Ox Agent Identity

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:09 PM UTC
• Version: 1.0.0

Overview

This skill is coherent for blockchain identity work, but it asks users to run live on-chain write commands with raw private keys and includes unsafe installer guidance.

Review before installing. Use only testnets or low-value dedicated wallets, avoid pasting production private keys into environment variables or command arguments, prefer encrypted keystores or hardware/signing services, verify the registry address and chain before any write, and install Foundry from reviewed official instructions rather than piping a remote script directly into bash.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:21

Finding

Unverified Remote Installer Is Piped Directly into Bash

Content

View full analysis

Vulnerability Details

File Location: README.md:18-22
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Vulnerable Code:

bash

# Install Foundry
curl -L https://foundry.paradigm.xyz | bash
foundryup

Technical Analysis

The installation instructions download mutable content from an external URL and immediately pass it to Bash. The -L option follows redirects, and neither the original response nor any redirected payload is pinned to a version or verified using a cryptographic signature or checksum.

Foundry is a legitimate prerequisite for the declared blockchain functionality, and the referenced domain appears related to the official project. However, installing it through an unverified curl | bash pipeline is not required for the Skill to perform ERC-8004 operations and exceeds the minimum safe installation behavior. The effective code can change after this Skill has been reviewed.

This creates a remote code-execution channel. Compromise of the hosting service, deployment pipeline, domain, DNS resolution, TLS infrastructure, or redirect destination could cause arbitrary attacker-controlled shell commands to execute under the invoking user's account.

Attack Path

1. An attacker compromises the remote installer endpoint, its release infrastructure, or a redirect destination.
2. The attacker replaces the expected installer response with a malicious shell script.
3. A user follows the README and runs the documented command.
4. curl downloads the attacker's current response and follows any supplied redirects.
5. Bash executes the response without inspection, signature verification, checksum validation, or version pinning.
6. The payload can access resources available to the user, including files, credentials, wallet material, shell configuration, and network services.

Impact Assessment

Successful exploitation provides arbitrary comm ...[truncated 661 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | bash pipeline from the installation instructions.
2. Direct users to Foundry's official installation documentation and security guidance.
3. Prefer a trusted operating-system package manager or an official release artifact pinned to a specific version.
4. Download the artifact separately rather than executing it from a pipe.
5. Verify a publisher-provided cryptographic signature or a SHA-256 checksum obtained through an independent trusted channel.
6. Inspect the downloaded installer before execution and run it without elevated privileges.
7. Document the exact expected domain, version, checksum, and redirect behavior.
8. Where practical, allow users to provide an existing cast binary instead of making installation part of the Skill workflow.

A safer conceptual workflow is:

bash

curl --fail --show-error --location --output foundry-installer \
  "https://official.example/pinned/foundry-installer"

echo "EXPECTED_SHA256  foundry-installer" | sha256sum --check -
less foundry-installer
bash foundry-installer

The actual URL and checksum must come from a verified official release and be pinned to the intended version.

T09 · Insecure Skill Coding Practices

Error

• Location: README.md:42

Finding

Wallet Private Keys Are Passed Through Environment Variables and Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Locations: README.md:25-27, README.md:38-42, SKILL.md:26-29, SKILL.md:35-41, SKILL.md:61-66, and SKILL.md:80-85
Vulnerability Type: Insecure handling of blockchain signing credentials
Risk Level: High

Vulnerable Code from README.md:25-27:

bash

# Set environment variables
export AGENT_REGISTRY_ADDRESS="0x..."      # ERC-8004 registry on your chain
export WEB3_RPC_URL="https://eth-mainnet.alchemy.io/..."  # or ETH_RPC_URL
export AGENT_WALLET_PRIVATE_KEY="0x..."    # for write transactions

Vulnerable Code from README.md:38-42:

bash

# Register an agent
cast send $AGENT_REGISTRY_ADDRESS "register((string,string,bytes32,uint256))" \
  '("MyAgent","v1.0",0x...,1710000000)' \
  --rpc-url $WEB3_RPC_URL --private-key $AGENT_WALLET_PRIVATE_KEY

Vulnerable Code from SKILL.md:26-29:

bash

export AGENT_REGISTRY_ADDRESS="0x..."      # ERC-8004 registry address
export WEB3_RPC_URL="https://eth-mainnet.alchemy.io/..."  # or ETH_RPC_URL
export AGENT_WALLET_PRIVATE_KEY="0x..."    # for write transactions

