Agnic Authenticate Wallet

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:26 AM UTC
• Version: 2.0.2

Overview

The skill is a disclosed wallet authentication helper, but it asks users to run a mutable npm CLI during credential and OAuth flows and documents an inline token pattern that can expose secrets.

Review before installing. Use only if you trust the current Agnic npm package and publisher, prefer a pinned or preinstalled reviewed CLI, avoid passing tokens with --token on the command line, and keep wallet/API token permissions and spending limits narrow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:10

Finding

Execution of an Unpinned Mutable npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-12; executable command examples also appear at lines 20, 32, 39, 46, 61, and 79
Vulnerability Type: Supply-chain risk caused by direct execution of a mutable third-party package version
Risk Level: High

Vulnerable Code

yaml

allowed-tools:
  - "Bash(npx agnic@latest status*)"
  - "Bash(npx agnic@latest auth *)"

Representative executable command:

bash

npx agnic@latest status --json

Technical Analysis

The Skill authorizes and instructs the agent to run agnic@latest directly through npx. The latest npm distribution tag is mutable and can point to a different package release at any time after this Skill has been audited. The project provides no lockfile, package integrity hash, vendored copy, or exact reviewed version constraint.

When the command is invoked, npx may download and execute code from the npm registry. Consequently, the effective executable payload is controlled by the current state of the external package and its publishing infrastructure rather than by the reviewed project. A compromised package publisher, npm account, release workflow, or dependency chain could introduce arbitrary behavior without requiring any modification to SKILL.md.

Attack Path

1. An attacker compromises the agnic npm publisher account, its build or release pipeline, or a transitive dependency.
2. The attacker publishes a malicious release and assigns it to the latest distribution tag.
3. A user invokes this Skill to authenticate a wallet, check status, or log out.
4. The agent executes an allowed npx agnic@latest ... command.
5. npx retrieves and executes the attacker-controlled package under the privileges of the agent user.
6. The malicious package can access data available to that process, potentially including environment variables, wallet authentication material, user files, and network resources.

Impact Assessment

Successful exploitation permits ...[truncated 430 chars]

Remediation

View remediation

Remediation Suggestions

• Replace agnic@latest with an exact, security-reviewed package version, such as agnic@X.Y.Z.
• Manage the CLI through a committed lockfile and use deterministic installation such as npm ci.
• Verify package integrity through an approved registry, integrity hashes, signed provenance, or equivalent supply-chain controls.
• Review new package versions before updating the pinned version.
• Run the CLI with the minimum required operating-system permissions and in an isolated environment where practical.
• Restrict access to unrelated environment variables and files before invoking the external CLI.
• Configure automated dependency scanning and publisher/provenance verification for future updates.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

API Token Exposure Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37-40
Vulnerability Type: Sensitive credential exposure through process arguments and command history
Risk Level: Medium

Vulnerable Code

markdown

**Option B -- Inline flag** (one-off commands):
```bash
npx agnic@latest --token <your-api-token> status --json

text

### Technical Analysis

The documented inline authentication option places the API token directly in the command-line argument list. Command-line secrets can be exposed through shell history, process-monitoring interfaces, terminal session recording, diagnostic output, audit systems, CI logs, wrapper scripts, or error reports.

On systems where process arguments are visible to other local users or monitoring agents, the token may be captured while the command is running. Even after execution, it can persist in shell history or centralized logs. This exposure is avoidable because the Skill already documents the `AGNIC_TOKEN` environment-variable method.

### Attack Path

1. A user follows the documented inline-token example and substitutes a valid API token.
2. The shell records the command in history, or process-monitoring and logging infrastructure captures the argument list.
3. A local user, administrator, log reader, monitoring integration, or attacker with access to the resulting records obtains the token.
4. The attacker submits the stolen token to the Agnic service before it expires or is revoked.
5. The attacker gains the API and wallet-related access granted to that token.

### Impact Assessment

The attacker can obtain the same service-level permissions granted to the exposed API token. The precise scope depends on server-side token permissions and spending limits, which are not defined in the reviewed file. Potential consequences include unauthorized account access, wallet operations allowed by the token, disclosure of account metadata, and consumption of associated service resources. This finding does not 
...[truncated 58 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the inline --token example and discourage passing secrets through command-line arguments.
• Use AGNIC_TOKEN only in a narrowly scoped process environment rather than exporting it globally or persisting it in shell startup files.
• Prefer an operating-system credential store, CI secret manager, or a CLI mechanism that reads the token from standard input or a protected file descriptor.
• Ensure CI and terminal logging systems redact the token and related authorization values.
• Clear any shell history or logs that may already contain real tokens, subject to organizational retention requirements.
• Revoke and regenerate any token suspected of having appeared in process listings, shell history, recordings, or logs.
• Apply minimum token scopes, conservative spending limits, short validity periods, and regular rotation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The second manifest finding is also valid because both allowed-tools entries independently authorize unpinned @latest execution paths. In a skill that handles authentication and secrets, this context increases danger because any compromised update could directly target credential collection or token theft.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill executes npx agnic@latest ..., which is not an immutable pin and will always resolve to whatever package is currently published under that tag. This creates a supply-chain risk: if the package is compromised, replaced, or a malicious update is published, users of the skill may run attacker-controlled code during authentication flows that handle tokens and local credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The allowed tool declaration permits npx agnic@latest auth *, which means future invocations may execute whatever code the latest published package contains. Because this skill is specifically about authentication, compromise of that package could expose API tokens, browser OAuth tokens, or wallet-related credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This status-check command uses npx agnic@latest, introducing runtime dependency on a mutable upstream package even for a seemingly read-only operation. An attacker controlling a future release could execute arbitrary code in the user's environment whenever the skill checks authentication status.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

Using npx agnic@latest status --json after exporting AGNIC_TOKEN is particularly sensitive because the command runs in an environment containing a live secret. A compromised future package version could read and exfiltrate AGNIC_TOKEN or other environment variables during execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence

Finding

The inline-token example passes a sensitive API token directly to npx agnic@latest, combining unpinned package execution with direct secret handling. If the package or its dependency chain is compromised, the token can be captured immediately; command-line tokens may also be exposed through process listings or shell history.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The browser OAuth login flow is initiated through npx agnic@latest auth login, so a mutable package controls the local callback server, browser launch, and token exchange process. That makes this especially dangerous in context because a malicious update could intercept OAuth codes, harvest refresh tokens, or spoof authentication UX.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The verification command again relies on npx agnic@latest, preserving the same supply-chain exposure throughout the skill lifecycle. Even though this step is post-authentication, it may still execute in a context containing stored credentials or refreshed session state.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The logout example still runs an unpinned package, which could execute arbitrary code while accessing local credential files during sign-out. Although impact is somewhat lower than login or token-entry steps, it still provides a code-execution foothold in a security-sensitive workflow.

Content

No source excerpt is available for this finding.