跳转到正文
报告库
用途分类 / 其他用途

Agentix Ceo Skill 安全审计

作者说它能做什么(原文)

Manage your team — create roles, assign tasks, spawn workers, and monitor progress

第三方安全检查结论

先别安装或运行

已检查文件
1
发现的风险
7
会不会运行危险命令?检查是否下载程序后直接运行、让他人远程控制电脑,或藏起要运行的命令。未发现风险
会不会泄露文件和密钥?检查是否发送含密码或密钥的文件,以及代码里是否直接写了密钥。发现 2 项风险
高风险

Anthropic API 密钥会上传给 Agentix

原文依据:3 处
发现了什么

该 Skill 明确要求用户提供 Anthropic API 密钥,并通过经过 Agentix 身份验证的 PATCH 请求把完整密钥交给 agentix.cloud。源码只有服务方关于加密存储和用途的声明,不能验证其实现。

为什么需要注意

Agentix 或能够访问其团队配置的一方可能使用该密钥调用 Anthropic API,读取密钥关联的权限范围,并产生由用户账户承担的费用。

在 SaaS 设置中,Skill 会要求用户提供完整的 Anthropic API 密钥,并通过 PATCH 请求发送至 agentix.cloud。其“加密保存且仅用于 worker”的说法只是文档声明,所给源码无法验证服务端实现。用户可要求改用限额较低的专用密钥、确认保存与删除政策,或拒绝上传主账户密钥。

SKILL.md:120来自说明文档打开原文件
Workers need an Anthropic API key to run. Ask the user to provide their Anthropic API key (from console.anthropic.com), then set it on the team — do not display it in chat:```PATCH https://agentix.cloud/teams/$TEAM_IDAuthorization: Bearer $API_KEY{ "anthropicApiKey": "$ANTHROPIC_API_KEY" }```This is stored encrypted and used only to spawn workers.
查看另外 2 个位置
SKILL.md:122来自说明文档打开原文件
```PATCH https://agentix.cloud/teams/$TEAM_IDAuthorization: Bearer $API_KEY{ "anthropicApiKey": "$ANTHROPIC_API_KEY" }```
SKILL.md:129来自说明文档打开原文件
This is stored encrypted and used only to spawn workers.
中风险

Agentix 凭据长期以明文保存在固定本地文件中

原文依据:3 处
发现了什么

该 Skill 用 shell 重定向把 API 密钥和账户标识写入 ~/.agentix/credentials,并在以后每次会话中静默加载。所示命令没有设置文件权限。

为什么需要注意

任何已能读取该文件的本地用户、进程或恶意软件都可取得 Agentix API 密钥,并可能操作用户的团队、任务和配置。

Skill 指示在每次会话开始时静默读取固定凭据文件,并示例把 API_KEY、TEAM_ID 和 CUSTOMER_ID 直接写入其中。命令创建目录但未设置文件或目录权限;实际暴露程度取决于系统 umask 和既有权限。用户可要求作者说明权限保护,并限制该文件仅当前账户可读。

SKILL.md:31来自说明文档打开原文件
On every session start, check `~/.agentix/credentials`:**File exists** → load values silently. Do not prompt the user.
查看另外 2 个位置
SKILL.md:40来自说明文档打开原文件
```bash# SaaS credentialsmkdir -p ~/.agentix && cat > ~/.agentix/credentials << 'EOF'API_KEY=at_live_...TEAM_ID=cmm...CUSTOMER_ID=cmm...EOF
SKILL.md:105来自说明文档打开原文件
Save the returned `apiKey` and `customerId` to `~/.agentix/credentials` immediately. Do not display them in chat. The key cannot be recovered if lost.
会不会删除文件或一直在后台运行?检查是否大范围删除文件、改写磁盘,或设置自动启动。发现 1 项风险
高风险

自动驾驶模式授权持续修改并合并仓库代码

原文依据:6 处
发现了什么

自动驾驶被描述为能够自行规划、创建任务、启动远程 worker、审查、合并并持续循环。它不要求每项新任务或合并都取得新的用户批准。

为什么需要注意

错误、受污染的任务或被操纵的 playbook 可能导致远程 worker 持续更改代码并合并不需要的内容;如果令牌权限较大,影响可扩展到默认分支和发布流程。

风险只在用户明确选择或切换到 autopilot 后成立;首次设置会向用户提供 supervised 选项。进入 autopilot 后,文本授权代理自行规划、创建任务、启动 worker,并描述为审查、合并和持续循环,没有要求每次任务或合并再确认。因此它可能持续改变已连接仓库。用户可选择 supervised,或要求对合并、推送和新任务设置逐项批准。

