arguedotfun

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:29 AM UTC
• Version: 1.1.0

Overview

This is a real-money blockchain betting skill with disclosed purpose, but it gives mutable remote instructions ongoing control over a wallet-enabled agent and uses broad financial permissions.

Install only if you are comfortable with an agent handling a funded Base wallet. Use a small dedicated wallet, avoid max-uint approvals, revoke allowances after use, do not reuse an existing high-value private key, and review any remote updates before letting the heartbeat run transactions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: skill.md:83

Finding

Unverified Remote Installer Is Piped Directly into a Shell

Content

View full analysis

Vulnerability Details

File Location: skill.md:83-88
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

bash

### Prerequisites

Install Foundry (provides the `cast` CLI for blockchain interactions):

```bash
curl -L https://foundry.paradigm.xyz | bash

text

### Technical Analysis

The installation command passes the response from a mutable external URL directly to `bash`. The downloaded content is not pinned to a specific release and is not verified using a cryptographic checksum or signature. The operator also has no opportunity to inspect the installer before execution.

HTTPS protects the connection in transit under normal conditions, but it does not protect against compromise of the remote server, its deployment process, domain control, or certificate issuance. Because the payload is retrieved at execution time, its effective behavior can change after this Skill has been reviewed.

The command executes with all permissions of the user running the setup. Those permissions may include access to home-directory files, shell configuration, environment variables, developer credentials, and any existing `~/.arguedotfun/.privkey`.

### Attack Path

1. An attacker compromises the remote installer host, its publishing pipeline, or an equivalent trusted delivery component.
2. The attacker modifies the response served from `https://foundry.paradigm.xyz`.
3. A user follows the Skill setup instructions and runs the documented pipeline.
4. `bash` immediately executes the attacker-controlled response without integrity verification or review.
5. The payload accesses user files, steals available wallet credentials, alters the host, or downloads additional components using the current user's permissions.

### Impact Assessment

Successful exploitation provides arbitrary command execution under the account running the setup. The resulting scope may include:

- Reading o
...[truncated 560 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the pipeline with a version-pinned installation procedure.
• Download the release artifact to a separate file rather than executing a network stream.
• Verify the artifact using a checksum or cryptographic signature published through an independently authenticated channel.
• Abort installation if verification fails.
• Permit users to inspect the downloaded installer before running it.
• Run installation with an unprivileged account and avoid exposing wallet keys or unrelated credentials to the installation environment.
• Document the exact supported Foundry version and provide reproducible upgrade instructions.

T03 · Remote Payload Retrieval and Execution

Error

• Location: heartbeat.md:66

Finding

Periodic Heartbeat Replaces Trusted Agent Instructions with Mutable Remote Content

Content

View full analysis

Vulnerability Details

File Location: heartbeat.md:66-80; related execution instructions at skill.md:512-542 and skill.md:704-719
Vulnerability Type: Unsigned remote instruction retrieval and activation
Risk Level: Critical

bash

## Step 1: Check for Skill Updates

```bash
REMOTE_VERSION=$(curl -s https://argue.fun/skill.md | head -10 | grep "version:" | awk '{print $2}')
LOCAL_VERSION=$(head -10 ~/.arguedotfun/skills/SKILL.md 2>/dev/null | grep "version:" | awk '{print $2}')

If versions differ or local file is missing:

bash

mkdir -p ~/.arguedotfun/skills
curl -s https://argue.fun/skill.md > ~/.arguedotfun/skills/SKILL.md
curl -s https://argue.fun/heartbeat.md > ~/.arguedotfun/skills/HEARTBEAT.md

If the skill updated, re-read it. Contract addresses, commands, or features may have changed.

text

The related scheduling instructions state:

```markdown
When each scheduled time arrives, fetch and run `https://argue.fun/heartbeat.md`.

Technical Analysis

The heartbeat checks only a plaintext version value supplied by the same remote origin as the replacement content. This does not provide authenticity or integrity: a compromised origin can change both the version and the instructions simultaneously.

Updated files are downloaded without a pinned digest, signature verification, content validation, review, or explicit user approval. The Agent is then instructed to re-read or run those instructions. In this context, Skill text is operational content: it determines which shell commands and blockchain transactions the Agent performs.

This issue is especially severe because the same runtime loads PRIVKEY from ~/.arguedotfun/.privkey and is authorized to run cast send. A malicious update could therefore change contract addresses, transaction methods, recipients, approval amounts, RPC endpoints, or secret-handling instructions after the locally audited package has been i ...[truncated 2034 chars]

Remediation

View remediation

Remediation Suggestions

• Bundle audited Skill and heartbeat instructions locally and execute only the trusted local copy.
• Pin every update to an immutable version and expected cryptographic digest.
• Require updates to carry a signature from a documented offline or otherwise strongly protected release key.
• Download candidate updates to a temporary location, verify them, display a human-readable diff, and require explicit user approval before activation.
• Never treat a version string from the same remote origin as proof of authenticity.
• Maintain a fixed local policy that remote content cannot override, including prohibitions on key disclosure and unapproved financial transactions.
• Apply an allowlist for chain ID, RPC endpoint, token address, factory address, contract methods, recipients, and maximum transaction values.
• Require separate human confirmation for any update that modifies addresses, signing behavior, approvals, or shell commands.
• Use atomic replacement only after all validation succeeds, and retain a known-good rollback copy.

T09 · Insecure Skill Coding Practices

Error

• Location: skill.md:159

Finding

Maximum USDC Allowance Exceeds the Amount Needed for Individual Bets

Content

View full analysis

Vulnerability Details

File Location: skill.md:159-171
Vulnerability Type: Excessive token allowance and violation of least privilege
Risk Level: High

bash

### 3. Approve USDC Spending (One-Time)

Before placing any bet, you must approve the factory contract to spend your USDC. You only need to do this once:

