Agnic Check Balance (x402)

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:40 AM UTC
• Version: 2.0.2

Overview

The skill is a coherent USDC balance checker, but it runs a mutable npm package while handling wallet credentials and financial balances, so it should be reviewed before installation.

Install only if you trust the agnic npm package and its update process. Prefer a version-pinned command, use a narrow and revocable AGNIC_TOKEN, avoid exposing broader environment secrets, and run the balance check in a restricted environment when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:8

Finding

Execution of an Unpinned Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-9
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

yaml

allowed-tools:
  - "Bash(npx agnic@latest status*)"
  - "Bash(npx agnic@latest balance*)"

The unpinned package is also invoked at SKILL.md:15, SKILL.md:19, SKILL.md:38, and SKILL.md:41.

Technical Analysis

The Skill authorizes and instructs the Agent to execute agnic@latest through npx. The latest npm tag is mutable and does not identify a specific, previously audited package artifact. Depending on the local npm environment, npx may download the current package release and immediately execute its code.

Consequently, the code ultimately executed is not included in this project and can change after the Skill has been reviewed. No exact version, lockfile, package integrity hash, or other artifact verification mechanism is provided. This creates a supply-chain trust boundary in which compromise of the package, its publisher account, or a future release can introduce arbitrary executable behavior.

The exposure is particularly sensitive because the documented CLI consumes AGNIC_TOKEN, performs wallet authentication, accesses wallet addresses, and retrieves financial balance information.

Attack Path

1. An attacker compromises the agnic package publisher, npm account, release process, or a future package version.
2. The attacker publishes a malicious release and causes the mutable latest tag to resolve to it.
3. A user asks the Agent to check a wallet balance or authentication status.
4. The Skill authorizes the Agent to run npx agnic@latest balance ... or npx agnic@latest status ....
5. npx retrieves and executes the malicious package artifact with the permissions of the Agent process.
6. The malicious package can inspect process-accessible data, including authentication tokens and wallet-related information, and pe ...[truncated 820 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace agnic@latest with an exact, reviewed package version in every allowed-tool rule, command, and example.
2. Install the dependency through a committed lockfile rather than allowing npx to resolve and download a mutable release at invocation time.
3. Verify the package artifact with npm lockfile integrity metadata or an independently maintained checksum before execution.
4. Record and verify the expected npm package owner, source repository, and release provenance. Review package ownership changes before upgrades.
5. Introduce a controlled dependency-update process that audits new versions before changing the pinned version.
6. Run the CLI with least privilege in an isolated environment with restricted filesystem and network access.
7. Expose AGNIC_TOKEN only to the specific command that requires it, use a narrowly scoped and revocable token, and prevent credentials from appearing in command output or logs.
8. Ensure the allowed-tool patterns accept only the required fixed commands and validated network options after the dependency has been pinned.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

A second manifest entry similarly permits npx agnic@latest, creating duplicate unsafe execution paths (status* and balance*). Multiple allowed-tool entries increase attack surface because more command families can invoke unreviewed upstream code under agent authority.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation description uses broad phrases like 'check my balance', 'how much do I have', and 'show funds', which overlap with common user speech and may cause over-triggering. In an agent environment, overly broad routing can unintentionally invoke wallet-related tooling, exposing financial metadata or causing authenticated commands to run in situations where the user did not clearly intend it.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill executes npx agnic@latest, which fetches and runs the latest published package version at runtime rather than a pinned, reviewed version. This creates a supply-chain risk: a compromised maintainer account, malicious release, or breaking update could cause arbitrary code execution in the agent context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This command also relies on npx agnic@latest, so every invocation may execute newly published code without prior review. In an authenticated wallet-related workflow, that can expose tokens, addresses, and agent environment data if the upstream package is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Using npx ...@latest in authentication guidance is especially risky because it may be run when credentials such as AGNIC_TOKEN are present. A malicious or trojanized package update could exfiltrate tokens or alter authentication behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The documented command syntax instructs users and agents to invoke an unpinned package version. While this instance is documentation rather than the manifest itself, it still drives unsafe operational behavior and normalizes runtime execution of unreviewed updates.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This option/example context still centers on npx agnic@latest, preserving the same supply-chain execution risk. Repetition throughout the skill increases the chance that an operator or agent will copy the unsafe form even if a safer invocation exists elsewhere.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Another unpinned invocation appears in the examples section, reinforcing a pattern of executing remote code without version control. In aggregate, this broadens exposure because any balance check can become a code execution event tied to upstream package state.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The example for checking all networks uses @latest, so even read-only wallet balance queries depend on mutable upstream code. Because the skill deals with financial context and authenticated state, even a nominally read-only action has meaningful security sensitivity.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This network-specific example still fetches the latest package at runtime, leaving behavior dependent on the package registry at execution time. An attacker controlling or poisoning the upstream package could misuse the wallet-related context regardless of the specific network flag.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The error-handling guidance tells users to run another @latest command during authentication troubleshooting, potentially at the exact moment credentials are being set up. That compounds the supply-chain risk by increasing the chance that sensitive login flows occur through unreviewed code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.