ClawHub
Back to skill

Security audit

Agnic Fund Wallet

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for funding an Agnic wallet, but it steers a financial workflow through a mutable CLI package and gives under-scoped credential guidance.

Review this skill before installing. Prefer a pinned, reviewed Agnic CLI version, avoid passing tokens on the command line, keep AGNIC_TOKEN out of chats and logs, and verify any wallet address through an independent trusted Agnic channel before sending USDC.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:10
Finding

Execution of an Unpinned Third-Party CLI Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–13
Vulnerability Type: Supply-chain exposure through a mutable npm package tag
Risk Level: High

Vulnerable Code:

yaml
allowed-tools:
  - "Bash(npx agnic@latest status*)"
  - "Bash(npx agnic@latest address*)"
  - "Bash(npx agnic@latest balance*)"

Technical Analysis

The skill authorizes execution of npx agnic@latest. The npm latest tag is mutable, so the code executed during a future invocation may differ from the code available when the skill was audited. When the package is not already installed, npx can retrieve and execute it at runtime.

No reviewed version, lockfile integrity value, or other immutable package identifier is specified. A compromised package release, npm publisher account, or mutable distribution tag could therefore introduce arbitrary code without requiring changes to this repository. The risk is amplified because the CLI supplies the cryptocurrency address to which users are instructed to transfer USDC.

Attack Path

  1. An attacker compromises the agnic npm package, its publisher account, or a release referenced by the latest tag.
  2. The attacker publishes a malicious version and assigns it to latest.
  3. The agent invokes an allowed command such as npx agnic@latest address.
  4. npx downloads and executes the malicious package in the agent's environment.
  5. The package executes arbitrary code with the privileges of the agent process, accesses data available to that process, or returns an attacker-controlled wallet address.
  6. If the displayed address is trusted, the user may irreversibly transfer USDC to the attacker.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user or service running the agent. Data accessible to that process—including environment variables and potentially AGNIC_TOKEN—could be read or modified. A substituted walle ...[truncated 359 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace agnic@latest with an explicitly pinned and reviewed version.
  • Use a lockfile and verify package integrity through trusted registry metadata or an independently validated checksum.
  • Prefer a preinstalled, reviewed executable rather than downloading executable code when the skill runs.
  • Verify the package publisher, provenance, signatures, and release process before deployment.
  • Run the CLI in a restricted environment with minimal filesystem, environment-variable, and network access.
  • Require users to verify the destination address through a separate trusted channel, such as the authenticated dashboard, before transferring funds.
  • Establish an update process in which new CLI versions are reviewed and tested before changing the pinned version.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:23
Finding

Authentication Token May Be Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 23
Vulnerability Type: Insecure secret handling through process arguments
Risk Level: Medium

Vulnerable Code:

text
- **Headless (CI/server/agent)**: Set `AGNIC_TOKEN` env var or pass `--token <token>`

Technical Analysis

The documentation recommends passing an authentication token through the --token command-line option. Command-line arguments can be exposed through process inspection, shell history, CI job output, diagnostic telemetry, audit logs, command transcripts, or error reports.

Any party or process able to inspect those channels may recover the plaintext token. Although the environment-variable alternative is generally preferable to a command-line argument, environment variables must also be injected and logged securely.

Attack Path

  1. A user follows the documented guidance and invokes the CLI with --token followed by a valid token.
  2. The command or process arguments are retained in shell history, agent transcripts, CI logs, process listings, or monitoring records.
  3. Another user, process, administrator, or party with access to those records retrieves the token.
  4. The attacker reuses the token to authenticate to Agnic.
  5. The attacker gains whatever account and wallet-management capabilities are authorized by that token until it expires or is revoked.

Impact Assessment

Exploitation may result in unauthorized access to the associated Agnic account and any operations permitted by the exposed token. The precise privilege level and financial impact depend on the token's server-side scope, expiration, and authorization controls, which are not defined in the reviewed file.

This finding does not establish that the token directly permits fund transfers. It establishes a credible credential-disclosure path that could allow impersonation within the token's granted privileges.

Remediation
View remediation

Remediation Suggestions

  • Remove the recommendation to pass secrets through --token.
  • Prefer an operating-system credential store, CI secret manager, protected configuration file, or secure environment injection.
  • If interactive entry is supported, read the token from standard input without echoing it.
  • Ensure CI systems mask the token and do not print expanded commands or secret-bearing environment values.
  • Prevent authentication secrets from appearing in agent transcripts, telemetry, exception messages, and debug output.
  • Apply restrictive token scopes and short expiration periods, and support immediate revocation and rotation.
  • Document a response procedure requiring prompt revocation and replacement of any token suspected of appearing in logs or process arguments.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Rp1

Medium
Category
MCP Rug Pull
Confidence
81% confidence
Finding

A third allowed-tool entry in the manifest also authorizes npx agnic@latest, carrying the same mutable-dependency risk. The skill context matters here because these manifest entries define what the agent may execute, so version drift directly affects runtime trust. That makes this more dangerous than a casual prose mention elsewhere in the file.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are broad enough to match common conversational requests such as 'add funds' or 'need more balance', which can cause the skill to activate unexpectedly. Mis-triggering a wallet-funding workflow can steer users into financial actions or authenticated CLI usage when they may have meant something else, increasing the chance of confusion, disclosure, or unsafe execution. In a finance-adjacent skill, overbroad routing is more sensitive than in a harmless informational domain.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill tells users to set AGNIC_TOKEN or pass --token <token> but does not clearly warn that the token is a secret that must never be pasted into chat, logs, screenshots, or shared terminals. In agent environments, users may copy credentials into the conversation or commands may be recorded in shell history and telemetry, leading to account compromise. The presence of explicit token-passing guidance without a sensitivity warning materially increases credential-handling risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.