Asrai Crypto Analysis (x402)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:13 AM UTC
• Version: 2.1.4

Overview

This crypto-analysis skill is not proven malicious, but it asks users to handle wallet and exchange secrets in unsafe, high-impact ways.

Review before installing. Use only a dedicated low-balance wallet, do not put a primary wallet private key in this skill, do not paste private keys into remote URLs, and avoid configuring exchange keys unless they are read-only, withdrawal-disabled, IP-restricted, and disposable. Prefer a pinned, audited package version and a design where signing and exchange authentication stay local.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: README.md:56
• Finding: Wallet Private Key Disclosed Through Remote MCP URLs<![CDATA[ ## Vulnerability Details **File Location**: `README.md:56-59` **Vulnerability Type**: Wallet private key exposure through URL query parameters **Risk Level**: Critical ### Vulnerable Code ```text ### 3. n8n / remote connections HTTP Streamable: https://mcp.asrai.me/mcp?key=0x<your_private_key> SSE (legacy): https://mcp.asrai.me/sse?key=0x<your_private_key> ``` ### Technical Analysis The documented configuration requires the user to place a wallet private key directly in the query string of a URL sent to an external service. URL query strings are commonly retained in destination-server access logs, reverse-proxy logs, browser history, monitoring systems, error reports, and network diagnostics. HTTPS protects the request while it is in transit but does not prevent the remote endpoint or terminating infrastructure from reading and recording the URL. A wallet private key is not an authentication token that can safely be disclosed to a service. Anyone who obtains it can independently sign transactions as the wallet owner. This design also conflicts with the safer local-signing model implied elsewhere in the project. ### Attack Path 1. A user follows the remote MCP setup instructions. 2. The user substitutes an actual wallet private key into the `key` query parameter. 3. The MCP client sends the complete URL to `mcp.asrai.me`. 4. The external service, reverse proxy, observability platform, browser, or another logging component records the URL. 5. An attacker or unauthorized operator with access to those records extracts the private key. 6. The attacker imports the key into another wallet and signs unauthorized transactions. 7. Assets controlled by the wallet can be transferred or spent without further authorization. ### Impact Assessment Successful exploitation provides full cryptographic control over the affected wallet rather than access limited to this Skill. An attacker could sign arbitrary transactions, transfer tokens, approve malicious ...[truncated 292 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove all instructions that place wallet private keys in URLs, headers, request bodies, or remote configuration. - Perform x402 payment signing locally with a reviewed client so the private key never leaves the user's device. - Use a dedicated wallet containing only the minimum funds required for payment. - If the remote MCP service requires authentication, issue a scoped, revocable service token unrelated to the wallet private key. - Prevent secrets from being written to browser history, command history, logs, telemetry, and error reports. - Add automatic secret redaction to clients and infrastructure. - Clearly document the trust boundary and state that users must never disclose seed phrases or private keys. - Treat previously submitted keys as compromised and instruct affected users to migrate assets to newly generated wallets. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/endpoints.md:77
• Finding: Exchange API Credentials Transmitted in HTTP URL Paths<![CDATA[ ## Vulnerability Details **File Location**: `references/endpoints.md:77-80` **Vulnerability Type**: Sensitive exchange credentials embedded in request paths **Risk Level**: Critical ### Vulnerable Code ```text ### Exchange Positions - `GET /api/exchange/<exchange>/<api_key>/<secret_key>` — live positions for exchange (`mexc`, `binance`, `lighter`) - Keys read from `~/.env` automatically: `MEXC_API_KEY`, `MEXC_SECRET_KEY`, `BINANCE_API_KEY`, `BINANCE_SECRET_KEY`, `LIGHTER_L1_ADDRESS`, `LIGHTER_API_PRIVATE_KEY` - Returns: account info, open positions, unrealized PnL, leverage, margin, liquidation price ``` ### Technical Analysis The endpoint design embeds both the exchange API key and secret key in an HTTP path. Request paths are routinely recorded by web servers, reverse proxies, load balancers, web application firewalls, content-delivery infrastructure, tracing platforms, and application monitoring systems. TLS only protects the request between network endpoints. It does not prevent the destination service or any TLS-terminating intermediary from reading and logging the path. The documented behavior also indicates that credentials are automatically read from `~/.env`, creating a direct flow from local secret storage to an external endpoint. Exchange secret keys should remain local and should be used to sign exchange requests locally. Sending the secret to a third-party analytics API removes the security properties of exchange request signing and unnecessarily expands the credential trust boundary. ### Attack Path 1. A user stores exchange API credentials in `~/.env` as instructed. 2. The positions integration reads the API key and secret key from that file. 3. It constructs a request path containing both credential values. 4. The request is sent through the remote service and its supporting infrastructure. 5. A server, proxy, monitoring system, or tracing platform records the path. 6. An attacker or unauthorized operator retrieves the cre ...[truncated 865 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove API and secret keys from all URL paths and query strings. - Keep exchange secret keys local and use them only to sign requests sent directly to the relevant exchange. - Retrieve positions locally or through a local broker component that returns sanitized position data to the analysis service. - If delegation is unavoidable, use narrowly scoped, short-lived, revocable tokens rather than exchange secrets. - Require read-only exchange keys with withdrawal and trading permissions disabled unless functionality strictly requires otherwise. - Apply exchange-supported IP allowlists and per-key account restrictions. - Pass service authentication through an authorization header, while ensuring credentials are redacted from logs and traces. - Rotate all credentials that may previously have been submitted using the documented endpoint. - Add automated tests that reject URLs containing secret-key values. ]]>