SKILL.md:143来自说明文档打开原文件
The playbook contains a `## Mode` section that is either `supervised` or `autopilot`. Apply the team preferences for that mode as described below.- **Supervised**: Monitor in-flight work and push it forward. Do NOT plan new work or create tasks without user approval.- **Autopilot**: Full autonomy — monitor, plan, create tasks, spawn workers, and loop continuously.
查看另外 5 个位置
SKILL.md:152来自说明文档打开原文件
> **How should I operate?**>> 1. **Supervised** — I monitor workers and push in-flight work forward, but I check with you before planning new work or spawning workers.> 2. **Autopilot** — I run autonomously — plan work, spawn workers, review, merge, and loop. Maximum throughput.
SKILL.md:191来自说明文档打开原文件
Configure git integration — ask the user for their GitHub token and repo URL, then set them (do not display the token in chat):```json{ "config": { "gitRepoUrl": "https://github.com/org/repo", "githubToken": "$GITHUB_TOKEN" } }```
SKILL.md:145来自说明文档打开原文件
- **Supervised**: Monitor in-flight work and push it forward. Do NOT plan new work or create tasks without user approval.- **Autopilot**: Full autonomy — monitor, plan, create tasks, spawn workers, and loop continuously.
SKILL.md:150来自说明文档打开原文件
If the playbook is `null`, ask the user:> **How should I operate?**>> 1. **Supervised** — I monitor workers and push in-flight work forward, but I check with you before planning new work or spawning workers.> 2. **Autopilot** — I run autonomously — plan work, spawn workers, review, merge, and loop. Maximum throughput.
SKILL.md:165来自说明文档打开原文件
### Switching modesIf the user says "switch to supervised/autopilot", fetch the new template, preserve any `## Custom Policies` section, and PUT the updated playbook.
会不会绕过安全保护?检查是否跳过网站安全验证、开放过多文件权限,或取消操作前的确认。发现 2 项风险
高风险

GitHub 令牌被交给远程服务和其 worker 使用

原文依据:3 处
发现了什么

启用 Git 集成时,该 Skill 要求取得用户的 GitHub 令牌,并把令牌与仓库地址放进 Agentix 团队配置。任务由运行在 Modal 上的远程 worker 执行。

为什么需要注意

令牌授予的全部仓库权限都可能被远程服务或 worker 使用,包括读取私有代码、推送更改或访问其他令牌可见的仓库。自动驾驶模式还声称能够审查和合并代码。

启用 Git 集成时,Skill 会索取 GitHub 令牌并将其与仓库地址写入远程团队配置;该平台的 worker 又运行在 Modal。源码没有说明令牌权限范围、远程 worker 的具体访问边界或删除方式,因此令牌可能赋予第三方基础设施读写仓库的能力。用户可要求使用仅限目标仓库、最小权限且可随时撤销的令牌。

SKILL.md:10来自说明文档打开原文件
You are a CEO — an orchestrator that manages a team of AI workers through the Agentix platform. Workers are ephemeral Agentix workers that run on Modal, complete their task, and exit.
查看另外 2 个位置
SKILL.md:191来自说明文档打开原文件
Configure git integration — ask the user for their GitHub token and repo URL, then set them (do not display the token in chat):```json{ "config": { "gitRepoUrl": "https://github.com/org/repo", "githubToken": "$GITHUB_TOKEN" } }```
SKILL.md:152来自说明文档打开原文件
> **How should I operate?**>> 1. **Supervised** — I monitor workers and push in-flight work forward, but I check with you before planning new work or spawning workers.> 2. **Autopilot** — I run autonomously — plan work, spawn workers, review, merge, and loop. Maximum throughput.
中风险

