Fund

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:34 PM UTC
• Version: 0.1.0

Overview

This wallet funding skill is coherent, but it should be reviewed because it runs an unpinned npm wallet tool in a real-money funding flow with broad invocation triggers.

Install only if you trust the awal npm package and are comfortable with a skill that can open a USDC funding flow. Before sending funds, independently verify the wallet address and expect Coinbase/payment-provider fees, identity checks, regional restrictions, and settlement delays. A safer version would pin the CLI version and require explicit confirmation before launching funding or showing deposit instructions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Unpinned npm Package Execution in a Cryptocurrency Wallet Workflow

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6–66
Vulnerability Type: Unpinned third-party dependency executed at runtime
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: ["Bash(npx awal@latest status*)", "Bash(npx awal@latest show*)", "Bash(npx awal@latest address*)", "Bash(npx awal@latest balance*)"]

bash

npx awal@latest status
npx awal@latest show
npx awal@latest address
npx awal@latest balance

Technical Analysis

The Skill repeatedly invokes awal@latest through npx. The latest npm distribution tag is mutable, so these commands may download and execute package code that differs from the version present when the Skill was audited. The project does not specify an exact package version, integrity hash, lockfile, reviewed local implementation, or other mechanism that guarantees reproducible execution.

Because npx can retrieve and execute the package at runtime, compromise of the package publisher, npm account, package ownership, or release process could turn an otherwise legitimate command into arbitrary code execution. This risk is especially significant because the commands interact with a cryptocurrency wallet, expose its public address and balance, and open a funding interface.

The trailing command wildcards in allowed-tools also broaden the accepted command patterns. Although the documented commands contain no attacker-controlled arguments, narrower exact command authorization would better enforce least privilege.

Attack Path

1. An attacker compromises the npm publisher account, package ownership, or release pipeline for awal.
2. The attacker publishes a malicious release and assigns it to the mutable latest distribution tag.
3. The Agent invokes one of the documented commands, such as npx awal@latest show.
4. npx retrieves and executes the attacker-controlled package version with the Agent process's operating-system privileges.
5. The malicious package can inspect accessible ...[truncated 1101 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace awal@latest with an exact, reviewed version, for example awal@X.Y.Z.
2. Install the dependency through a controlled deployment process rather than downloading it during Skill execution.
3. Commit and enforce a lockfile containing registry-resolved integrity hashes.
4. Verify npm package ownership, provenance attestations, release signatures, and publisher account protections.
5. Mirror or vendor the reviewed package in a trusted internal repository where practical.
6. Run the wallet tooling in a restricted sandbox with minimal filesystem, environment-variable, and network access.
7. Restrict allowed-tools to exact required commands and remove trailing wildcards unless arguments are operationally necessary.
8. Require explicit user confirmation before displaying deposit addresses, opening payment interfaces, or initiating financially sensitive operations.
9. Re-audit the dependency before upgrading and use automated supply-chain monitoring to detect ownership changes or unexpected releases.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The fourth manifest npx awal@latest entry repeats the same vulnerability and broadens exposure across multiple wallet operations. Because the commands are part of a funding skill, compromise could affect deposit addresses, authentication state, UI launch behavior, and balance reporting in ways that directly impact funds.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description uses broad triggers like 'fund', 'buy USDC', 'get USDC', and insufficient-balance scenarios, which can cause the agent to invoke a money-movement workflow in response to common conversational cues. In context, that increases the chance of unintended financial guidance or opening a purchase flow when the user did not clearly request a transaction.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The Bash(npx awal@latest balance*) allowance has the same supply-chain risk as the other tool entries because it resolves to the latest published package each time. In a wallet-related skill, compromise of the dependency could misreport balances, phish via UI prompts, or run arbitrary code in the agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill guides users into purchasing USDC through a third-party onramp without prominent warnings that this is a real financial transaction involving external payment processing, fees, regional restrictions, and identity/compliance steps. In a wallet funding context, the absence of clear transactional disclosure can lead to user confusion, social engineering opportunities, or unintentional purchases.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The command example npx awal@latest status instructs execution of an unpinned npm package. Because this skill concerns wallet authentication and funding, a compromised upstream release could intercept wallet state, alter prompts, or execute arbitrary code under the guise of a benign status check.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill tells the agent to run npx awal@latest show, which dynamically fetches and executes the newest package version before opening the funding interface. In a transaction-oriented flow, this increases the chance of UI spoofing, redirection to fraudulent onramp pages, or arbitrary code execution if the package is hijacked.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The alternative funding path exposes npx awal@latest address, again relying on a mutable upstream dependency. A malicious or compromised release could return attacker-controlled deposit addresses, directly enabling theft of funds intended for the user's wallet.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The prerequisites section references npx awal@latest status, preserving the same unpinned execution risk in a critical wallet context. Repetition throughout the skill normalizes unsafe runtime package resolution and increases the likelihood that operators will execute a compromised release without noticing.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The flow explicitly instructs npx awal@latest show during the user funding path, making the unsafe dependency resolution part of the primary transaction workflow. That context materially increases risk because any compromise can affect real-money actions, payment instructions, and user trust decisions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The balance-check command npx awal@latest balance introduces the same supply-chain execution risk after funding. In a financial skill, compromised balance output could conceal theft, fabricate successful deposits, or steer users into repeated funding attempts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.