ClawHub
Back to skill

Security audit

Polygon PoS Development

Security checks for vulnerabilities and agentic risk

Overview

This Polygon deployment guide is mostly coherent, but it asks users to run unverified remote shell installers and handle private keys while broadcasting blockchain transactions, including mainnet deployments.

Review before installing or following this skill. Use an isolated environment, install Foundry through a verified and pinned method, avoid machines or shells that already hold valuable wallet keys, prefer keystores or hardware/external signers over `--private-key`, use low-value test keys for Amoy, and treat any mainnet `--broadcast` command as an irreversible real-funds action.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:69
Finding

Unverified Remote Foundry Installer Executed Directly by Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:69
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code Snippet:

markdown
- Foundry installed: `curl -L https://foundry.paradigm.xyz | bash && foundryup`

Technical Analysis

The installation command downloads mutable content from an external URL and passes it directly to Bash. The response is not pinned to a specific release and is not subjected to checksum validation, signature verification, inspection, or an integrity check before execution.

Installing Foundry is relevant to the Skill's stated purpose, but direct remote-to-shell execution exceeds the minimum privilege and trust necessary to install it. The effective code can change after the Skill has been reviewed. Compromise of the upstream service, its deployment pipeline, DNS resolution, TLS termination, or another delivery component could therefore turn this instruction into arbitrary code execution.

The subsequent foundryup command also retrieves and installs executable tooling according to upstream state rather than a version and artifact whose integrity has been independently verified.

Attack Path

  1. An attacker compromises the remote installer endpoint or an element of its delivery chain.
  2. The attacker modifies the installer response to include malicious shell commands.
  3. A user or agent follows the prerequisite and executes the documented command.
  4. curl retrieves the attacker's current response.
  5. Bash executes the response immediately without an opportunity for integrity validation or review.
  6. The payload accesses or modifies resources available to the invoking account, potentially including project files, shell configuration, credentials, and blockchain wallet keys.
  7. Because foundryup is chained with &&, additional mutable executable components may be retrieved after the initial script succeeds.

...[truncated 652 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | bash pipeline.
  2. Link users to official installation documentation rather than automatically executing remotely supplied code.
  3. Prefer a version-pinned binary or source archive from the official Foundry release repository.
  4. Download the selected artifact to a local file before execution.
  5. Verify its cryptographic checksum and, where available, its publisher signature against values obtained through a trusted channel.
  6. Require explicit user inspection or approval before running any installer.
  7. Pin the installed Foundry version instead of allowing foundryup to select mutable upstream state.
  8. Perform installation from an unprivileged account or isolated environment, and do not expose wallet keys or API credentials during installation.
  9. Document the expected installer hash, release version, and trusted source so users can reproduce the integrity check.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:117
Finding

Complete Setup Path Pipes a Mutable Remote Installer into Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:117-118
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code Snippet:

bash
curl -L https://foundry.paradigm.xyz | bash
foundryup

Technical Analysis

The setup path instructs users or agents to execute an HTTP response directly as shell code. HTTPS protects transport under normal conditions but does not establish that the response is immutable, tied to a reviewed release, or safe. No version pin, checksum, signature, or local review separates retrieval from execution.

This behavior creates a remote code-execution channel whose payload can change independently of the audited Skill package. Although Foundry installation is necessary for the documented workflow, executing a mutable response with all permissions of the current user is not the least-privilege installation method.

Calling foundryup immediately afterward introduces a related supply-chain exposure because it installs executable components selected from current upstream content rather than an independently verified, pinned artifact.

Attack Path

  1. The upstream installer, publishing account, hosting infrastructure, or delivery path is compromised.
  2. A malicious installer is returned from https://foundry.paradigm.xyz.
  3. A user or autonomous agent follows the complete setup instructions.
  4. Bash executes the malicious response as it is downloaded.
  5. The payload searches the user environment and filesystem for sensitive deployment material or modifies executable and configuration files.
  6. It may exfiltrate discovered credentials over the network or install further payloads within the user's permission boundary.
  7. The user may continue with the guide and place wallet credentials into the environment, increasing the consequences of any malicious modification left by the installer.

