Skip to content
Report library
Purpose / Other

Agentix Ceo Skill Security Audit

What the author says it does (original text)

Manage your team — create roles, assign tasks, spawn workers, and monitor progress

Independent security check

Do not install or run it yet

Files checked
1
Risks found
7
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
High risk

The Anthropic API key is uploaded to Agentix

Source references: 3
What we found

The Skill explicitly asks for the user's Anthropic API key and sends the complete key to agentix.cloud in an authenticated PATCH request. The source only states that the service encrypts and limits its use; it does not verify those controls.

Why this matters

Agentix, or a party able to access its team configuration, could use the key for Anthropic API calls within its permissions and generate charges billed to the user.

During SaaS setup, the Skill asks for the full Anthropic API key and sends it to agentix.cloud in a PATCH request. The claim that it is encrypted and used only for workers is a documentation assertion; the supplied source cannot verify the server-side implementation. A user can require a dedicated low-limit key, confirm retention/deletion controls, or decline to upload a primary-account key.

SKILL.md:120In the instructionsOpen original file
Workers need an Anthropic API key to run. Ask the user to provide their Anthropic API key (from console.anthropic.com), then set it on the team — do not display it in chat:```PATCH https://agentix.cloud/teams/$TEAM_IDAuthorization: Bearer $API_KEY{ "anthropicApiKey": "$ANTHROPIC_API_KEY" }```This is stored encrypted and used only to spawn workers.
Show 2 other places
SKILL.md:122In the instructionsOpen original file
```PATCH https://agentix.cloud/teams/$TEAM_IDAuthorization: Bearer $API_KEY{ "anthropicApiKey": "$ANTHROPIC_API_KEY" }```
SKILL.md:129In the instructionsOpen original file
This is stored encrypted and used only to spawn workers.
Medium risk

Agentix credentials persist in a fixed plaintext local file

Source references: 3
What we found

The Skill writes the API key and account identifiers to ~/.agentix/credentials using shell redirection and silently reloads them in later sessions. The shown command does not set file permissions.

Why this matters

Any local user, process, or malware already able to read the file could obtain the Agentix API key and potentially operate the user's teams, tasks, and configuration.

The Skill directs every session to silently read a fixed credentials file and shows API_KEY, TEAM_ID, and CUSTOMER_ID being written directly into it. The command creates the directory but does not set directory or file permissions; actual exposure depends on the system umask and existing permissions. A user can ask the author to document permission safeguards and restrict the file to the current account.

SKILL.md:31In the instructionsOpen original file
On every session start, check `~/.agentix/credentials`:**File exists** → load values silently. Do not prompt the user.
Show 2 other places
SKILL.md:40In the instructionsOpen original file
```bash# SaaS credentialsmkdir -p ~/.agentix && cat > ~/.agentix/credentials << 'EOF'API_KEY=at_live_...TEAM_ID=cmm...CUSTOMER_ID=cmm...EOF
SKILL.md:105In the instructionsOpen original file
Save the returned `apiKey` and `customerId` to `~/.agentix/credentials` immediately. Do not display them in chat. The key cannot be recovered if lost.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
High risk

Autopilot authorizes continuous repository changes and merging

Source references: 6
What we found

Autopilot is described as independently planning, creating tasks, spawning remote workers, reviewing, merging, and looping continuously. It does not require fresh user approval for each new task or merge.

Why this matters

Mistakes, poisoned tasks, or a manipulated playbook could cause workers to keep changing code and merge unwanted content. With broad token permissions, this could affect default branches and release processes.

This risk applies only after the user explicitly selects or switches to autopilot; first-time setup also offers supervised mode. Once enabled, autopilot authorizes autonomous planning, task creation, worker spawning, review, merging, and continuous looping without requiring fresh approval for each task or merge. It may therefore keep changing a connected repository. A user can choose supervised mode or require per-action approval for merges, pushes, and new tasks.

