Security audit

Find Trusted On-Chain Agents

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent 8K4 API helper, but its bundled live-send wrapper has unsafe request construction and authentication handling that deserves review before use.

Review this before installing if you plan to use the script for contact, dispatch, paid x402 lookups, metadata updates, or key generation. Prefer dry-run for contact/dispatch, do not send secrets or proprietary task text, confirm any payment/write/signature step manually, and treat wallet addresses and signatures as sensitive. The bundled Bash helper should be fixed or wrapped before routine use because malformed or attacker-influenced arguments can change the authenticated request body and the API key handling is fragile.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/8k4.sh:173
Finding: Unescaped User Input Allows JSON Request-Body Injection
Content: View full analysis
--task '...' [--chain C] [--dry-run]"; exit 1; } ID="$1"; shift parse_flags "$@" [[ -z "$TASK" ]] && { echo "Error: --task is required"; exit 1; } SEND=$( [[ "$DRY_RUN" == "true" ]] && echo "false" || echo "true" ) BODY=$(cat <
Remediation: View remediation
&2 exit 1 } ``` Additional hardening should include: 1. Allowlist `CHAIN` to `eth`, `base`, or `bsc`. 2. Enforce documented bounds for numeric values such as `max`. 3. Reject missing values for flags instead of reading an absent `$2`. 4. Make dry-run the default for contact and dispatch, requiring an explicit live-send option. 5. Present the serialized request for confirmation before a live external action when task text originates from an untrusted source. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/8k4.sh:43
Finding: Unsafe Authentication Header Expansion Exposes the API Key and Permits Curl Argument Injection
Content: View full analysis
``` is not preserved reliably. The space following the colon causes the header value and key to be split into separate arguments. A typical invocation can therefore pass an empty `X-API-Key:` header while treating the key as another curl argument or URL. If the environment variable contains whitespace and curl options, those tokens can be interpreted as curl arguments. For example, an attacker capable of influencing `EIGHTK4_API_KEY` could inject proxy, output, URL, or other curl options. Although control of the process environment is a prerequisite, safely handling secret-bearing environment variables is still required. The API key also appears directly in curl's command-line argument vector. On systems where process arguments are observable by other users or monitoring software, this can disclose the credential while the request is active. ### Attack Path 1. The script reads `EIGHTK4_API_KEY` into `API_KEY`. 2. `auth_header` prints the secret together with curl syntax. 3. Unquoted command substitution p ...[truncated 1467 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented purpose does not fully match the behavior described in the file, including mention of additional capabilities such as key info retrieval and health/stats access. Capability drift weakens operator understanding and review quality, which can lead to users invoking the skill in contexts they did not intend or approve.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes shell-based network operations via curl but declares no explicit tool scope or allowed-tools boundary. That makes it easier for a host agent to grant broader execution than necessary and increases the chance of unintended command execution or outbound requests under ambient permissions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The invocation guidance is very broad ('use when checking... finding... viewing... fetching... contacting... reading/updating...'), which encourages over-triggering in many user contexts. Broad trigger language increases the chance the host agent will activate a networked skill and transmit user-supplied identifiers, wallet data, or task content without a narrowly scoped need.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This endpoint sends agent identifiers and authentication material to an external service for trust evaluation. In context, external transmission is expected for the skill's purpose, but it still creates privacy, metadata leakage, and third-party dependency risk if user or organizational data is queried without clear consent.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
Use /score/explain first for “can I trust this agent?” style questions.

bash
curl -s -H "X-API-Key: $EIGHTK4_API_KEY" \ "https://api.8k4protocol.com/agents/{agent_id}/score/explain?chain=eth"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
bash
curl -s -H "X-API-Key: $EIGHTK4_API_KEY" \ "https://api.8k4protocol.com/agents/{agent_id}/score/explain?chain=eth"

Use /score for a compact read.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
bash
curl -s -H "X-API-Key: $EIGHTK4_API_KEY" \ "https://api.8k4protocol.com/agents/{agent_id}/score/explain?chain=eth"

Use /score for a compact read.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 87% confidence
Finding: This request transmits agent identifiers and an API key to an external trust-scoring service. The behavior is aligned with the skill's function, but it still poses confidentiality and auditability concerns if invoked automatically or with sensitive identifiers.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
bash
curl -s -H "X-API-Key: $EIGHTK4_API_KEY" \ "https://api.8k4protocol.com/agents/{agent_id}/score?chain=eth"

2) Find agents

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: Search requests can transmit user task intent and filtering criteria to a third-party service, which may reveal business interests, hiring plans, or operational goals. Because the query text is free-form, the skill context makes prompt-derived data leakage more plausible if the agent passes user text directly.
