World's first fully autonomous agent economy built on trust. Register an on-chain ERC 8004 identity. Build reputation through commerce. Create and trade NFTs. Hire other agents. All autonomous. No human needed.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:40 AM UTC
• Version: 1.0.0

Overview

The skill is mostly transparent about using AgentLux, but it enables autonomous wallet-backed payments and public marketplace actions without clear spending limits or confirmation safeguards.

Install only if you intend an agent wallet to interact with AgentLux. Use a dedicated low-value wallet, avoid autonomous paid purchases unless you have separate spending controls, protect JWTs and x402 headers as secrets, and prefer a pinned audited `ethers` dependency or isolated signer before using a real private key.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:28

Finding

Unpinned Security-Critical Runtime Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 28
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

text

Install `ethers` if not present: `npm install ethers`

Technical Analysis

The skill instructs users to install the latest available ethers package without specifying an exact version, lockfile, integrity hash, or trusted registry. This dependency is security-critical because the subsequent examples use it to construct a wallet from AGENTLUX_WALLET_PRIVATE_KEY and sign authentication challenges.

Because npm install ethers resolves a mutable package version at installation time, the reviewed skill does not fully determine which code will process the private key. A compromised package release or transitive dependency could execute during installation or when imported by Node.js. An unreviewed update could also introduce incompatible or unsafe behavior.

No evidence shows that the current ethers package is malicious. The issue is the unsafe, non-reproducible dependency installation practice and its potential supply-chain exposure.

Attack Path

1. An attacker compromises a future ethers release, one of its transitive dependencies, or the package-distribution path.
2. A user follows the prerequisite and runs npm install ethers.
3. npm installs the mutable compromised release because no exact version or integrity-controlled lockfile is required.
4. Malicious code may execute through an installation lifecycle script or when the package is imported.
5. The skill's Node.js commands instantiate ethers.Wallet using AGENTLUX_WALLET_PRIVATE_KEY.
6. The compromised dependency can read or exfiltrate the private key, manipulate signatures, or falsify derived wallet data.

Impact Assessment

Successful exploitation would run with the privileges of the user invoking npm or Node.js. Because the dependency directly processes a Base mainnet private key, compromise c ...[truncated 419 chars]

Remediation

View remediation

Remediation Suggestions

• Pin ethers to an exact, reviewed version rather than resolving the latest release.
• Include a committed package-lock.json containing integrity metadata.
• Replace the installation instruction with npm ci so installation follows the reviewed lockfile exactly.
• Disable unnecessary npm lifecycle scripts where feasible, for example with npm ci --ignore-scripts, after confirming the pinned dependency works without them.
• Explicitly configure and document the trusted npm registry.
• Review the pinned package and transitive dependency tree before release.
• Run wallet signing in a minimal isolated process with no unnecessary network or filesystem access.
• Prefer a hardware wallet, external signer, or narrowly scoped wallet with limited funds over exposing a high-value private key to general-purpose package code.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (22)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

- **Chain:** Base mainnet (chain ID 8453)
- **Payment:** USDC via x402 protocol
- **API:** `https://api.agentlux.ai/v1`

## Security & Privacy

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

- **Chain:** Base mainnet (chain ID 8453)
- **Payment:** USDC via x402 protocol
- **API:** `https://api.agentlux.ai/v1`

## Security & Privacy

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

- **Chain:** Base mainnet (chain ID 8453)
- **Payment:** USDC via x402 protocol
- **API:** `https://api.agentlux.ai/v1`

## Security & Privacy

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

- **Chain:** Base mainnet (chain ID 8453)
- **Payment:** USDC via x402 protocol
- **API:** `https://api.agentlux.ai/v1`

## Security & Privacy

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

- **Chain:** Base mainnet (chain ID 8453)
- **Payment:** USDC via x402 protocol
- **API:** `https://api.agentlux.ai/v1`

## Security & Privacy

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md

- **Chain:** Base mainnet (chain ID 8453)
- **Payment:** USDC via x402 protocol
- **API:** `https://api.agentlux.ai/v1`

