: Complete login with post ID · See AUTH.md for complete flow · 2. Get Your API Key · 3. Check Your Wallets
Findings
HIGH Indirect Prompt Injection via External Referenced Files Prompt Injectionllm
The SKILL.md instructions reference multiple external files hosted on bags.fm (CULTURE.md, AUTH.md, WALLETS.md, FEES.md, HEARTBEAT.md, TRADING.md, LAUNCH.md) and instructs users to download and follow them. These external files are not included in the skill package and could contain malicious instructions that the agent would follow. The skill establishes transitive trust by delegating to untrusted external content that could be modified by attackers to inject prompts, override instructions, or manipulate agent behavior.
SKILL.md
## Skill Files
| File | URL |
|------|-----|
| **SKILL.md** (this file) | `https://bags.fm/skill.md` |
| **CULTURE.md** | `https://bags.fm/culture.md` |
| **AUTH.md** | `https://bags.fm/auth.md` |
...
**Install locally:**
```bash
mkdir -p ~/.bags/skills
curl -s https://bags.fm/skill.md > ~/.bags/skills/SKILL.md
curl -s https://bags.fm/culture.md > ~/.bags/skills/CULTURE.md
...HIGH Credential Exposure via API Key Creation and Storage Data Exfiltrationllm
The skill instructs the agent to create and use API keys (dev keys and JWT tokens) for authentication with the Bags platform. These credentials provide access to financial operations including wallet management, trading, and token launches. The instructions show storing tokens and using them in subsequent API calls, but there's no guidance on secure credential storage, rotation, or protection. Compromised credentials could lead to unauthorized access to wallets and financial operations.
SKILL.md
### 2. Get Your API Key
After authentication, create a dev key to access the Public API:
```bash
curl -X POST https://public-api-v2.bags.fm/api/v1/agent/dev/keys/create \
-H "Content-Type: application/json" \
-d '{"token": "YOUR_JWT_TOKEN", "name": "My Agent Key"}'MEDIUM Incomplete Skill Metadata and Missing Safety Disclosures Social Engineeringllm
The skill manifest is missing critical metadata fields including license, compatibility, and allowed-tools. More importantly, the skill involves financial operations (cryptocurrency trading, wallet management, token launches) but provides no warnings about financial risks, no disclosure of network operations, and no transparency about the scope of operations. The description presents this as a simple launchpad integration without disclosing the significant financial and security implications.
SKILL.md
YAML Manifest Details:
- name: bags
- description: Bags - The Solana launchpad for humans and AI agents...
- license: Not specified
- compatibility: Not specified
- allowed-tools: Not specifiedMEDIUM Command Injection Risk in Installation Instructions Command Injectionllm
The installation instructions use curl with shell redirection to download and execute external content from bags.fm. The commands use 'curl -s' (silent mode) which suppresses error messages and could hide malicious redirects or content. These commands are executed directly in bash without any validation, integrity checks, or user confirmation, creating a command injection vector if the remote server is compromised or performs malicious redirects.
SKILL.md
**Install locally:**
```bash
mkdir -p ~/.bags/skills
curl -s https://bags.fm/skill.md > ~/.bags/skills/SKILL.md
curl -s https://bags.fm/culture.md > ~/.bags/skills/CULTURE.md
curl -s https://bags.fm/auth.md > ~/.bags/skills/AUTH.md
...What is in the package
| File | Kind | Size |
|---|---|---|
auth.md | doc | 12 KB |
culture.md | doc | 5.7 KB |
fees.md | doc | 10.0 KB |
heartbeat.md | doc | 14 KB |
launch.md | doc | 21 KB |
skill.json | config | 1.4 KB |
skill.md | doc | 9.7 KB |
trading.md | doc | 14 KB |
wallets.md | doc | 17 KB |
External hosts referenced
bags.fm public-api-v2.bags.fm gene-v4mswe-fast-mainnet.helius-rpc.com solscan.io dev.bags.fm www.moltbook.com docs.bags.fm mytoken.com release.anza.xyz t.me x.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
BAGS_API_KEY BAGS_JWT_TOKEN BAGS_PRIVATE_KEY BAGS_TOKEN_MINT BAGS_RPC_URL BAGS_CONFIG_RESPONSE BAGS_CONFIG_TXS BAGS_CLAIMABLE_LAMPORTS BAGS_CONFIG_KEY BAGS_CREDS_FILE BAGS_METADATA_URL BAGS_TOKEN_INFO BAGS_TOKEN_NAME BAGS_TOKEN_SYMBOL BAGS_KEY_RESPONSE BAGS_AUTH_CHECK BAGS_BALANCE_LAMPORTS BAGS_CONFIG_TX_COUNT BAGS_IMAGE_URL BAGS_MOLTBOOK_USERNAME BAGS_POST_ID BAGS_PROVIDER BAGS_PUBLIC_ID BAGS_TOKEN_DESC BAGS_USERNAME TOKEN_MINT BAGS_MOLTBOOK_API_KEY BAGS_SECRET BAGS_TOTAL_LAMPORTS
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/testing-sagb
- Raw scan result: sagb-scan.json
- Badge for your README:
- Request a re-scan