Vulnerable Code from SKILL.md:35-41:

bash

cast send $AGENT_REGISTRY_ADDRESS \
  "register((string,string,bytes32,uint256))" \
  '("MyAgent","v1.0",0x...,1710000000)' \
  --rpc-url $WEB3_RPC_URL \
  --private-key $AGENT_WALLET_PRIVATE_KEY

Vulnerable Code from SKILL.md:61-66:

bash

cast send $AGENT_REGISTRY_ADDRESS \
  "updateReputation(address,uint256)" \
  $AGENT_ADDRESS 85 \
  --rpc-url $WEB3_RPC_URL \
  --private-key $VALIDATOR_PRIVATE_KEY

Vulnerable Code from SKILL.md:80-85:

bash

cast send $AGENT_REGISTRY_ADDRESS \
  "addAttestation(address,bytes)" \
  $AGENT_ADDRESS $SIGNATURE \
  --rpc-url $WEB3_RPC_URL \
  --private-key $ATTESTER_PRIVATE_KEY

Technical Analysis

The documentation instructs users to export a plaintext private key and exp ...[truncated 2541 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove examples that pass raw private keys through --private-key.
2. Use Foundry's encrypted keystore support or another secure signer integration.
3. Prefer hardware wallets, smart-account signers, or isolated signing services for privileged validator and attester operations.
4. Prompt for keystore passwords interactively rather than storing them in exported environment variables or command history.
5. Do not export plaintext private keys into a general shell environment.
6. Disable shell tracing before any operation involving sensitive values and ensure CI systems redact secrets.
7. Assign separate keys to agent, validator, and attester roles, each with only the required on-chain permissions.
8. Use low-value, testnet-only accounts while testing and require explicit human confirmation before mainnet writes.
9. Document immediate key rotation, permission revocation, and fund migration procedures for suspected exposure.
10. Avoid placing secrets in command substitution, configuration files with broad permissions, shell history, or process arguments.

The documentation should use an encrypted account reference rather than a raw key, for example:

bash

cast send "$AGENT_REGISTRY_ADDRESS" \
  "register((string,string,bytes32,uint256))" \
  '("MyAgent","v1.0",0x...,1710000000)' \
  --rpc-url "$WEB3_RPC_URL" \
  --account agent-identity

The exact signer option should be verified against the installed Foundry version. The referenced account should be backed by an encrypted keystore or hardware signer with restrictive local permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The README instructs users to execute curl -L https://foundry.paradigm.xyz | bash, which downloads remote content and immediately executes it without prior verification. If the remote host, transport, DNS, or upstream distribution path is compromised, users could run arbitrary attacker-controlled code on their machine.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

bash

# Install Foundry
curl -L https://foundry.paradigm.xyz | bash
foundryup

# Set environment variables

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | bash construction is itself dangerous because it turns fetched network data directly into executable shell input, removing any opportunity for review or validation. In the context of a developer skill that also asks for wallet private keys and blockchain tooling, arbitrary code execution could directly lead to credential theft, wallet compromise, or broader system access.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

bash

# Install Foundry
curl -L https://foundry.paradigm.xyz | bash
foundryup

# Set environment variables

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes blockchain identity-management functionality centered on ERC-8004 agent registration and attestations. The actual code performs only local static validation of a markdown file's formatting/content constraints. It does not interact with a blockchain, registry, attestations, wallets, smart contracts, or any external identity system. This is a clear material mismatch in primary purpose and capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README provides a cast send example using a private key, which will broadcast a real state-changing transaction, but it does not clearly warn users about gas costs, irreversible on-chain effects, or the risk of using a funded key in copy-pasted commands. In a blockchain skill focused on identity registration and reputation updates, this omission is materially risky because users may treat the example as harmless documentation rather than an operation with financial and trust consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill provides a live cast send example using a private key for agent registration without clearly warning that this submits a real blockchain transaction, consumes funds, and creates an irreversible on-chain state change. In an agent skill context, this is dangerous because users or downstream agents may execute examples verbatim against mainnet with sensitive credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The reputation update example performs a privileged write using a validator private key but does not prominently warn about the sensitivity of validator credentials or the consequences of modifying another agent's reputation on-chain. If executed carelessly, this could cause unauthorized or mistaken trust-score changes, reputational harm, and key exposure risk in a high-trust governance/DeFi setting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The attestation submission example sends signed data on-chain without explicitly warning that attestations become persistent, publicly visible records and may disclose sensitive or reputation-affecting information. In this skill's identity and trust context, accidental publication can have lasting privacy, compliance, and operational consequences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.