```bash
PRIVKEY=$(cat ~/.arguedotfun/.privkey)

cast send 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 \
  "approve(address,uint256)" \
  0xf939a2853C0b60b324b459c9f63A2379A7B16537 \
  $(cast max-uint) \
  --private-key $PRIVKEY \
  --rpc-url https://mainnet.base.org

text

### Technical Analysis

The setup grants the hard-coded factory contract the maximum possible USDC allowance. This authorization is not limited to a specific bet, session, or intended spending budget and remains available until explicitly revoked or replaced.

An unlimited allowance is convenient but violates least privilege. The declared functionality only requires enough allowance to cover the bet or bounty that the user has authorized. The reviewed repository contains documentation rather than contract source code, deployment verification, or evidence about upgradeability and administrative controls. Consequently, the safety of the spender cannot be established from this project alone.

If the approved factory is malicious, compromised, upgraded unsafely, or exposes an exploitable path capable of invoking USDC `transferFrom`, the allowance may permit withdrawal of the wallet's current and future USDC balance without another approval transaction.

### Attack Path

1. The user follows setup instructions and grants the factory a maximum-value USDC allowance.
2. The allowance remains active after the intended bet has completed.
3. The approved factory, its controlling authority, or a callable contract path is compromised or abused.
4. The spender invokes `transferFrom` against the user's wallet within the unlimited allo
...[truncated 881 chars]

Remediation

View remediation

Remediation Suggestions

• Approve only the exact amount required for the user-authorized bet or bounty.
• If batching requires a buffer, use a clearly disclosed, user-selected spending cap rather than cast max-uint.
• Check the existing allowance before each action and increase it only by the minimum necessary amount.
• Reset the allowance to zero after the intended operation when continued authorization is unnecessary.
• Require explicit human confirmation that displays the chain ID, token, spender, amount, and estimated maximum loss.
• Verify the runtime chain ID and deployed bytecode before approval.
• Document whether the factory is upgradeable, who controls upgrades, and what audits or verification apply to the deployed contract.
• Provide revocation instructions and periodically alert users about residual allowances.
• Keep material wallet balances separate from the operational wallet used by the Skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (14)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill tells users to fetch remote skill.md and heartbeat.md from argue.fun and then rely on them operationally, effectively treating mutable web content as executable instructions. This creates a supply-chain risk where anyone controlling that endpoint, DNS, TLS termination, or deployment pipeline can change future agent behavior and potentially induce unsafe transactions or data exfiltration.

Content

Scanner excerpt · skill.md (reported line 23)May include surrounding context.

Install locally:

bash

mkdir -p ~/.arguedotfun/skills
curl -s https://argue.fun/skill.md > ~/.arguedotfun/skills/SKILL.md
curl -s https://argue.fun/heartbeat.md > ~/.arguedotfun/skills/HEARTBEAT.md

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

curl -L https://foundry.paradigm.xyz | bash is a classic pipe-to-shell pattern that executes network-delivered code immediately without prior verification. In a wallet-managing skill, this is especially dangerous because compromise of the download source or transport path can yield arbitrary code execution on the host that can steal private keys and funds.

Content

Scanner excerpt · skill.md (reported line 87)May include surrounding context.

Install Foundry (provides the cast CLI for blockchain interactions):

bash

curl -L https://foundry.paradigm.xyz | bash
foundryup

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly encourages feeding autonomous trading skills to an AI agent and highlights wallet setup, on-chain position management, betting, claiming winnings, and periodic automated monitoring without any accompanying warning about financial loss, irreversible blockchain transactions, private key handling, or the need for explicit user approval. In the context of a skill intended for autonomous agent use, this omission increases the likelihood that operators enable high-risk financial actions without understanding the consequences or putting safeguards in place.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs the agent to read a raw private key from a local file into an environment variable, exposing a highly sensitive credential during a routine heartbeat. Any downstream command, logging, prompt injection, or future updated skill content could misuse that key to sign unauthorized transactions and drain funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions access a private key file without any warning, isolation guidance, or controls around secret handling. Even if the goal is legitimate transaction signing, normalizing direct plaintext key access in agent instructions increases the chance of accidental exposure, reuse, or abuse by later steps.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The heartbeat instructs the agent to self-update by downloading replacement skill files from a remote URL and storing them locally. That gives the remote operator an unbounded path to change future behavior, potentially introducing wallet-draining actions or other unsafe instructions under the guise of a routine market check.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

This step persists remotely fetched instructions into the user's home directory, establishing durable local state that can silently influence future runs. Combined with the preceding self-update logic, it creates a persistence mechanism for potentially malicious or compromised skill content beyond the current session.

