atproto-deploy
Fail
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: A hardcoded administrative token is present in the
SKILL.mdfile:ADMIN_TOKEN="grimlock-admin-f5f3ef8419386713454c05b8d475cce1". This token is included in examplecurlcommands used to authenticate requests to the agent network's management API. - [COMMAND_EXECUTION]: The skill uses
npxto execute build and deployment tools:npx wrangler deployfor Cloudflare Workers,npx vite buildfor the dashboard application, andnpx turbo typecheckandnpx vitest runfor pre-deployment checks. - [DATA_EXFILTRATION]: The skill uses
curlto interact with remote APIs atagent-network.joelhooks.workers.dev. While these target the author's project infrastructure, the use of these commands in conjunction with the hardcoded administrative token facilitates unauthorized remote data modification and access.
Recommendations
- AI detected serious security threats
Audit Metadata