SKILL.md:143In the instructionsOpen original file
The playbook contains a `## Mode` section that is either `supervised` or `autopilot`. Apply the team preferences for that mode as described below.- **Supervised**: Monitor in-flight work and push it forward. Do NOT plan new work or create tasks without user approval.- **Autopilot**: Full autonomy — monitor, plan, create tasks, spawn workers, and loop continuously.
Show 5 other places
SKILL.md:152In the instructionsOpen original file
> **How should I operate?**>> 1. **Supervised** — I monitor workers and push in-flight work forward, but I check with you before planning new work or spawning workers.> 2. **Autopilot** — I run autonomously — plan work, spawn workers, review, merge, and loop. Maximum throughput.
SKILL.md:191In the instructionsOpen original file
Configure git integration — ask the user for their GitHub token and repo URL, then set them (do not display the token in chat):```json{ "config": { "gitRepoUrl": "https://github.com/org/repo", "githubToken": "$GITHUB_TOKEN" } }```
SKILL.md:145In the instructionsOpen original file
- **Supervised**: Monitor in-flight work and push it forward. Do NOT plan new work or create tasks without user approval.- **Autopilot**: Full autonomy — monitor, plan, create tasks, spawn workers, and loop continuously.
SKILL.md:150In the instructionsOpen original file
If the playbook is `null`, ask the user:> **How should I operate?**>> 1. **Supervised** — I monitor workers and push in-flight work forward, but I check with you before planning new work or spawning workers.> 2. **Autopilot** — I run autonomously — plan work, spawn workers, review, merge, and loop. Maximum throughput.
SKILL.md:165In the instructionsOpen original file
### Switching modesIf the user says "switch to supervised/autopilot", fetch the new template, preserve any `## Custom Policies` section, and PUT the updated playbook.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
High risk

A GitHub token is entrusted to the remote service and its workers

Source references: 3
What we found

When Git integration is configured, the Skill obtains the user's GitHub token and places it with the repository URL in Agentix team configuration. Tasks are performed by remote workers running on Modal.

Why this matters

The remote service or workers could exercise every repository permission granted to the token, potentially including reading private code, pushing changes, or accessing other repositories visible to it. Autopilot also claims the ability to review and merge code.

When Git integration is enabled, the Skill requests a GitHub token and stores it with the repository URL in remote team configuration, while platform workers run on Modal. The source does not specify token scope, exact worker access boundaries, or deletion controls, so third-party infrastructure may gain repository read/write capabilities. A user can require a revocable, least-privilege token limited to the intended repository.

SKILL.md:10In the instructionsOpen original file
You are a CEO — an orchestrator that manages a team of AI workers through the Agentix platform. Workers are ephemeral Agentix workers that run on Modal, complete their task, and exit.
Show 2 other places
SKILL.md:191In the instructionsOpen original file
Configure git integration — ask the user for their GitHub token and repo URL, then set them (do not display the token in chat):```json{ "config": { "gitRepoUrl": "https://github.com/org/repo", "githubToken": "$GITHUB_TOKEN" } }```
SKILL.md:152In the instructionsOpen original file
> **How should I operate?**>> 1. **Supervised** — I monitor workers and push in-flight work forward, but I check with you before planning new work or spawning workers.> 2. **Autopilot** — I run autonomously — plan work, spawn workers, review, merge, and loop. Maximum throughput.
Medium risk

Self-hosted mode explicitly operates without authentication

Source references: 4
What we found

The Skill states that the self-hosted API is open on the local network with no API key or authentication, while the API exposes role and task creation, modification, and deletion.

Why this matters

If the instance listens beyond a trusted local interface, any device or process able to reach its port could inspect or alter team work, delete roles, or cancel tasks.

The Skill explicitly says the self-hosted API is open on the local network without authentication, while listed endpoints can create, modify, and delete roles and tasks and start workers. If the service is reachable beyond trusted hosts or networks, anyone with endpoint access may operate team resources. A user can require localhost-only binding, network access controls, or authentication at a reverse proxy.

