Agent News Api

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:48 AM UTC
• Version: 1.2.2

Overview

The skill is purpose-aligned for paid real-time news, but it handles wallet-linked authentication and API credentials with under-scoped network and replay risks that need review before installation.

Install only in a tightly controlled environment. Use a dedicated low-balance Solana key, pin AGENT_NEWS_API_URL to the official endpoint, set explicit spending and streaming limits, monitor credits, and prefer pinned dependencies plus a lockfile before production use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: lib/agent-news-client.js:123

Finding

Arbitrary API origin can receive API keys and wallet authentication proofs

Content

View full analysis

{ return axios({ method, url: `${this.apiUrl}${path}`, headers: { 'X-API-KEY': this.apiKey, ...options.headers }, params: options.params, data: options.data }); }; ``` ```javascript // lib/agent-news-client.js:149-153 const response = await axios.post(`${this.apiUrl}/api/keys/autonomous`, { walletAddress, signature: bs58.encode(signature), message }); ``` ```javascript // lib/agent-news-client.js:165-168 this.socket = io(this.apiUrl, { auth: { apiKey: this.apiKey } }); ``` ### Technical Analysis The value of `AGENT_NEWS_API_URL` controls the destination of all REST and Socket.io connections without validating the scheme, hostname, port, or trust boundary. This conflicts with the Skill metadata's declared network scope, which lists only `api.agentnewsapi.com` and `agentnewsapi.com`. When an API key is available, it is sent to the configured destination through the ` ...[truncated 2400 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: lib/agent-news-client.js:139

Finding

Fixed Solana authentication message creates a replayable wallet proof

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill promotes autonomous funding, deposits, and premium per-story billing using real SOL, but it does not present a prominent warning that transactions spend real funds and may be irreversible. In an agent context, this increases the risk of unattended or repeated spending loops, balance depletion, and transfers to the protocol wallet without meaningful operator awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The onboarding flow asks the agent to use a local Solana private key to create a persistent API credential, but it does not clearly warn about the sensitivity of the wallet key, the trust implications of granting persistent access, or the blast radius if the host or generated key is compromised. In autonomous environments, normalizing direct use of a hot private key materially raises the chance of credential misuse and unintended financial exposure.

Content

No source excerpt is available for this finding.

Scope Creep

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest declares network access only to agentnewsapi domains, but the documentation explicitly states the skill also contacts Coinbase to update the SOL/USD exchange rate. This hidden dependency weakens permission transparency and can cause either undeclared outbound access attempts or pressure to broaden permissions later without review, which is a security and governance issue for agent environments that rely on accurate egress controls.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency uses a caret range instead of an exact pinned version, which allows npm to resolve newer releases within the major version. That increases supply-chain risk because builds may pull in different code over time, including compromised or vulnerable intermediate releases.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json

"author": "Agent News Protocol <[e-mail]>",
  "license": "ISC",
  "dependencies": {
    "@solana/web3.js": "^1.98.4",
    "axios": "^1.14.0",
    "bs58": "^6.0.0",
    "dotenv": "^17.3.1",

Unverifiable Dependency: @solana/web3.js has 3 known advisory(ies) (CVE-2024-30253 (Handling untrusted input can result in a crash, leading to loss of availability ); CVE-2024-54134 (Modified package published to npm, containing malware that exfiltrates private k); MAL-2024-11183 (Malicious code in @solana/web3.js (npm))), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 78% confidence

Finding

The manifest does not pin @solana/web3.js to an exact release, while advisories exist for some versions of that package, including malware-tainted publications and denial-of-service issues. Because the actual installed version is not fixed, consumers can unknowingly install an affected release, which is more concerning here because the skill appears related to Solana/Web3 operations and may handle sensitive keys or transactions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The axios dependency is specified with a caret range, so future installs may resolve to different patch or minor versions. In an agent skill that performs network activity, this weakens build reproducibility and increases exposure to supply-chain compromise or newly introduced vulnerable releases.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json

"license": "ISC",
  "dependencies": {
    "@solana/web3.js": "^1.98.4",
    "axios": "^1.14.0",
    "bs58": "^6.0.0",
    "dotenv": "^17.3.1",
    "socket.io-client": "^4.8.3",

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Axios has multiple known advisories across versions, but the package is not pinned, so the effective installed version is ambiguous and may vary by install time. In an autonomous agent skill that likely performs outbound network requests, exposure to a vulnerable axios release could enable request manipulation, SSRF-related behaviors, or other network-layer abuse depending on usage.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Using an unpinned version for bs58 permits silent drift between installed versions. While not an immediate exploit by itself, it creates a supply-chain trust gap where malicious or defective upstream releases can be pulled into agent environments unexpectedly.

Content

Scanner excerpt · package.json (reported line 29)May include surrounding context.

json

"dependencies": {
    "@solana/web3.js": "^1.98.4",
    "axios": "^1.14.0",
    "bs58": "^6.0.0",
    "dotenv": "^17.3.1",
    "socket.io-client": "^4.8.3",
    "tweetnacl": "^1.0.3"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

The dotenv dependency is not pinned to an exact version, allowing package resolution to change over time. Because dotenv influences environment-variable handling, unexpected upstream changes could affect configuration security or introduce supply-chain exposure.

Content

Scanner excerpt · package.json (reported line 30)May include surrounding context.

json

"@solana/web3.js": "^1.98.4",
    "axios": "^1.14.0",
    "bs58": "^6.0.0",
    "dotenv": "^17.3.1",
    "socket.io-client": "^4.8.3",
    "tweetnacl": "^1.0.3"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

socket.io-client is declared with a caret range, enabling automatic uptake of newer compatible releases at install time. For a real-time networked skill, this increases risk from dependency compromise or behavior changes that could affect communications security.

Content

Scanner excerpt · package.json (reported line 31)May include surrounding context.

json

"axios": "^1.14.0",
    "bs58": "^6.0.0",
    "dotenv": "^17.3.1",
    "socket.io-client": "^4.8.3",
    "tweetnacl": "^1.0.3"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

tweetnacl is used with a non-exact version, which weakens reproducibility for a cryptography-related package. In security-sensitive code, silently changing cryptographic dependencies is particularly risky because compromised or flawed releases can materially affect confidentiality or integrity.

Content

Scanner excerpt · package.json (reported line 32)May include surrounding context.

json

"bs58": "^6.0.0",
    "dotenv": "^17.3.1",
    "socket.io-client": "^4.8.3",
    "tweetnacl": "^1.0.3"
  }
}

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: agent-news-cli.js:14