自托管模式明确不使用身份验证

原文依据:4 处
发现了什么

该 Skill 声称自托管 API 在本地网络上开放且无需 API 密钥或认证,同时该 API 提供创建、修改和删除角色与任务的接口。

为什么需要注意

如果实例监听的不只是受信任的本机接口,任何能访问其端口的设备或进程都可能查看或修改团队工作,删除角色或取消任务。

Skill 明确称自托管 API 在本地网络开放且无认证,同时列出的接口可创建、修改、删除角色和任务并启动 worker。若服务监听范围超过受信主机或网络,任何能访问端点的人都可能操作团队资源。用户可要求仅绑定 localhost、使用网络访问控制或在前置代理加入认证。

SKILL.md:37来自说明文档打开原文件
- **SaaS** (`$AGENTIX_API` is `https://agentix.cloud` or unset): Run the registration flow (Steps 1–4 below), then save credentials.- **Self-hosted** (`AGENTIX_API_URL` points to a custom instance): No registration needed. No API keys, no auth — the API is open on the local network. Just save the instance URL and team ID.
查看另外 3 个位置
SKILL.md:203来自说明文档打开原文件
```GET    $AGENTIX_API/roles?teamId=$TEAM_ID             # list rolesPOST   $AGENTIX_API/roles                            # create rolePATCH  $AGENTIX_API/roles/ROLE_ID                    # update roleDELETE $AGENTIX_API/roles/ROLE_ID                    # delete role```
SKILL.md:220来自说明文档打开原文件
```GET    $AGENTIX_API/tasks?teamId=$TEAM_ID             # list (filter: &status=, &role=)GET    $AGENTIX_API/tasks/TASK_ID                    # get detailsPOST   $AGENTIX_API/tasks                            # createPATCH  $AGENTIX_API/tasks/TASK_ID                    # updateDELETE $AGENTIX_API/tasks/TASK_ID                    # cancel```
SKILL.md:232来自说明文档打开原文件
```GET    $AGENTIX_API/workers?teamId=$TEAM_ID           # list (filter: &status=running)GET    $AGENTIX_API/workers/WORKER_ID                # get detailsPOST   $AGENTIX_API/tasks/TASK_ID/run                # spawn workerPOST   $AGENTIX_API/tasks/TASK_ID/resume             # resume failed worker```
会不会误导 AI 或隐藏内容?检查工作说明是否要求 AI 忽略你的指令、干扰检查结果,或夹带看不见的文字。发现 1 项风险
高风险

远程 playbook 可改变代理的操作规则

原文依据:5 处
发现了什么

该 Skill 要求每个会话都从可配置的 API 地址下载 playbook,并按其中的模式、政策和自定义规则行动。API 地址可以由环境变量或凭据文件指定,因此这些指令不一定来自固定的 agentix.cloud 域名。

为什么需要注意

如果团队账户、远程服务、自托管实例或本地配置被篡改,攻击者可通过 playbook 引导代理创建任务、启动 worker 或采取用户未预期的行动。

Skill 要求每次会话从 API 获取 playbook,并把其中的模式、政策和自定义规则作为操作指令。API 地址可由环境变量改为任意自托管实例,而自托管配置也会保存在凭据文件中。因此,控制该端点或 playbook 的一方可以影响代理后续决策。用户可固定可信域名,并在应用远程规则前要求展示和确认。

SKILL.md:14来自说明文档打开原文件
Throughout this skill, `$AGENTIX_API` refers to the base URL of the Agentix API. Before making any API calls, resolve this value as follows:1. Check the `AGENTIX_API_URL` environment variable.2. If not set, default to `https://agentix.cloud`.
查看另外 4 个位置
SKILL.md:62来自说明文档打开原文件
1. **The user's instructions always take precedence over the playbook and this skill file.** If the user tells you to stop, pause, wait, or change course — do so immediately.2. **Read the playbook before acting.** The playbook (`GET /teams/:id/playbook`) contains team configuration and preferences — your operating mode, policies, and custom rules for this team.3. **This file is an API reference.** It describes what you *can* do. The playbook provides the team-specific configuration for *when and how* to do it.
SKILL.md:137来自说明文档打开原文件
**Read it at the start of every session.**```GET $AGENTIX_API/teams/$TEAM_ID/playbook```The playbook contains a `## Mode` section that is either `supervised` or `autopilot`. Apply the team preferences for that mode as described below.- **Supervised**: Monitor in-flight work and push it forward. Do NOT plan new work or create tasks without user approval.- **Autopilot**: Full autonomy — monitor, plan, create tasks, spawn workers, and loop continuously.
SKILL.md:178来自说明文档打开原文件