T08 · Insecure Dependencies

Error

• Location: README.md:11
• Finding: Automatic Execution of Mutable Third-Party npm Packages<![CDATA[ ## Vulnerability Details **File Location**: `README.md:11-14`, `README.md:37-39`, `README.md:73-84`, `SKILL.md:49-51`, and `SKILL.md:65-84` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code `README.md:11-14`: ```bash npx -y -p asrai-mcp@latest install-skill ``` `README.md:37-39`: ```json { "mcpServers": { "asrai": { "command": "npx", "args": ["-y", "asrai-mcp"] } } } ``` `README.md:73-84`: ```bash npx -y -p asrai-mcp asrai technical_analysis BTC 4h npx -y -p asrai-mcp asrai sentiment npx -y -p asrai-mcp asrai forecast ETH npx -y -p asrai-mcp asrai market_overview npx -y -p asrai-mcp asrai ask_ai "Is BTC a good buy right now?" npx -y -p asrai-mcp asrai coin_info SOL npx -y -p asrai-mcp asrai screener ath npx -y -p asrai-mcp asrai smart_money BTC 1d npx -y -p asrai-mcp asrai portfolio npx -y -p asrai-mcp asrai indicator_guide ALSAT ``` `SKILL.md:49-51`: ```bash npx -y -p asrai-mcp install-skill ``` `SKILL.md:65-84`: ```bash npx -y -p asrai-mcp asrai <tool> [args...] ``` ```bash npx -y -p asrai-mcp asrai ask_ai "What is the outlook for BTC today?" npx -y -p asrai-mcp asrai technical_analysis BTC 4h npx -y -p asrai-mcp asrai sentiment npx -y -p asrai-mcp asrai forecast ETH npx -y -p asrai-mcp asrai market_overview npx -y -p asrai-mcp asrai coin_info SOL npx -y -p asrai-mcp asrai portfolio npx -y -p asrai-mcp asrai indicator_guide ALSAT ``` ### Technical Analysis The documented commands use `npx -y` to download and execute an npm package without interactive confirmation. Most commands do not specify an exact version, while the installation command explicitly uses the mutable `@latest` tag. Consequently, the code executed in the future may differ from the code that existed when this Skill was reviewed. A compromised npm publisher account, malicious package update, or supply-chain compromise could cause arbitrary code to execute under the user's account. The ris ...[truncated 2028 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `asrai-mcp` to a specific audited version rather than using an unversioned package name or `@latest`. - Verify package integrity using a lockfile, npm integrity metadata, or a documented cryptographic digest. - Review package provenance, publisher controls, build process, and release signatures before execution. - Remove `-y` where practical so dependency installation is not silently approved. - Install dependencies through a controlled deployment process rather than downloading executable code during every tool call. - Run the package in a sandbox or isolated account with minimal filesystem and network permissions. - Pass only the minimum environment variables needed for each operation. - Do not expose wallet private keys or exchange secret keys to the package process. - Separate installation from runtime and retain a locally verified immutable package artifact. - Monitor dependency releases and require security review before upgrading the pinned version. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (37)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The README instructs users to place a private key in ~/.env without any security warning about plaintext storage, filesystem permissions, shell history, process exposure, backups, or the consequences of compromise. In this crypto context, exposure of the key can lead directly to wallet theft or unauthorized spending, making the omission especially dangerous.

Credential Access

High

• Category: Privilege Escalation

Content

### 1. Set your private key

```bash
echo "ASRAI_PRIVATE_KEY=0x<your_private_key>" >> ~/.env
```

Your wallet must hold USDC on Base mainnet (~$1–2 is plenty).

• Confidence: 95% confidence
• Finding: The skill explicitly instructs users to store a private key in a local .env file, which is a credential access risk because such files are often readable by local tools, included in backups, exposed to other processes, or mishandled by agents and plugins. Given the wallet-backed payment model, compromise of this file could enable unauthorized transactions and theft of funds.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Embedding a private key directly in a URL is highly dangerous because URLs are commonly logged by servers, proxies, browser history, shell history, monitoring tools, and configuration files. In this skill's context, the leaked secret is a blockchain private key tied to spending, so compromise can result in immediate fund loss and broader account exposure.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill instructs users to place a wallet private key in `~/.env` for automatic signed payments, but it does not provide a prominent warning about the extreme sensitivity of that credential or safer alternatives. In a crypto context, compromise of a private key can lead to irreversible asset theft and unauthorized on-chain spending, making this materially more dangerous than ordinary API-token setup.