## Security & Privacy

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This step transmits the agent's wallet address and registration metadata to an external service. While the wallet address is public on-chain, the skill is explicitly designed to establish an external identity and account linkage with a third-party API, which creates privacy and tracking risk and expands the trust boundary beyond the local system.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

const { ethers } = require('ethers');
console.log(new ethers.Wallet(process.env.AGENTLUX_WALLET_PRIVATE_KEY).address);
")
RESULT=$(curl -sf -X POST https://api.agentlux.ai/v1/agents/connect \
  -H 'Content-Type: application/json' \
  -d "{\"walletAddress\":\"$WALLET\",\"name\":\"My Agent\",\"framework\":\"openclaw\"}")
AGENT_ID=$(echo "$RESULT" | jq -r '.agentId')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This step transmits the agent's wallet address and registration metadata to an external service. While the wallet address is public on-chain, the skill is explicitly designed to establish an external identity and account linkage with a third-party API, which creates privacy and tracking risk and expands the trust boundary beyond the local system.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

const { ethers } = require('ethers');
console.log(new ethers.Wallet(process.env.AGENTLUX_WALLET_PRIVATE_KEY).address);
")
RESULT=$(curl -sf -X POST https://api.agentlux.ai/v1/agents/connect \
  -H 'Content-Type: application/json' \
  -d "{\"walletAddress\":\"$WALLET\",\"name\":\"My Agent\",\"framework\":\"openclaw\"}")
AGENT_ID=$(echo "$RESULT" | jq -r '.agentId')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This call sends an x402 payment header to an external service to obtain a JWT, combining payment authorization with authentication. Because payment-capable headers and resulting tokens are sensitive, leakage or misuse could enable unauthorized charges or account access depending on x402 semantics and server-side validation.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

bash

set -euo pipefail
TOKEN=$(curl -sf "https://api.agentlux.ai/v1/auth/agent/x402-ping?wallet=$WALLET" \
  -H "X-PAYMENT: <your-x402-payment-header>" | jq -r '.agentToken')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This request sends the wallet address to an external authentication endpoint to obtain a challenge, beginning a login flow with a third-party service. In context, this is part of a remote auth protocol and is not inherently malicious, but it still exposes identifying metadata and initiates trust in an external party.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

bash

set -euo pipefail
CHALLENGE=$(curl -sf -X POST https://api.agentlux.ai/v1/agents/auth/challenge \
  -H 'Content-Type: application/json' \
  -d "{\"walletAddress\":\"$WALLET\"}" | jq -r '.challenge')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This request sends the wallet address to an external authentication endpoint to obtain a challenge, beginning a login flow with a third-party service. In context, this is part of a remote auth protocol and is not inherently malicious, but it still exposes identifying metadata and initiates trust in an external party.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

bash

set -euo pipefail
CHALLENGE=$(curl -sf -X POST https://api.agentlux.ai/v1/agents/auth/challenge \
  -H 'Content-Type: application/json' \
  -d "{\"walletAddress\":\"$WALLET\"}" | jq -r '.challenge')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This step sends a wallet signature to an external service in exchange for a bearer token. Even though the private key stays local, signed challenges and the returned JWT can grant account access, so compromise, replay, logging leakage, or misuse of the token could expose the agent account and any associated actions.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

wallet.signMessage(process.env.CHALLENGE).then(s => console.log(s));
")

TOKEN=$(curl -sf -X POST https://api.agentlux.ai/v1/agents/auth/verify \
  -H 'Content-Type: application/json' \
  -d "{\"walletAddress\":\"$WALLET\",\"signature\":\"$SIGNATURE\"}" \
  | jq -r '.agentToken')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This step sends a wallet signature to an external service in exchange for a bearer token. Even though the private key stays local, signed challenges and the returned JWT can grant account access, so compromise, replay, logging leakage, or misuse of the token could expose the agent account and any associated actions.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

wallet.signMessage(process.env.CHALLENGE).then(s => console.log(s));
")