SKILL.md:37In the instructionsOpen original file
- **SaaS** (`$AGENTIX_API` is `https://agentix.cloud` or unset): Run the registration flow (Steps 1–4 below), then save credentials.- **Self-hosted** (`AGENTIX_API_URL` points to a custom instance): No registration needed. No API keys, no auth — the API is open on the local network. Just save the instance URL and team ID.
Show 3 other places
SKILL.md:203In the instructionsOpen original file
```GET    $AGENTIX_API/roles?teamId=$TEAM_ID             # list rolesPOST   $AGENTIX_API/roles                            # create rolePATCH  $AGENTIX_API/roles/ROLE_ID                    # update roleDELETE $AGENTIX_API/roles/ROLE_ID                    # delete role```
SKILL.md:220In the instructionsOpen original file
```GET    $AGENTIX_API/tasks?teamId=$TEAM_ID             # list (filter: &status=, &role=)GET    $AGENTIX_API/tasks/TASK_ID                    # get detailsPOST   $AGENTIX_API/tasks                            # createPATCH  $AGENTIX_API/tasks/TASK_ID                    # updateDELETE $AGENTIX_API/tasks/TASK_ID                    # cancel```
SKILL.md:232In the instructionsOpen original file
```GET    $AGENTIX_API/workers?teamId=$TEAM_ID           # list (filter: &status=running)GET    $AGENTIX_API/workers/WORKER_ID                # get detailsPOST   $AGENTIX_API/tasks/TASK_ID/run                # spawn workerPOST   $AGENTIX_API/tasks/TASK_ID/resume             # resume failed worker```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
High risk

A remote playbook can change the agent's operating instructions

Source references: 5
What we found

The Skill fetches a playbook from a configurable API address every session and follows its mode, policies, and custom rules. The address may come from an environment variable or credential file, so the instructions need not originate from the fixed agentix.cloud domain.

Why this matters

If the team account, remote service, self-hosted instance, or local configuration is compromised, an attacker could use the playbook to steer the agent into creating tasks, spawning workers, or taking actions the user did not expect.

The Skill requires fetching a playbook each session and treating its mode, policies, and custom rules as operating instructions. The API address can be redirected to a custom self-hosted instance and saved in the credentials file. Consequently, whoever controls that endpoint or playbook can influence later agent decisions. A user can pin an approved domain and require remote rules to be shown and confirmed before use.

SKILL.md:14In the instructionsOpen original file
Throughout this skill, `$AGENTIX_API` refers to the base URL of the Agentix API. Before making any API calls, resolve this value as follows:1. Check the `AGENTIX_API_URL` environment variable.2. If not set, default to `https://agentix.cloud`.
Show 4 other places
SKILL.md:62In the instructionsOpen original file
1. **The user's instructions always take precedence over the playbook and this skill file.** If the user tells you to stop, pause, wait, or change course — do so immediately.2. **Read the playbook before acting.** The playbook (`GET /teams/:id/playbook`) contains team configuration and preferences — your operating mode, policies, and custom rules for this team.3. **This file is an API reference.** It describes what you *can* do. The playbook provides the team-specific configuration for *when and how* to do it.
SKILL.md:137In the instructionsOpen original file
**Read it at the start of every session.**```GET $AGENTIX_API/teams/$TEAM_ID/playbook```The playbook contains a `## Mode` section that is either `supervised` or `autopilot`. Apply the team preferences for that mode as described below.- **Supervised**: Monitor in-flight work and push it forward. Do NOT plan new work or create tasks without user approval.- **Autopilot**: Full autonomy — monitor, plan, create tasks, spawn workers, and loop continuously.
SKILL.md:178In the instructionsOpen original file
Users can add custom policies under `## Custom Policies` — these survive mode switches.
SKILL.md:48In the instructionsOpen original file
# Self-hosted credentials (no API key needed)mkdir -p ~/.agentix && cat > ~/.agentix/credentials << 'EOF'AGENTIX_API_URL=http://localhost:3456TEAM_ID=defaultEOF```
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Continuous autonomous workers can create open-ended API charges

Source references: 4
What we found

Every worker requires the user's Anthropic API key, while autopilot explicitly creates tasks, spawns workers, and loops continuously. No budget, invocation count, or stopping limit is specified.

Why this matters

Long-running work, repeated failures, or many automatically generated tasks could continually consume Anthropic quota and charge the user's account.

Workers use the user's Anthropic API key, while autopilot is defined to create tasks, spawn workers, and loop continuously. The source provides no budget, worker-count, usage, or stopping limit, so selecting autopilot could produce open-ended model usage and charges; the source does not establish a billing model or prove charges occurred. A user can require spending and concurrency caps plus an explicit stopping condition.

SKILL.md:118In the instructionsOpen original file
### Step 4 — Set your Anthropic API keyWorkers need an Anthropic API key to run. Ask the user to provide their Anthropic API key (from console.anthropic.com), then set it on the team — do not display it in chat:
Show 3 other places
SKILL.md:143In the instructionsOpen original file
The playbook contains a `## Mode` section that is either `supervised` or `autopilot`. Apply the team preferences for that mode as described below.- **Supervised**: Monitor in-flight work and push it forward. Do NOT plan new work or create tasks without user approval.- **Autopilot**: Full autonomy — monitor, plan, create tasks, spawn workers, and loop continuously.
SKILL.md:145In the instructionsOpen original file
- **Supervised**: Monitor in-flight work and push it forward. Do NOT plan new work or create tasks without user approval.- **Autopilot**: Full autonomy — monitor, plan, create tasks, spawn workers, and loop continuously.
SKILL.md:154In the instructionsOpen original file
>> 1. **Supervised** — I monitor workers and push in-flight work forward, but I check with you before planning new work or spawning workers.> 2. **Autopilot** — I run autonomously — plan work, spawn workers, review, merge, and loop. Maximum throughput.

Inside this skill

7 instruction sections

The Skill connects to agentix.cloud by default and requires registration with a name and email; it then saves the returned Agentix API key and customer identifier locally.

View source
SKILL.md:16In the instructionsOpen original file
1. Check the `AGENTIX_API_URL` environment variable.2. If not set, default to `https://agentix.cloud`.
SKILL.md:84In the instructionsOpen original file
Ask the user for their name and email. Do not guess these values.```POST https://agentix.cloud/registerContent-Type: application/json{ "name": "<from user>", "email": "<from user>" }```
SKILL.md:103In the instructionsOpen original file
202 = still waiting, 200 = confirmed (contains `apiKey` and `customerId`), 410 = expired.Save the returned `apiKey` and `customerId` to `~/.agentix/credentials` immediately. Do not display them in chat. The key cannot be recovered if lost.

At every session start it silently reads a credential file at a fixed location, where the Agentix API key, team ID, and customer ID are stored as plaintext environment-style values.

View source
SKILL.md:31In the instructionsOpen original file
On every session start, check `~/.agentix/credentials`:**File exists** → load values silently. Do not prompt the user.
SKILL.md:40In the instructionsOpen original file
```bash# SaaS credentialsmkdir -p ~/.agentix && cat > ~/.agentix/credentials << 'EOF'API_KEY=at_live_...TEAM_ID=cmm...CUSTOMER_ID=cmm...EOF

