wachaimandates

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:10 AM UTC
• Version: 1.0.2

Overview

The skill is coherent for managing signed agent agreements, but users should treat its wallet and mandate files as sensitive and install the CLI carefully.

Before installing, consider using a pinned version or isolated environment instead of a global latest npm install. Protect ~/.wachai/wallet.json as private key material, avoid shared or synced storage directories, and inspect received or old mandates before signing, sending, or relying on them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39–44
Vulnerability Type: Unpinned third-party dependency and unsafe global installation
Risk Level: Medium

Vulnerable Code Snippet

markdown

### Install

```bash
npm install -g @quillai-network/wachai
wachai --help

text

### Technical Analysis

The skill directs users to globally install and execute the latest available version of the external npm package `@quillai-network/wachai`. The installation command does not specify an exact reviewed version, integrity hash, lockfile, or other reproducible verification mechanism.

npm packages can execute lifecycle scripts during installation. Consequently, the effective code executed by this instruction can change after the skill has been reviewed. Global installation also makes the package executable broadly in the user's environment and can increase the consequences of a compromised package release.

Although the package scope and documented GitHub organization appear consistent by name, that does not establish package integrity or protect against publisher-account compromise, registry compromise, or a malicious future release.

### Attack Path

1. An attacker compromises the npm publisher account, package build pipeline, or another component of the package's distribution chain.
2. The attacker publishes a malicious release under the existing `@quillai-network/wachai` package name.
3. A user follows the skill instruction and runs `npm install -g @quillai-network/wachai`.
4. npm retrieves the current package version rather than a previously reviewed, immutable version.
5. Malicious lifecycle code may execute during installation, or malicious program logic may execute when the user runs `wachai`.
6. The malicious package operates with the privileges of the installing user and may access files, credentials, wallet data, or mandate records available to that account.

### Impact Assessment

Succe
...[truncated 780 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, security-reviewed version rather than installing the moving latest release:

   bash

   npm install -g @quillai-network/wachai@<reviewed-exact-version>
   

2. Document the expected package integrity hash and verify it against a trusted release channel before installation.
3. Require npm package provenance and signed, reproducible releases where supported.
4. Provide a lockfile or an equivalent immutable dependency manifest covering the CLI and its transitive dependencies.
5. Prefer project-local installation in a constrained environment over global installation, reducing executable-path exposure and limiting impact.
6. Review package lifecycle scripts and disable them during installation with --ignore-scripts where the package can function without them.
7. Run the CLI under a dedicated low-privilege account or sandbox with access restricted to the minimum necessary wallet, mandate, and network resources.
8. Protect wallet files using restrictive filesystem permissions and, where supported, encryption backed by an operating-system credential store or hardware wallet.
9. Establish a release-review process that repeats dependency and source-code auditing before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 62% confidence

Finding

The skill normalizes creating, signing, verifying, and receiving mandates that are then saved locally and reused across sessions, which introduces session persistence and durable state. In this context, persistent mandate and wallet state can be security-relevant because an agent may later act on previously stored agreements or messages without a clear re-validation step, especially when mandates are exchanged over XMTP and saved automatically.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

- a basis to **rank/repute** counterparties over time (e.g., did they consistently complete what they signed?)

`wachai` is a CLI that lets agents:
- create mandates (`create-mandate`)
- sign mandates (`sign`)
- verify mandates (`verify`)
- share mandates over XMTP (`xmtp send` / `xmtp receive`)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill instructs users to initialize and use a local wallet file and local mandate storage, but it does not explicitly warn that these files may contain sensitive cryptographic material and durable agreement records. In an agent context, silent local persistence can increase the chance of accidental key exposure through weak filesystem permissions, backups, shared workspaces, or careless handling of portable test directories.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.