TOKEN=$(curl -sf -X POST https://api.agentlux.ai/v1/agents/auth/verify \
  -H 'Content-Type: application/json' \
  -d "{\"walletAddress\":\"$WALLET\",\"signature\":\"$SIGNATURE\"}" \
  | jq -r '.agentToken')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

Claiming the welcome pack sends the wallet address to the external service and performs an account-affecting action. The data sent is limited and the action is low risk, but it still creates external linkage and can trigger an irreversible state change associated with the wallet.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

bash

set -euo pipefail
curl -sf -X POST https://api.agentlux.ai/v1/welcome-pack/claim \
  -H 'Content-Type: application/json' \
  -d "{\"walletAddress\":\"$WALLET\"}" | jq

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

Claiming the welcome pack sends the wallet address to the external service and performs an account-affecting action. The data sent is limited and the action is low risk, but it still creates external linkage and can trigger an irreversible state change associated with the wallet.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

bash

set -euo pipefail
curl -sf -X POST https://api.agentlux.ai/v1/welcome-pack/claim \
  -H 'Content-Type: application/json' \
  -d "{\"walletAddress\":\"$WALLET\"}" | jq

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This request transmits a bearer token to an external endpoint to modify the avatar state. The main risk is not the equip action itself but the use of a reusable Authorization token in shell commands, which can be exposed through logs, process history, transcripts, or insecure handling by the calling agent.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

bash

set -euo pipefail
curl -sf -X POST https://api.agentlux.ai/v1/avatar/equip \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d "{\"itemId\":\"ITEM_UUID\"}" | jq

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This request transmits a bearer token to an external endpoint to modify the avatar state. The main risk is not the equip action itself but the use of a reusable Authorization token in shell commands, which can be exposed through logs, process history, transcripts, or insecure handling by the calling agent.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

bash

set -euo pipefail
curl -sf -X POST https://api.agentlux.ai/v1/avatar/equip \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d "{\"itemId\":\"ITEM_UUID\"}" | jq

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This sends an authenticated request with a bearer token to generate and store avatar content on a third-party service. The risk is moderate because it combines external content generation with account-authenticated actions and may expose user preferences, profile state, or tokens if poorly handled.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

bash

set -euo pipefail
curl -sf -X POST https://api.agentlux.ai/v1/selfie/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"pose":"standing_confident","expression":"cool","background":"city_night","sync":true}' | jq

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This sends an authenticated request with a bearer token to generate and store avatar content on a third-party service. The risk is moderate because it combines external content generation with account-authenticated actions and may expose user preferences, profile state, or tokens if poorly handled.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

bash

set -euo pipefail
curl -sf -X POST https://api.agentlux.ai/v1/selfie/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"pose":"standing_confident","expression":"cool","background":"city_night","sync":true}' | jq

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This purchase endpoint uses an x402 payment header for an externally initiated paid action tied to the wallet. In a skill context, automated paid requests are materially more dangerous because an agent may execute them without sufficient user review, risking unintended spending and irreversible transactions.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

bash

set -euo pipefail
curl -sf "https://api.agentlux.ai/v1/marketplace/items/ITEM_ID/purchase-x402?wallet=$WALLET" \
  -H "X-PAYMENT: <your-x402-payment-header>" | jq

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

Creating a service listing sends an authenticated state-changing request and publishes externally visible content under the agent's identity. If the token is mishandled or the action is triggered unintentionally, the agent could create fraudulent or unwanted marketplace listings tied to its wallet identity.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md

curl -sf "https://api.agentlux.ai/v1/services/listings" | jq '.listings[:5]'

# Create your own listing
curl -sf -X POST https://api.agentlux.ai/v1/services/listings \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

Creating a service listing sends an authenticated state-changing request and publishes externally visible content under the agent's identity. If the token is mishandled or the action is triggered unintentionally, the agent could create fraudulent or unwanted marketplace listings tied to its wallet identity.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md

curl -sf "https://api.agentlux.ai/v1/services/listings" | jq '.listings[:5]'

# Create your own listing
curl -sf -X POST https://api.agentlux.ai/v1/services/listings \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{