Pet Operator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:10 AM UTC
• Version: 1.2.0

Overview

The skill is mostly purpose-aligned, but its transaction generator can silently encode the default operator even when the user configured a different operator.

Review this skill carefully before installing if you plan to override AAI_OPERATOR. With the default AAI operator and working cast binary, behavior is coherent, but any generated approve or revoke transaction should be decoded or independently checked before signing. Expect local config changes and backup files when using the delegated-wallet add/remove scripts.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/lib.sh:43

Finding

Operator Override Is Silently Ignored by Fallback Calldata

Content

View full analysis

Vulnerability Details

File Location: scripts/lib.sh, lines 43–67
Vulnerability Type: Inconsistent ABI encoding caused by hardcoded fallback calldata
Risk Level: Medium

Vulnerable Code

bash

set_pet_operator_calldata() {
  local approved="$1"

  case "$approved" in
    true|false)
      ;;
    *)
      err "approved must be true|false"
      ;;
  esac

  if command -v cast >/dev/null 2>&1; then
    local data
    data="$(cast calldata "setPetOperatorForAll(address,bool)" "$AAI_OPERATOR" "$approved" 2>/dev/null || true)"
    if [[ -n "$data" && "$data" == 0x* ]]; then
      printf '%s\n' "$data"
      return 0
    fi
  fi

  if [[ "$approved" == "true" ]]; then
    printf '%s\n' "0xcd675d57000000000000000000000000b96b48a6b190a9d509ce9312654f34e9770f21100000000000000000000000000000000000000000000000000000000000000001"
  else
    printf '%s\n' "0xcd675d57000000000000000000000000b96b48a6b190a9d509ce9312654f34e9770f21100000000000000000000000000000000000000000000000000000000000000000"
  fi
}

Technical Analysis

The Skill documents AAI_OPERATOR as an overridable environment variable. The primary encoding path correctly uses the current value of $AAI_OPERATOR. However, if cast is unavailable or cast calldata fails, the fallback transaction data embeds the default AAI operator address, 0xb96B48a6B190A9d509cE9312654F34E9770F2110, rather than the configured address.

The transaction-generation scripts display $AAI_OPERATOR separately from the generated calldata. Consequently, their human-readable output can identify one operator while the actual calldata grants or revokes permission for another operator. A user who reviews only the displayed operator and destination may sign a transaction whose effective authorization differs from the stated authorization.

Although the generated transaction grants pet-operator rights rather than NFT transfer rights, it applies through setPetOperatorForAll to all of the owner's Aavegotchis. T ...[truncated 1507 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the hardcoded fallback and fail closed if ABI encoding cannot be performed:

bash

require_bin cast
cast calldata \
  "setPetOperatorForAll(address,bool)" \
  "$AAI_OPERATOR" \
  "$approved"

2. If an offline fallback is required, dynamically ABI-encode the validated current value of $AAI_OPERATOR rather than embedding a fixed address.

3. Validate AAI_OPERATOR with is_eth_address before generating transaction data.

4. Decode or independently verify the generated calldata before displaying it. Confirm that:

   • the selector is for setPetOperatorForAll(address,bool);
   • the encoded operator equals $AAI_OPERATOR;
   • the encoded Boolean equals the requested operation.

5. Abort on any encoding or verification failure instead of suppressing the error with 2>/dev/null || true.

6. Add automated tests covering default and overridden operator addresses for both approval and revocation, including simulated cast failure.

7. Display a decoded summary derived from the final calldata so the human-readable operator cannot diverge from the actual transaction payload.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · REVOKE.md (reported line 88)May include surrounding context.

md

A: No! You always keep full ownership. Pet operator only allows petting.

**Q: Will AAI know I revoked?**  
A: Yes, via on-chain checks. AAI will automatically remove you from the list.

**Q: Can I revoke just one gotchi?**  
A: No, `setPetOperatorForAll` affects all your gotchis. It's all or nothing.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This shell script creates a backup and then overwrites the configured pet-me-master config file, which is a user-data-affecting file write. Although it prints progress messages, it does not warn the user that it will modify the config or ask for confirmation before performing the write.

Content

No source excerpt is available for this finding.