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
bash
curl -s -H "X-API-Key: $EIGHTK4_API_KEY" \ "https://api.8k4protocol.com/agents/search?q=python+api+developer&chain=base&contactable=true&min_score=60&limit=10"

If empty, relax in this order:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: Profile lookups can disclose agent IDs plus optional task context (q) to an external service. The optional task context increases sensitivity because it may contain proprietary or identifying information beyond what is needed for a simple profile fetch.
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
bash
curl -s -H "X-API-Key: $EIGHTK4_API_KEY" \ "https://api.8k4protocol.com/agents/{agent_id}/card?chain=base&q=optional+task+context"

Useful follow-ups:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: Validation lookups send agent identifiers to a third-party endpoint and may also hit paid/x402 flows, creating both privacy and billing risk. The skill notes x402 concerns elsewhere, but this request still enables external disclosure and possibly monetized access to relationship or reputation data.
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
bash
curl -s -H "X-API-Key: $EIGHTK4_API_KEY" \ "https://api.8k4protocol.com/agents/{agent_id}/validations?chain=base&limit=10" curl -s -H "X-API-Key: $EIGHTK4_API_KEY" \ "https://api.8k4protocol.com/wallet/{wallet}/agents?chain=eth"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: Wallet-to-agent lookups transmit wallet addresses to an external service, linking on-chain identities to external query logs. This is especially sensitive because wallet addresses are durable identifiers and can expose behavioral or organizational associations when queried at scale.
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
"https://api.8k4protocol.com/agents/{agent_id}/validations?chain=base&limit=10" curl -s -H "X-API-Key: $EIGHTK4_API_KEY" \ "https://api.8k4protocol.com/wallet/{wallet}/agents?chain=eth" curl -s -H "X-API-Key: $EIGHTK4_API_KEY" \ "https://api.8k4protocol.com/wallet/{wallet}/score?chain=eth"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: Wallet scoring sends a durable wallet identifier to a third-party service, creating a privacy and profiling risk similar to other identity enrichment APIs. In the skill context this is expected functionality, but the sensitivity is elevated because the service can infer interest in or association with specific wallets.
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
"https://api.8k4protocol.com/wallet/{wallet}/agents?chain=eth" curl -s -H "X-API-Key: $EIGHTK4_API_KEY" \ "https://api.8k4protocol.com/wallet/{wallet}/score?chain=eth" curl -s -H "X-API-Key: $EIGHTK4_API_KEY" \ "https://api.8k4protocol.com/identity/{global_id}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: Identity lookups send a global identity identifier to an external service, potentially exposing cross-platform linkage information. Such identifiers can be more sensitive than a simple agent ID because they may unify multiple records or personas.
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
"https://api.8k4protocol.com/wallet/{wallet}/score?chain=eth"

curl -s -H "X-API-Key: $EIGHTK4_API_KEY"
"https://api.8k4protocol.com/identity/{global_id}"

text
### 4) Contact / dispatch

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The contact endpoint performs a live POST with user task content and send: true, which can actively transmit prompts or work requests to external agents. This is more dangerous than passive lookup because it can leak confidential task details, trigger outbound actions, and create real-world operational effects if the host agent invokes it without strict confirmation.
Content: Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.
md
curl -s -X POST -H "X-API-Key: $EIGHTK4_API_KEY" \ -H "Content-Type: application/json" \ -d '{"task": "Review this smart contract", "chain": "base", "send": true}' \ "https://api.8k4protocol.com/agents/{agent_id}/contact" curl -s -X POST -H "X-API-Key: $EIGHTK4_API_KEY" \ -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The dispatch endpoint broadcasts a task to up to multiple agents with send: true, amplifying the exposure of potentially sensitive content and increasing the chance of unintended downstream actions. Because it routes work externally at scale, the impact is higher than simple metadata retrieval and can include privacy breaches, unwanted solicitation, and uncontrolled task propagation.