Impact Assessment

Successful exploitation provi ...[truncated 542 chars]

Remediation
View remediation

Remediation Suggestions

Replace the instructions with an integrity-verified installation process:

bash
# Illustrative workflow; use an official versioned release URL and published hash.
curl --fail --location --output foundry-release.tar.gz \
  "OFFICIAL_VERSIONED_RELEASE_URL"
echo "EXPECTED_SHA256  foundry-release.tar.gz" | sha256sum --check -

After validation, extract and install the artifact without elevated privileges. The actual release URL and digest must come from Foundry's authenticated official release process rather than placeholders or an untrusted mirror.

Additionally:

  • Pin an explicit Foundry release.
  • Verify publisher signatures when available.
  • Separate download, verification, and execution into distinct steps.
  • Avoid automatic upgrades through mutable release channels.
  • Use a disposable or sandboxed environment for toolchain installation.
  • Ensure private keys and API keys are absent from the process environment during installation.

T03 · Remote Payload Retrieval and Execution

Error
Location
references/foundry-deployment.md:10
Finding

Deployment Reference Executes an Unpinned Remote Installation Script

Content
View full analysis

Vulnerability Details

File Location: references/foundry-deployment.md:10-11
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code Snippet:

bash
curl -L https://foundry.paradigm.xyz | bash
foundryup

Technical Analysis

The deployment reference repeats the unsafe installation pattern by streaming remotely retrieved content directly into Bash. The installer is neither retained for inspection nor authenticated against a pinned checksum or signature. Consequently, the code executed during installation is controlled by mutable upstream state and may differ from what existed when this Skill was audited.

The named domain is represented as Foundry's installer source, and no evidence in the package proves that it is currently malicious. The vulnerability is the unconditional trust and immediate execution model: compromise of any trusted upstream component can become local command execution without requiring changes to the Skill itself.

This is broader than the minimum access needed to support Polygon contract deployment. A safer workflow can install a specific verified Foundry release while limiting execution to the intended binaries.

Attack Path

  1. An attacker gains control over the installer response through an upstream service, account, infrastructure, or delivery-chain compromise.
  2. The attacker adds commands that collect credentials, modify the local toolchain, or download another payload.
  3. A developer follows the deployment guide and runs the installation block.
  4. Bash executes the response immediately with the developer's permissions.
  5. The attacker accesses local repositories and deployment secrets or modifies tools used to build and deploy contracts.
  6. Altered local tooling or stolen private keys can subsequently affect testnet or mainnet deployments.

Impact Assessment

Exploitation permits arbitrary commands under the invoking use ...[truncated 542 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace curl | bash with a documented, version-pinned release installation.
  • Download the artifact first and fail safely on HTTP errors using curl --fail.
  • Validate the artifact against an official SHA-256 or stronger digest and verify a publisher signature where supported.
  • Show the expected version and digest directly in the guide or link to an authenticated release manifest.
  • Require explicit approval before executing downloaded content.
  • Install as an unprivileged user and avoid sudo unless a narrowly scoped operation strictly requires it.
  • Keep blockchain private keys out of environment variables and the filesystem during toolchain installation.
  • Pin CI installations to immutable release identifiers or commit digests rather than floating installer channels.
  • Review and verify foundryup behavior before recommending it as an automatic follow-up step.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (19)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to pipe a remotely fetched script directly into bash, which executes unreviewed code from the network immediately. If the upstream site, transport path, or fetched content is compromised, this can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
### Prerequisites

- Foundry installed: `curl -L https://foundry.paradigm.xyz | bash && foundryup`
- Wallet with private key
- Polygonscan API key (get from https://polygonscan.com/myapikey)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

This is the same unsafe remote script execution pattern in the complete setup path. In a developer skill likely to be followed verbatim, this meaningfully increases the chance of workstation compromise or supply-chain abuse.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

  1. Install Foundry:
bash
curl -L https://foundry.paradigm.xyz | bash
foundryup

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The '| bash' chaining is the dangerous execution step that turns a network fetch into immediate shell execution. In a security-sensitive blockchain development workflow where users also handle private keys, compromising the host can quickly lead to wallet or secret theft.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

  1. Install Foundry:
bash
curl -L https://foundry.paradigm.xyz | bash
foundryup

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

Using curl ... | bash executes remote code directly without giving the user an opportunity to inspect integrity, provenance, or tampering. If the host, network path, or downloaded script is compromised, users could execute arbitrary code leading to workstation compromise, credential theft, or supply-chain infection.