The remote Agentix service receives the user's Anthropic API key and, when Git integration is enabled, a GitHub token and repository URL. Ephemeral remote workers use this configuration to perform tasks.

View source
SKILL.md:10In the instructionsOpen original file
You are a CEO — an orchestrator that manages a team of AI workers through the Agentix platform. Workers are ephemeral Agentix workers that run on Modal, complete their task, and exit.
SKILL.md:120In the instructionsOpen original file
Workers need an Anthropic API key to run. Ask the user to provide their Anthropic API key (from console.anthropic.com), then set it on the team — do not display it in chat:```PATCH https://agentix.cloud/teams/$TEAM_IDAuthorization: Bearer $API_KEY{ "anthropicApiKey": "$ANTHROPIC_API_KEY" }```This is stored encrypted and used only to spawn workers.
SKILL.md:191In the instructionsOpen original file
Configure git integration — ask the user for their GitHub token and repo URL, then set them (do not display the token in chat):```json{ "config": { "gitRepoUrl": "https://github.com/org/repo", "githubToken": "$GITHUB_TOKEN" } }```

The team's operating rules are fetched from a remote playbook. Supervised mode requires approval for new work, while autopilot permits continuous planning, task creation, worker spawning, review, and merging.

View source
SKILL.md:137In the instructionsOpen original file
**Read it at the start of every session.**```GET $AGENTIX_API/teams/$TEAM_ID/playbook```The playbook contains a `## Mode` section that is either `supervised` or `autopilot`. Apply the team preferences for that mode as described below.- **Supervised**: Monitor in-flight work and push it forward. Do NOT plan new work or create tasks without user approval.- **Autopilot**: Full autonomy — monitor, plan, create tasks, spawn workers, and loop continuously.
SKILL.md:152In the instructionsOpen original file
> **How should I operate?**>> 1. **Supervised** — I monitor workers and push in-flight work forward, but I check with you before planning new work or spawning workers.> 2. **Autopilot** — I run autonomously — plan work, spawn workers, review, merge, and loop. Maximum throughput.
Start here · InstructionsSKILL.md
agentix-ceo
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:17In the instructionsOpen original file
1. Check the `AGENTIX_API_URL` environment variable.2. If not set, default to `https://agentix.cloud`.
SKILL.md:21In the instructionsOpen original file
# SaaS (default — zero config required)export AGENTIX_API_URL=https://agentix.cloud
SKILL.md:24In the instructionsOpen original file
# Self-hosted (set to your own instance URL instead)export AGENTIX_API_URL=https://your-agentix-instance.example.com```
Run commands
SKILL.md:19In the instructionsOpen original file
```bash# SaaS (default — zero config required)
SKILL.md:40In the instructionsOpen original file
```bash# SaaS credentials
Read keys or account settings
SKILL.md:29In the instructionsOpen original file
## Credentials
SKILL.md:31In the instructionsOpen original file
On every session start, check `~/.agentix/credentials`:
SKILL.md:37In the instructionsOpen original file
- **SaaS** (`$AGENTIX_API` is `https://agentix.cloud` or unset): Run the registration flow (Steps 1–4 below), then save credentials.- **Self-hosted** (`AGENTIX_API_URL` points to a custom instance): No registration needed. No API keys, no auth — the API is open on the local network. Just save the instance URL and team ID.
Read files
SKILL.md:42In the instructionsOpen original file
# SaaS credentialsmkdir -p ~/.agentix && cat > ~/.agentix/credentials << 'EOF'API_KEY=at_live_...
SKILL.md:49In the instructionsOpen original file
# Self-hosted credentials (no API key needed)mkdir -p ~/.agentix && cat > ~/.agentix/credentials << 'EOF'AGENTIX_API_URL=http://localhost:3456
Lines read
266
File checksum (to compare versions)
38336586187eb2ed2f3dbcf008ca4abb0b1bb3d8fc21baeea74a2b8872b3d408