Credential Access

High

• Category: Privilege Escalation

Content

Auto-detects OpenClaw, Cursor, Cline, and other agents. Then set your key:

```
ASRAI_PRIVATE_KEY=0x<your_private_key>  # add to ~/.env
```

For MCP agents (Cursor, Cline, Claude Desktop) also add to config:

• Confidence: 93% confidence
• Finding: The skill explicitly instructs users to store `ASRAI_PRIVATE_KEY` in `~/.env`, which is direct credential handling guidance for a highly sensitive secret. Because this is a cryptocurrency private key used to sign payments, exposure can result in immediate and irreversible financial loss far beyond typical API credential compromise.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The exchange setup section asks users to store exchange API credentials in `~/.env` without an explicit warning about account privacy, credential handling, or the consequences if those keys are misused. Even if intended as read-only, users may supply broader-permission keys, and compromise could expose positions, balances, trading metadata, or enable unauthorized trading depending on exchange key scopes.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

Only configure the exchanges you use — tool auto-detects which keys are set.

## Output rules

🎨 Output Style — Human-Friendly Format

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The README instructs users to execute an npm package via npx without pinning a version, which causes the latest published package to be fetched and run at install time. If the package or publisher account is compromised, users may execute attacker-controlled code and expose wallet keys, exchange credentials, or local files.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 76% confidence
• Finding: Using npx to install a skill from a mutable package/source without version pinning creates a supply-chain risk similar to other unpinned npm executions. A later malicious or compromised release could change installation behavior and place arbitrary content into agent skill directories.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The README encourages broad natural-language prompts like normal conversation and says the agent will automatically pick the right tool. That increases the risk of accidental invocation, unintended paid API calls, or triggering sensitive functionality in response to ambiguous user text, especially in autonomous or semi-autonomous agent settings.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This command runs asrai-mcp through npx without version pinning, so each execution may pull a changed package version. Because the skill is intended to run tool commands directly from an agent environment, compromise of the package could lead to immediate code execution in a sensitive context.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This example again executes a mutable npm package through npx without pinning a version. In the context of a crypto-analysis skill that asks users to configure private keys, supply-chain compromise could directly endanger financial credentials and funds.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: Running an unpinned asrai-mcp package through npx allows arbitrary future package changes to be executed automatically. Since these commands are expected to be used interactively by agents or users, the attack surface includes local environment variables, shell access, and credential stores.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The README provides another direct npx execution path without immutable versioning. In a tool that integrates with wallets and potentially exchange-connected accounts, that creates meaningful risk of remote code execution via npm supply-chain compromise.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This command example repeats the same unsafe pattern of dynamic package retrieval and execution. The context makes it more dangerous because the surrounding documentation asks the user to store private keys and API credentials in the environment that the executed package can access.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: Executing an unpinned package through npx at command time is a real supply-chain vulnerability. If the package becomes malicious, the command can run with the user's privileges and access to configured secrets, including wallet and exchange credentials referenced elsewhere in the README.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The command uses a mutable npm resolution path instead of a fixed version, enabling arbitrary code execution if a future release is compromised. Because the tool is designed for crypto-related workflows, exploitation could have direct financial consequences beyond ordinary workstation compromise.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This example also relies on npx fetching and running an unpinned package. In a skill that may be invoked by autonomous agents, the combination of dynamic package execution and broad tool usage increases the chance that malicious updates execute without human scrutiny.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The README instructs direct execution of an unpinned npm package, leaving users exposed to future malicious package updates or dependency hijacking. Since these commands may run in environments containing wallet keys and API secrets, the impact can include theft of funds or account takeover.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This final command example repeats the same unpinned npx execution issue. The risk is amplified by the README's broader credential-handling model, which makes any package-execution compromise materially dangerous rather than merely theoretical.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation describes a positions tool that retrieves live open positions from connected exchanges, but the finding indicates this capability is omitted from the manifest or declared interface. Security-relevant capabilities that are undocumented in the formal manifest reduce user visibility and can bypass least-privilege expectations during skill review or installation.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The documented setup instructs users to provide MEXC, Binance, and Lighter API credentials so the skill can access live positions. That private account integration is not obviously required by the manifest's stated purpose of crypto market analysis covering sentiment, forecasting, technicals, and DEX data.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The activation guidance uses very broad triggers such as crypto prices, market analysis, sentiment, and investment advice, which overlap with ordinary conversation and can cause the skill to be invoked more often than users expect. In this case, over-invocation is especially risky because each call can incur wallet-signed payments and may route prompts into a third-party package/toolchain.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The skill installs and executes `asrai-mcp` via `npx` without pinning a specific version, so every invocation can fetch whatever package version is currently published. In a skill that asks users to configure wallet private keys and exchange credentials, this creates a serious supply-chain risk: a compromised or malicious package update could execute arbitrary code and exfiltrate secrets or trigger unauthorized financial actions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: This example command executes `asrai-mcp` through `npx` without a pinned version, allowing unreviewed code changes to be pulled and run on demand. Because the skill is designed to operate in environments containing `ASRAI_PRIVATE_KEY` and possibly exchange API keys, the blast radius includes credential theft and unauthorized paid calls or account data access.

Static analysis

No suspicious patterns detected.