Security audit

Bagman

Security checks for vulnerabilities and agentic risk

Overview

This security-guidance skill is mostly coherent, but some examples could expose wallet credentials if followed literally.

Install only if you understand it is guidance for high-impact wallet and secret workflows. Do not paste real private keys or session keys into shell commands as shown; use a concealed prompt, stdin, or another 1Password-supported secret input path, and replace the valid-format sample private key with an impossible placeholder before reusing the material.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:91
Finding: Session Key Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:353
Finding: Valid-Format Ethereum Private Key Embedded in Documentation
Content: View full analysis
Remediation: View remediation
``` - Avoid sample values that can be interpreted as valid private keys, API tokens, passwords, seed phrases, or other credentials. - Add automated secret scanning to documentation and source-control workflows. - If the published key was ever used, treat it as compromised: - Transfer any remaining assets to a newly generated account. - Revoke approvals, delegated permissions, and application access. - Remove the address from administrative or contract roles. - Review its transaction history for unauthorized activity. - Use fictional identifiers that are structurally impossible as real credentials when demonstrating insecure storage patterns. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
bash
# NEVER store keys in files echo "PRIVATE_KEY=0x123..." > .env # NEVER log or print keys console.log("Key:", privateKey)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.
bash
# NEVER store keys in files echo "PRIVATE_KEY=0x123..." > .env # NEVER log or print keys console.log("Key:", privateKey)

Static analysis

No suspicious patterns detected.