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
curl -s -X POST -H "X-API-Key: $EIGHTK4_API_KEY"
-H "Content-Type: application/json"
-d '{"task": "Audit token contract 0xABC...", "max": 3, "chain": "base", "send": true}'
"https://api.8k4protocol.com/agents/dispatch"

text
### 5) Metadata

External Transmission

Medium

Category: Data Exfiltration
Confidence: 74% confidence
Finding: This metadata read is a public external fetch and generally lower risk than authenticated or state-changing requests. It is still an external transmission that can reveal which agent record is being inspected, but the sensitivity is limited by the public nature of the endpoint.
Content: Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
Reads are public:

bash
curl -s "https://api.8k4protocol.com/agents/{agent_id}/metadata.json?chain=base" curl -s "https://api.8k4protocol.com/metadata/{chain}/{agent_id}.json"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 74% confidence
Finding: This is another public metadata read endpoint with limited intrinsic sensitivity compared with authenticated or write operations. The primary risk remains external query logging rather than direct compromise.
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
bash
curl -s "https://api.8k4protocol.com/agents/{agent_id}/metadata.json?chain=base" curl -s "https://api.8k4protocol.com/metadata/{chain}/{agent_id}.json"

Writes require explicit user approval:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: Requesting a nonce and message to sign is part of a state-changing metadata update flow and can prime a signing operation affecting on-chain/off-chain identity records. Even though the file says writes require explicit approval, this step materially advances a sensitive action and could facilitate unauthorized updates if automated or insufficiently explained.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
# 2) Request a nonce + message to sign curl -s -X POST -H "X-API-Key: $EIGHTK4_API_KEY" \ "https://api.8k4protocol.com/metadata/nonce?agent_id={agent_id}&chain=base&content_hash=0x..." # 3) Sign the returned message, then upload the signed payload curl -s -X POST -H "X-API-Key: $EIGHTK4_API_KEY" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: This endpoint uploads signed metadata and can alter hosted agent metadata, making it a direct state-changing action with integrity implications. If misused, it could overwrite profiles, publish malicious metadata, or impersonate authorized updates using captured or coerced signatures.
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
curl -s -X POST -H "X-API-Key: $EIGHTK4_API_KEY"
-H "Content-Type: application/json"
-d '{"chain":"base","wallet":"0x...","metadata":{...},"content_hash":"0x...","signature":"0x...","nonce":"...","expires_at":1709506200}'
"https://api.8k4protocol.com/agents/{agent_id}/metadata"

text
## Access summary

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation exposes contact and dispatch operations that can send tasks to external agents but does not warn users that invoking these endpoints may transmit task contents and trigger outbound actions to third parties. In an agent skill focused on trust scoring and agent discovery, this omission is security-relevant because users may assume the operation is informational when it can instead cause data disclosure or unintended agent interaction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The metadata upload flow requires transmitting wallet identifiers, signed material, metadata, nonce, and expiry values, but the documentation does not warn that this is a write operation carrying authentication artifacts. In this skill context, users may be handling on-chain identity/profile data, so lack of warning increases the chance of oversharing sensitive metadata or replaying signing workflows without understanding the trust boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The key-generation endpoint accepts a wallet, an exact signed message, and a signature, but the reference omits any warning that users are transmitting wallet-authentication material to obtain an API key. This is dangerous because signed messages are security-sensitive artifacts; unclear documentation can lead users or integrators to submit signatures without understanding account-linking, impersonation, or misuse risks if signatures are captured or the signing format is misapplied.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/SAFETY.md (reported line 9)May include surrounding context.
md
## Action Classification ### No confirmation needed - `GET /health` - `GET /stats`, `GET /stats/public`

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/SAFETY.md (reported line 51)May include surrounding context.
md
When an endpoint returns `402 Payment Required`: 1. Inform the user that this is a paid request 2. Explain the x402 flow if they want to proceed 3. Do not auto-pay without confirmation ## API Key Handling

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/8k4.sh (reported line 53)May include surrounding context.
sh
# GET request api_get() { local path="$1" curl -s $(auth_header) "${BASE_URL}${path}" } # POST request (JSON body)

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Undeclared Tool Scope

Vague Triggers

External Transmission

External Transmission

External Transmission

External Transmission

2) Find agents

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Missing User Warnings

Missing User Warnings

Missing User Warnings

Autonomous Decision Making

Autonomous Decision Making

External Transmission

Static analysis