Security audit

Agnic Authenticate Wallet (x402)

Security checks for vulnerabilities and agentic risk

Overview

This wallet-authentication skill is purpose-aligned, but it needs Review because it runs a mutable npm CLI while handling wallet credentials and includes unsafe token guidance.

Install only if you trust the Agnic npm package and publisher, and prefer a pinned reviewed CLI version. Avoid pasting real API tokens into command lines or agent-visible transcripts; use a protected environment variable or secret manager, keep token scopes and spending limits tight, and use logout or token revocation when done.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:19
Finding: Execution of an Unpinned Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:37
Finding: API Token Exposure Through Command-Line Arguments
Content: View full analysis
status --json ``` ``` ### Technical Analysis The documented inline-token option instructs users to place an API token directly in a command-line argument. After replacing the placeholder with a real credential, the token may be retained in shell history. Depending on the operating system, process configuration, and monitoring environment, command arguments may also be observable through process inspection, audit logs, telemetry, terminal recording, debugging output, or automation logs. An environment variable is also sensitive and must be protected, but it avoids directly embedding the credential in the shell command and its history. A dedicated credential store or protected standard-input mechanism would provide stronger handling where supported. ### Attack Path 1. A user replaces the placeholder with a valid Agnic API token and runs the documented command. 2. The shell records the complete command in history, or local monitoring and process-inspection facilities capture its arguments. 3. Another user, process, administrator, log reader, or attacker with access to the recorded data obtains the token. 4. The attacker reuses the token before it expires or is revoked. 5. The attacker performs operations allowed by the token's configured account permissions and spending limits. ### Impact Assessment Exposure can grant unauthorized access to the Agnic account or wallet functions available to the token. The exact impact depends on server-side token scopes, expiration, revocation controls, and spending limits, none of which are fully specified in the audited file. Potential consequences include disclosure of account information and unauthorized API or wall ...[truncated 144 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 83% confidence
Finding: This duplicate manifest finding is substantively valid because the allowed tools authorize execution of a moving @latest target. In an auth-related skill, dynamic package resolution is more sensitive because the invoked code may process tokens, open browser OAuth flows, and write credentials locally.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger text is broad enough to match many generic authentication or wallet-related requests, which can cause the skill to activate outside a narrowly intended context. Over-broad invocation increases the chance that an agent prompts for tokens, initiates auth flows, or steers users into credential-handling steps when another, safer path would be more appropriate.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill recommends export AGNIC_TOKEN=<your-api-token> and an inline --token <your-api-token> form without warning that secrets may be exposed through shell history, terminal logs, process listings, CI logs, or agent transcripts. Because this skill is specifically about authentication, omission of secret-handling guidance materially raises the chance of credential leakage and account compromise.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.