T09 · Insecure Skill Coding Practices
Error
- Location
client/src/solana/index.js:274- Finding
Incorrect SPL Token Decimal Conversion Can Cause 1,000× Overpayment
- Content
View full analysis
- Remediation
View remediation
Security audit
Bob P2P - Beta
Security checks for vulnerabilities and agentic risk
Overview
This skill matches its marketplace purpose, but it handles real wallet secrets and payments in ways that could expose funds or cause unintended spending.
Review carefully before installing. Use only a dedicated low-balance wallet, avoid storing a primary wallet mnemonic/private key in this client, confirm exact recipient and price out of band before calls, and treat downloaded provider results as untrusted. The skill should add safer secret storage, payment confirmation and spending limits, fixed token amount handling, path containment for downloads, endpoint authorization, and a reproducible dependency lockfile before ordinary use.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
client/src/consumer/index.js:243- Finding
Remote Provider Data Controls Automatic Cryptocurrency Payments Without Price Authorization
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
client/src/consumer/index.js:157- Finding
Provider-Controlled Result Filename Allows Arbitrary File Overwrite
- Content
View full analysis
{ writer.on('finish', resolve); writer.on('error', reject); }); } /** * Download job result file via P2P streaming * * @param {string} providerUrl - Provider endpoint * @param {string} jobId - Job identifier * @param {string} resultFilename - Result filename * @returns {Promise} - Local file path */ async downloadJobResult(providerUrl, jobId, resultFilename) { const downloadUrl = `${providerUrl}/job/${jobId}/download`; const localPath = path.join(this.outputPath, resultFilename); console.log(`Downloading result from provider via P2P...`); await this.downloadResult(downloadUrl, localPath); console.log(`Result saved to: ${localPath}`); return localPath; } ``` The remote filename is consumed automatically after polling: ```js if (completedJob.resultFilename && this.outputPath) { console.log('\nStep 5: Downloading result file...'); const localFilePath = await this.downloadJobResult( providerUrl, completedJob.jobId, completedJob.resultFilename ); completedJob.localFilePath = localFilePath; } ``` ### Technical Analysis `resultFilename` originates in the remote provider's job-status response. It is passed directly to `path.join()` without rejecting absolute paths, path separators, or `..` traversal components. `path.join()` normalizes traversal but does not guarantee that the resulting path remains inside `this.outputPath`. `fs.createWriteStream()` then creates or ...[truncated 1171 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.sh:143- Finding
Wallet Mnemonic Is Entered Visibly and Stored Without Enforced Restrictive Permissions
- Content
View full analysis
" PRIVATE_KEY if [ -n "$WALLET_ADDRESS" ] && [ -n "$PRIVATE_KEY" ]; then cat > "$CONFIG_FILE" << CONFIGEOF { "wallet": { "address": "$WALLET_ADDRESS", "privateKey": "$PRIVATE_KEY" ``` The configuration script repeats the same pattern: ```bash read -p "Wallet address: " WALLET_ADDRESS echo "Private key (mnemonic or key):" read -p "> " PRIVATE_KEY if [ -n "$WALLET_ADDRESS" ] && [ -n "$PRIVATE_KEY" ]; then # Create new config preserving other settings RESULTS_PATH="$HOME/.bob-p2p/results" cat > "$CONFIG_FILE" << CONFIGEOF { "wallet": { "address": "$WALLET_ADDRESS", "privateKey": "$PRIVATE_KEY" ``` ### Technical Analysis The private key or mnemonic is collected with ordinary `read`, so terminal echo remains enabled. The secret can be exposed through shoulder surfing, screen sharing, terminal recording, or session-capture tooling. The scripts then store the complete secret in plaintext JSON. They do not set `umask 077`, use a secure secret store, or explicitly apply `chmod 600`. File readability therefore depends on the user's ambient umask and environment. A mnemonic provides control over the derived wallet and is substantially more sensitive than an ordinary API credential. ### Attack Path 1. A user follows the documented setup or reconfiguration process. 2. The user types a wallet mnemonic or private key into an echoed prompt. 3. The secret may be captured by observers or terminal-recording systems. 4. The script writes the secret to `~/.bob-p2p/client/config.json`. 5. If file permissions permit access, another lo ...[truncated 491 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
client/src/provider/server.js:186- Finding
Job Results and Generated Files Are Exposed Without Consumer Authorization
- Content
View full analysis
{ try { const { jobId } = req.params; const job = await this.jobs.getJob(jobId); res.json({ jobId: job.jobId, apiId: job.apiId, status: job.status, progress: job.progress, progressMessage: job.progressMessage, result: job.result, resultFilename: job.resultFilename, error: job.error, createdAt: job.createdAt, startedAt: job.startedAt, completedAt: job.completedAt }); } catch (error) { res.status(404).json({ error: error.message }); } }); // Download job result file (P2P streaming) this.app.get('/job/:jobId/download', async (req, res) => { try { const { jobId } = req.params; const job = await this.jobs.getJob(jobId); if (job.status !== 'completed') { return res.status(400).json({ error: 'Job not completed yet' }); } if (!job.resultFilename) { return res.status(404).json({ error: 'No result file available for this job' }); } const filepath = path.join(this.jobs.resultStorage, job.resultFilename); if (!fs.existsSync(filepath)) { return res.status(404).json({ error: 'Result file not found on disk' }); } // Stream the file to consumer res.sendFile(filepath); } catch (error) { res.status(404).json({ error: error.message }); } }); ``` ### Technical Analysis The provider retrieves jobs solely by `jobId`. Neither endpoint authenticate ...[truncated 1219 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/setup.sh:77- Finding