Content

Scanner excerpt · references/foundry-deployment.md (reported line 10)May include surrounding context.

Install Foundry

bash
curl -L https://foundry.paradigm.xyz | bash
foundryup

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The | bash pattern is dangerous because it chains network retrieval directly into execution, eliminating meaningful review or validation. In a blockchain development context, this is especially risky because developer machines often hold private keys, API tokens, deployment artifacts, and wallet tooling that would be valuable to an attacker.

Content

Scanner excerpt · references/foundry-deployment.md (reported line 10)May include surrounding context.

Install Foundry

bash
curl -L https://foundry.paradigm.xyz | bash
foundryup

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 360)May include surrounding context.

Add to .gitignore:

text
.env
broadcast/
deployments/

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 563)May include surrounding context.

Add to .gitignore:

text
.env
broadcast/
deployments/

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/contract-verification.md (reported line 317)May include surrounding context.

Add to .gitignore:

text
.env
broadcast/
deployments/

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/foundry-deployment.md (reported line 85)May include surrounding context.

Add to .gitignore:

text
.env
broadcast/
deployments/

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The mainnet deployment section includes a broadcast command that will submit real transactions, but the warning does not explicitly state that this uses real funds and creates irreversible on-chain effects. In a blockchain deployment skill, that omission can cause users or agents to execute costly production actions too casually, especially because nearby sections emphasize speed and agent-friendly workflows.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 381)May include surrounding context.

--verify

text

**Option 3: Deploy without verification**
```bash
forge script script/Deploy.s.sol \
    --rpc-url amoy \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guide instructs users to supply --private-key $PRIVATE_KEY on the command line without warning that secrets passed as CLI arguments may be exposed through shell history, process listings, CI logs, or telemetry. In blockchain workflows, exposure of a deployer private key can immediately lead to wallet compromise and irreversible asset loss.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
[etherscan]
amoy = { key = "${POLYGONSCAN_API_KEY}", url = "https://api-amoy.polygonscan.com/api" }
polygon = { key = "${POLYGONSCAN_API_KEY}", url = "https://api.polygonscan.com/api" }

# Amoy testnet profile
[profile.amoy]

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/contract-verification.md (reported line 115)May include surrounding context.

md
[etherscan]
amoy = { key = "${POLYGONSCAN_API_KEY}", url = "https://api-amoy.polygonscan.com/api" }
polygon = { key = "${POLYGONSCAN_API_KEY}", url = "https://api.polygonscan.com/api" }

# Amoy testnet profile
[profile.amoy]

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/foundry-deployment.md (reported line 56)May include surrounding context.

md
[etherscan]
amoy = { key = "${POLYGONSCAN_API_KEY}", url = "https://api-amoy.polygonscan.com/api" }
polygon = { key = "${POLYGONSCAN_API_KEY}", url = "https://api.polygonscan.com/api" }

# Amoy testnet profile
[profile.amoy]

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file includes a command to deploy to Polygon mainnet with --broadcast, which will submit real transactions and consume funds. Although it says to test on Amoy first, it does not clearly warn that mainnet deployment is irreversible and will spend real assets, which is the kind of user/system-impact warning required for markdown guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide shows transaction-sending commands using a private key and broadcast flags against a live testnet without a prominent warning that these commands sign and submit real network transactions. In blockchain tooling, users often copy-paste commands, so this can lead to accidental exposure or unsafe handling of private keys and unintended on-chain actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The documentation instructs users to run a Docker image by name without pinning a version tag or immutable digest. This creates a supply-chain risk because future image changes or a compromised latest/default tag could cause users to execute unexpected or malicious analysis code on their machine.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
references/foundry-deployment.md:55

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:144