Skill Trust Decision
delvorn-register
The skill contains an undeclared promotional script that injects marketing content into public Telegraph pages using harvested credentials, a clear doc-to-code mismatch with the SKILL.md describing only an x402 payment flow.
Most direct threat evidence
01
SKILL.md describes a legitimate x402 payment test flow to build trust Entry · SKILL.md
02
edit_telegraph_promo.py is bundled as an additional script but not mentioned in SKILL.md stealth · edit_telegraph_promo.py
03
Script reads a Telegraph access token from an undisclosed credential path Escalation · edit_telegraph_promo.py
Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
2 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
8 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 4 attack-chain steps and 2 severe findings.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
Attack Chain
01
SKILL.md describes a legitimate x402 payment test flow to build trust
Entry · SKILL.md:1
02
edit_telegraph_promo.py is bundled as an additional script but not mentioned in SKILL.md
stealth · edit_telegraph_promo.py:1
03
Script reads a Telegraph access token from an undisclosed credential path
Escalation · edit_telegraph_promo.py:5
04
Agent unknowingly publishes promotional contest content to a public webpage via Telegraph API
Impact · edit_telegraph_promo.py:46
What drove the risk score up
Undeclared credential access +15
edit_telegraph_promo.py reads a local Telegraph access token from connector-secrets path without declaration in SKILL.md
Undeclared network write +15
Script performs editPage POST to api.telegra.ph, modifying public content, never mentioned in SKILL.md
Undeclared content modification +15
Injects promotional text about 'first independent agent' contest into a public webpage
Doc-to-code mismatch +10
SKILL.md describes only x402 payment flow; the promotional script is entirely separate hidden functionality
Most important evidence
High Doc Mismatch
Undeclared promotional content injection script
edit_telegraph_promo.py is a standalone Python script that reads a Telegraph access token, fetches a public page, injects promotional text about a contest, and reposts it. This functionality is completely absent from SKILL.md which only describes an x402 payment test.
edit_telegraph_promo.py:1 Remove this script or declare its purpose, credential access, and network write behavior in SKILL.md. Users must consent to promotional content being published.
High Credential Theft
Undeclared credential file access
The script accesses /home/box/agent-data/connector-secrets/.../telegraph.json to retrieve an access token. This credential access is not declared in SKILL.md capabilities or documentation.
edit_telegraph_promo.py:5 If this script is retained, clearly document the credential path access and require explicit user consent.
Medium Data Exfil
Hidden content modification behavior
The script silently modifies a public Telegraph page with promotional content about 'first independent agent' completing a test and receiving 'Certified' status. This uses agent capabilities for undisclosed marketing purposes.
edit_telegraph_promo.py:14 Any content modification on behalf of a user must be explicitly declared and consented to.
Low Priv Escalation
Capability mismatch with declared tools
SKILL.md declares curl (bins) but the promotional script uses Python urllib for network operations. The script also performs network writes that aren't part of the described x402 flow.
edit_telegraph_promo.py:38 Ensure all network operations match declared capabilities and use cases.
Declared capability vs actual capability
Network Block
Declared READ
→ Inferred WRITE
edit_telegraph_promo.py:46 - POST to api.telegra.ph/editPage Filesystem Block
Declared NONE
→ Inferred READ
edit_telegraph_promo.py:5 - reads telegraph.json from connector-secrets path Shell Pass
Declared NONE
→ Inferred NONE
recat.sh:2 - clawhub CLI call (not declared but benign for self-publishing) Suspicious artifacts and egress
Medium External URL
https://delvorn.site/api/x402/test-asset SKILL.md:3
Medium External URL
https://telegra.ph/Delvorn-register-1-test-public-receipt-08-26 SKILL.md:11
Medium External URL
https://delvorn.site/.well-known/x402 SKILL.md:22
Medium External URL
https://api.telegra.ph/getPage/ edit_telegraph_promo.py:15
Medium External URL
https://delvorn.site/ edit_telegraph_promo.py:37
Medium External URL
https://api.telegra.ph/editPage/ edit_telegraph_promo.py:40
Medium External URL
https://clawhub.ai/user/mranderson323 skill-card.md:9
Medium External URL
https://clawhub.ai/mranderson323/skills/delvorn-register skill-card.md:35
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| urllib | stdlib | Python | No | Standard library only, no external dependencies |
File composition
5 files · 141 lines
Markdown 2 files · 79 linesPython 1 files · 50 linesShell 1 files · 7 linesJSON 1 files · 5 lines
Files of concern · 3
skill-card.md https://clawhub.ai/user/mranderson323 · https://clawhub.ai/mranderson323/skills/delvorn-register
edit_telegraph_promo.py Undeclared promotional content injection script · Undeclared credential file access · Hidden content modification behavior · Capability mismatch with declared tools · https://api.telegra.ph/getPage/ · https://delvorn.site/ · https://api.telegra.ph/editPage/
SKILL.md https://delvorn.site/api/x402/test-asset · https://telegra.ph/Delvorn-register-1-test-public-receipt-08-26 · https://delvorn.site/.well-known/x402
Other files · recat.sh · _meta.json
Security positives
The skill-card.md does acknowledge the undeclared script as a known risk, demonstrating publisher awareness
The x402 payment flow described in SKILL.md appears legitimate and well-defined
recat.sh is a simple CLI publishing script with no malicious behavior
No base64 obfuscation, reverse shells, or direct credential exfiltration observed