Setup Installs Mutable Dependencies Without a Lockfile
- Content
View full analysis
/dev/null || npm install ``` The dependency manifest uses mutable version ranges, including: ```json "dependencies": { "@chainsafe/libp2p-noise": "^17.0.0", "@libp2p/bootstrap": "^12.0.11", "@libp2p/circuit-relay-v2": "^4.1.3", "@solana/spl-token": "^0.3.9", "@solana/web3.js": "^1.87.6", "axios": "^1.6.0", "better-sqlite3": "^12.6.2", "express": "^4.18.2", "libp2p": "^3.1.3", "mongodb": "^6.3.0", "pg": "^8.11.3", "tedious": "^16.6.1" } ``` No dependency lockfile was present in the audited project structure. ### Technical Analysis `npm install` resolves dependency and transitive-dependency versions at installation time. Because the manifest uses caret ranges and no reviewed lockfile is included, two users can receive different package versions. NPM lifecycle scripts may execute during installation. A compromised package release or dependency account can therefore execute code under the user running `scripts/setup.sh`, even though that package version was not part of the audited artifact. No malicious dependency was proven during this static audit; the issue is the unsafe and non-reproducible installation model. ### Attack Path 1. A direct or transitive dependency publisher account is compromised, or a malicious release is published within an allowed version range. 2. A user runs `scripts/setup.sh`. 3. `npm install` resolves the newly published version because no lockfile constrains the dependency graph. 4. The package's lifecycle script executes with the user's privileges. 5. The malicious package can access user files, including the plai ...[truncated 403 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (93)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill asks users to store a wallet private key or mnemonic locally and run setup/configuration scripts, while presenting itself as a marketplace client. Even if that behavior matches the intended design, collecting high-value crypto secrets into a local config file materially increases theft risk and is more dangerous in a skill that also performs shell and network actions.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh echo "" # Fetch and pretty-print RESULT=$(curl -s "$AGGREGATOR/api/$API_ID") # Try python, then node, then raw output if command -v python3 &> /dev/null; then
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script prompts for a wallet private key and writes it directly into config.json in plaintext under the user's home directory, with no warning, encryption, or permission hardening. In the context of a Solana/$BOB marketplace client, compromise of this file can directly enable theft of funds, unauthorized transactions, and impersonation of the user on the network.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The setup script interactively prompts for a Solana private key or mnemonic and writes it directly into config.json in plaintext under the user's home directory. This is dangerous because wallet secrets can be exposed through local file compromise, backups, shell observation/shoulder-surfing, or accidental disclosure, leading to theft of on-chain funds and unauthorized transactions. The skill context increases risk because this wallet is intended to hold and spend real Solana-based assets on mainnet.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill instructs users to run shell scripts and perform network operations, but it declares no explicit tool scope or permission boundaries. In an agent environment, missing scope metadata increases the chance that the skill can be invoked with broader-than-expected shell/network access and makes review and enforcement harder.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 76% confidence
- Finding
The setup flow creates persistent local configuration and prompts for wallet configuration, which implies session persistence of sensitive operational state. In this context, persistence becomes risky because the stored state includes or may lead to storing cryptocurrency credentials and long-lived connectivity settings that survive beyond the immediate task.
- Content
md This will: 1. Clone the bob-p2p-client repository 2. Install Node.js dependencies 3. Create config from template 4. Prompt you for wallet configuration ### Manual Setup
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The setup instructions tell users to place a Solana wallet private key or mnemonic directly into config.json, but the immediate step lacks a clear warning that this stores highly sensitive credentials in plaintext. Plaintext seed phrase storage makes wallet compromise much more likely through filesystem exposure, backups, logs, malware, or accidental commits.
- Content
Static analysis
No suspicious patterns detected.