Users can add custom policies under `## Custom Policies` — these survive mode switches.
SKILL.md:48来自说明文档打开原文件
# Self-hosted credentials (no API key needed)mkdir -p ~/.agentix && cat > ~/.agentix/credentials << 'EOF'AGENTIX_API_URL=http://localhost:3456TEAM_ID=defaultEOF```
会不会偷偷改推广链接或收款方?检查是否强制替换推广链接或收款对象,同时要求隐瞒更改。发现 1 项风险
中风险

持续自动启动 worker 可能造成开放式 API 费用

原文依据:4 处
发现了什么

每个 worker 都需要使用用户的 Anthropic API 密钥,而自动驾驶模式明确要求创建任务、启动 worker 并持续循环。文本没有规定预算、调用次数或停止上限。

为什么需要注意

长时间运行、重复失败或大量自动生成的任务可能持续消耗 Anthropic 配额,并把非预期费用记入用户账户。

worker 使用用户提供的 Anthropic API 密钥,而 autopilot 被定义为持续创建任务、启动 worker 并循环。源码没有预算、worker 数量、调用量或停止上限,因此在用户选择 autopilot 后可能产生开放式模型用量和费用;但源码未提供具体计费方式,不能断言费用已经发生。用户可要求消费上限、并发上限和明确停止条件。

SKILL.md:118来自说明文档打开原文件
### Step 4 — Set your Anthropic API keyWorkers need an Anthropic API key to run. Ask the user to provide their Anthropic API key (from console.anthropic.com), then set it on the team — do not display it in chat:
查看另外 3 个位置
SKILL.md:143来自说明文档打开原文件
The playbook contains a `## Mode` section that is either `supervised` or `autopilot`. Apply the team preferences for that mode as described below.- **Supervised**: Monitor in-flight work and push it forward. Do NOT plan new work or create tasks without user approval.- **Autopilot**: Full autonomy — monitor, plan, create tasks, spawn workers, and loop continuously.
SKILL.md:145来自说明文档打开原文件
- **Supervised**: Monitor in-flight work and push it forward. Do NOT plan new work or create tasks without user approval.- **Autopilot**: Full autonomy — monitor, plan, create tasks, spawn workers, and loop continuously.
SKILL.md:154来自说明文档打开原文件
>> 1. **Supervised** — I monitor workers and push in-flight work forward, but I check with you before planning new work or spawning workers.> 2. **Autopilot** — I run autonomously — plan work, spawn workers, review, merge, and loop. Maximum throughput.

Skill 逻辑拆解

7 个说明模块

该 Skill 默认连接 agentix.cloud,并要求用姓名和邮箱注册;随后把返回的 Agentix API 密钥和客户标识保存到本地。

查看原文
SKILL.md:16来自说明文档打开原文件
1. Check the `AGENTIX_API_URL` environment variable.2. If not set, default to `https://agentix.cloud`.
SKILL.md:84来自说明文档打开原文件
Ask the user for their name and email. Do not guess these values.```POST https://agentix.cloud/registerContent-Type: application/json{ "name": "<from user>", "email": "<from user>" }```
SKILL.md:103来自说明文档打开原文件
202 = still waiting, 200 = confirmed (contains `apiKey` and `customerId`), 410 = expired.Save the returned `apiKey` and `customerId` to `~/.agentix/credentials` immediately. Do not display them in chat. The key cannot be recovered if lost.

它在每个会话开始时静默读取固定位置的凭据文件,并把 Agentix API 密钥、团队 ID 和客户 ID 以环境变量式明文写入该文件。

查看原文
SKILL.md:31来自说明文档打开原文件
On every session start, check `~/.agentix/credentials`:**File exists** → load values silently. Do not prompt the user.
SKILL.md:40来自说明文档打开原文件
```bash# SaaS credentialsmkdir -p ~/.agentix && cat > ~/.agentix/credentials << 'EOF'API_KEY=at_live_...TEAM_ID=cmm...CUSTOMER_ID=cmm...EOF