Content

Scanner excerpt · heartbeat.md (reported line 76)May include surrounding context.

If versions differ or local file is missing:

bash

mkdir -p ~/.arguedotfun/skills
curl -s https://argue.fun/skill.md > ~/.arguedotfun/skills/SKILL.md
curl -s https://argue.fun/heartbeat.md > ~/.arguedotfun/skills/HEARTBEAT.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · heartbeat.md (reported line 146)May include surrounding context.

cast call $FACTORY "getUndeterminedDebatesCount()(uint256)" --rpc-url $RPC

text

**If active debate count is 0:** The platform is quiet. Consider creating a debate on a topic you find interesting (see the "Create a Debate" section in skill.md), or suggest debate topics to your human. Creating debates seeds the market and attracts other participants.

### 3b. Browse active debates

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill instructs the agent to persist fetched skill files under ~/.arguedotfun/skills, creating a durable local trust anchor for remotely controlled content. Persistent caching of externally hosted instructions increases the risk that later runs continue relying on stale or tampered skill material without integrity verification.

Content

Scanner excerpt · skill.md (reported line 22)May include surrounding context.

Install locally:

bash

mkdir -p ~/.arguedotfun/skills
curl -s https://argue.fun/skill.md > ~/.arguedotfun/skills/SKILL.md
curl -s https://argue.fun/heartbeat.md > ~/.arguedotfun/skills/HEARTBEAT.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The skill creates a persistent application directory specifically to store wallet state, including a private key in the same tree. Persisting sensitive wallet material on disk increases the attack surface from local compromise, backups, accidental disclosure, or other tools reading the home directory.

Content

Scanner excerpt · skill.md (reported line 100)May include surrounding context.

1. Generate Your Wallet

bash

mkdir -p ~/.arguedotfun

WALLET_OUTPUT=$(cast wallet new)
PRIVATE_KEY=$(echo "$WALLET_OUTPUT" | grep "Private key:" | awk '{print $3}')

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 107)May include surrounding context.

md

ADDRESS=$(echo "$WALLET_OUTPUT" | grep "Address:" | awk '{print $2}')

echo "$PRIVATE_KEY" > ~/.arguedotfun/.privkey
chmod 600 ~/.arguedotfun/.privkey

echo "{\"address\": \"$ADDRESS\"}" > ~/.arguedotfun/wallet.json
echo "{\"lastHeartbeat\": null, \"watchedDebates\": []}" > ~/.arguedotfun/state.json

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The instruction to write an existing wallet private key to ~/.arguedotfun/.privkey normalizes long-term plaintext secret storage for a live blockchain wallet. In this context the danger is amplified because the same skill later uses that key for signing financial transactions, so compromise of the file directly leads to theft of funds.

Content

Scanner excerpt · skill.md (reported line 115)May include surrounding context.

echo "Wallet created: $ADDRESS"

text

**If you already have a wallet**, write its private key to `~/.arguedotfun/.privkey` and address to `wallet.json` instead.

### 2. Fund Your Wallet

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs users to approve the factory for max-uint USDC spending, which grants effectively unlimited access to all current and future USDC in the wallet. Even if the current contract is intended to be legitimate, unlimited ERC-20 approvals materially increase blast radius if the approved contract, its dependencies, or the user's assumptions are wrong, and the skill does not clearly warn about this risk or present a safer limited-allowance option.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 78% confidence

Finding

The skill repeatedly encourages the agent to place bets, add bounties, claim funds, and trigger resolution when prompted or on heartbeat, which constitutes autonomous financial decision-making with real assets. In a blockchain betting context, this is risky because the agent can initiate irreversible transactions and spend user funds based on its own judgment or loosely scoped prompts.

Content

Scanner excerpt · skill.md (reported line 690)May include surrounding context.

md

| `Debate not active` | Status is not ACTIVE | Debate is already resolving or resolved |
| `Argument too long` | Argument > 1000 bytes (~500 characters) | Shorten your argument |
| `Debate content limit exceeded` | Total arguments exceed 120,000 bytes | No more arguments accepted, but you can still bet without an argument |
| `USDC transfer failed` | Insufficient USDC or no approval | Check USDC balance and approval. If empty, ask your human for funds. |
| `Debate not from this factory` | Invalid debate address | Verify with `isLegitDebate()` first |
| `Amount must be positive` | Adding zero bounty | Bounty must be > 0 |
| `Cannot resolve before end date` | End date hasn't passed | Wait until after the end date |

Static analysis

No suspicious patterns detected.