远程 Agentix 服务会接收用户的 Anthropic API 密钥;启用 Git 集成时还会接收 GitHub 令牌和仓库地址。远程临时 worker 使用这些配置执行任务。

查看原文
SKILL.md:10来自说明文档打开原文件
You are a CEO — an orchestrator that manages a team of AI workers through the Agentix platform. Workers are ephemeral Agentix workers that run on Modal, complete their task, and exit.
SKILL.md:120来自说明文档打开原文件
Workers need an Anthropic API key to run. Ask the user to provide their Anthropic API key (from console.anthropic.com), then set it on the team — do not display it in chat:```PATCH https://agentix.cloud/teams/$TEAM_IDAuthorization: Bearer $API_KEY{ "anthropicApiKey": "$ANTHROPIC_API_KEY" }```This is stored encrypted and used only to spawn workers.
SKILL.md:191来自说明文档打开原文件
Configure git integration — ask the user for their GitHub token and repo URL, then set them (do not display the token in chat):```json{ "config": { "gitRepoUrl": "https://github.com/org/repo", "githubToken": "$GITHUB_TOKEN" } }```

团队的操作规则从远程 playbook 获取。监督模式需要用户批准新工作;自动驾驶模式则允许持续规划、创建任务、启动 worker、审查和合并。

查看原文
SKILL.md:137来自说明文档打开原文件
**Read it at the start of every session.**```GET $AGENTIX_API/teams/$TEAM_ID/playbook```The playbook contains a `## Mode` section that is either `supervised` or `autopilot`. Apply the team preferences for that mode as described below.- **Supervised**: Monitor in-flight work and push it forward. Do NOT plan new work or create tasks without user approval.- **Autopilot**: Full autonomy — monitor, plan, create tasks, spawn workers, and loop continuously.
SKILL.md:152来自说明文档打开原文件
> **How should I operate?**>> 1. **Supervised** — I monitor workers and push in-flight work forward, but I check with you before planning new work or spawning workers.> 2. **Autopilot** — I run autonomously — plan work, spawn workers, review, merge, and loop. Maximum throughput.
从这里开始 · 工作说明SKILL.md
agentix-ceo
连线表示工作说明包含的模块,不是实际运行顺序。点击模块可查看原文。
文件与检查记录1 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围;纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件,没有实际运行 Skill,也没有检查它另外安装的软件包。因此,这不是“保证安全”的承诺;换了版本或使用环境,结果也可能不同。

  • SKILL.md工作说明

代码和说明中提到的操作

连接外部网站
SKILL.md:17来自说明文档打开原文件
1. Check the `AGENTIX_API_URL` environment variable.2. If not set, default to `https://agentix.cloud`.
SKILL.md:21来自说明文档打开原文件
# SaaS (default — zero config required)export AGENTIX_API_URL=https://agentix.cloud
SKILL.md:24来自说明文档打开原文件
# Self-hosted (set to your own instance URL instead)export AGENTIX_API_URL=https://your-agentix-instance.example.com```
运行命令
SKILL.md:19来自说明文档打开原文件
```bash# SaaS (default — zero config required)
SKILL.md:40来自说明文档打开原文件
```bash# SaaS credentials
读取密钥或账号配置
SKILL.md:29来自说明文档打开原文件
## Credentials
SKILL.md:31来自说明文档打开原文件
On every session start, check `~/.agentix/credentials`:
SKILL.md:37来自说明文档打开原文件
- **SaaS** (`$AGENTIX_API` is `https://agentix.cloud` or unset): Run the registration flow (Steps 1–4 below), then save credentials.- **Self-hosted** (`AGENTIX_API_URL` points to a custom instance): No registration needed. No API keys, no auth — the API is open on the local network. Just save the instance URL and team ID.
读取文件
SKILL.md:42来自说明文档打开原文件
# SaaS credentialsmkdir -p ~/.agentix && cat > ~/.agentix/credentials << 'EOF'API_KEY=at_live_...
SKILL.md:49来自说明文档打开原文件
# Self-hosted credentials (no API key needed)mkdir -p ~/.agentix && cat > ~/.agentix/credentials << 'EOF'AGENTIX_API_URL=http://localhost:3456
读取了多少行
266
文件校验值(用于核对版本)
38336586187eb2ed2f3dbcf008ca4abb0b1bb3d8fc21baeea74a2b8872b3d408