Authenticate Openant

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:33 AM UTC
• Version: 0.1.2

Overview

This authentication skill is coherent in purpose, but it gives an agent high-impact account and wallet-adjacent authority through an unpinned runtime CLI and some broad automatic actions.

Review this skill before installing. It is not clearly malicious, but it should ideally pin the OpenAnt CLI to a reviewed version, narrow wallet permissions to exact read-only commands, and require confirmation before key login, agent registration, heartbeat/profile publication, and email recovery changes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Mutable npm Package Version Is Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6-11 and command examples throughout lines 18-102
Vulnerability Type: Supply-chain risk caused by execution of an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: ["Bash(npx @openant-ai/cli@latest status*)", "Bash(npx @openant-ai/cli@latest login*)", "Bash(npx @openant-ai/cli@latest verify*)", "Bash(npx @openant-ai/cli@latest whoami*)", "Bash(npx @openant-ai/cli@latest agents register*)", "Bash(npx @openant-ai/cli@latest agents heartbeat*)", "Bash(npx @openant-ai/cli@latest wallet *)", "Bash(npx @openant-ai/cli@latest bind-email*)", "Bash(npx @openant-ai/cli@latest logout*)"]

bash

npx @openant-ai/cli@latest status --json

Technical Analysis

The skill executes @openant-ai/cli using the mutable npm tag latest. An npx invocation can download and immediately execute package code when the requested version is not already available locally. The code ultimately executed by this skill can therefore change after the skill itself has been reviewed.

The project contains no package lockfile, integrity hash, vendored dependency, or exact version constraint that binds these commands to a reviewed CLI artifact. Although there is no evidence in the audited file that the current package is malicious, this configuration creates a supply-chain exposure: compromise of the package publisher, npm account, package distribution channel, or a future release could affect every documented operation.

Attack Path

1. An attacker compromises the npm package publisher or otherwise gains the ability to publish or retag @openant-ai/cli.
2. The attacker publishes a malicious release and causes the npm latest tag to resolve to it.
3. The agent invokes any permitted command, such as npx @openant-ai/cli@latest status --json.
4. npx retrieves and executes the changed package code.
5. The package executes with t ...[truncated 587 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @openant-ai/cli@latest with an exact, reviewed version, such as @openant-ai/cli@X.Y.Z.
• Install the dependency through a package manifest and lockfile that records package integrity metadata.
• Use a controlled dependency-update process that reviews release changes before updating the pinned version.
• Where feasible, install the approved CLI artifact ahead of time rather than permitting npx to retrieve executable code during skill invocation.
• Consider enforcing an approved registry and validating package provenance or signatures in the deployment pipeline.
• Re-audit the dependency whenever its pinned version is changed.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:6

Finding

Authentication Skill Grants Overly Broad Wallet Command Permission

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 6; documented wallet operations at lines 99-100
Vulnerability Type: Overly broad tool authorization that violates least privilege
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: ["Bash(npx @openant-ai/cli@latest status*)", "Bash(npx @openant-ai/cli@latest login*)", "Bash(npx @openant-ai/cli@latest verify*)", "Bash(npx @openant-ai/cli@latest whoami*)", "Bash(npx @openant-ai/cli@latest agents register*)", "Bash(npx @openant-ai/cli@latest agents heartbeat*)", "Bash(npx @openant-ai/cli@latest wallet *)", "Bash(npx @openant-ai/cli@latest bind-email*)", "Bash(npx @openant-ai/cli@latest logout*)"]

The documented wallet use is limited to the following read-only commands:

markdown

| `npx @openant-ai/cli@latest wallet addresses --json` | List Solana + EVM wallet addresses |
| `npx @openant-ai/cli@latest wallet balance --json` | Check on-chain balances |

Technical Analysis

The permission pattern Bash(npx @openant-ai/cli@latest wallet *) authorizes an arbitrary wallet subcommand and arbitrary trailing arguments. This is broader than both the stated authentication purpose of the skill and the two documented read-only wallet operations.

The wildcard does not technically enforce that the invoked operation is limited to listing addresses or checking balances. Consequently, any additional wallet subcommand supported by the installed or future CLI version may fall within the granted tool permission. The use of the mutable latest version compounds this boundary problem because the available wallet command surface may change over time.

There is no evidence in SKILL.md that a specific state-changing wallet operation is currently invoked. The confirmed issue is the excessive authorization boundary, while exploitation depends on the commands supported by the effective CLI version and the agent's authenticated privileges.

Attack Path

...[truncated 1227 chars]

Remediation

View remediation

Remediation Suggestions

• Remove wallet permissions from this authentication-focused skill unless they are strictly required.
• Replace the wildcard permission with exact read-only command patterns for wallet addresses --json and wallet balance --json.
• Reject additional arguments rather than permitting unrestricted suffix matching.
• Place any state-changing wallet functionality in a separate, narrowly scoped skill.
• Require explicit human confirmation for transfers, signing, account changes, or other financially sensitive operations.
• Pin the CLI version so future wallet subcommands cannot silently expand the effective permission surface.
• Apply server-side authorization and transaction confirmation controls rather than relying exclusively on skill-level command matching.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (28)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence

Finding

The manifest and the skill body repeatedly invoke npx @openant-ai/cli@latest, which fetches and executes the newest package version at runtime rather than a reviewed immutable version. In an authentication skill, this is especially dangerous because any upstream compromise, malicious release, or breaking change would run in a privileged context that handles sessions, keys, wallet data, and account registration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description says to use the skill whenever operations fail with generic messages like 'Authentication required' or 'not signed in,' making invocation broadly triggerable across many workflows. In combination with autonomous execution and unpinned npx commands, this increases the chance the agent will launch sensitive auth and registration actions in contexts where a narrower, safer recovery path should be chosen.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence

Finding

The allowed-tools list authorizes execution of npx @openant-ai/cli@latest ..., which delegates trust to whatever package version is current at invocation time. Because this skill is used for login, registration, identity, wallet, and email-binding flows, a malicious or compromised upstream package could steal credentials, private key material, OTPs, or alter account actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill instruction to use npx @openant-ai/cli@latest for status checks still executes unpinned remote code. Even read-like commands are risky here because the package startup code itself can perform arbitrary actions before handling the requested subcommand.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The login step uses an unpinned package at the moment sensitive authentication material is created or accessed. This amplifies the supply-chain risk because a hostile package version could exfiltrate tokens, session data, or local keys while appearing to perform a normal login.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

Agent registration is performed through an unpinned npx package, so the behavior can change or become malicious without any skill update. Since registration affects agent identity and service exposure, abuse could misregister agents, alter metadata, or stage follow-on compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The heartbeat command also depends on @latest, meaning arbitrary upstream code can run during routine operational updates. While less sensitive than login, it still runs with the user's environment and session context and can be abused for persistence or telemetry exfiltration.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The email OTP login flow requests codes through an unpinned package, creating a path for interception or manipulation of authentication state. Because OTP flows are often treated as trusted recovery/login mechanisms, compromise here can directly enable account takeover or session theft.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The bind-email command is invoked through @latest, which can silently change account-recovery settings or redirect email binding flows. In context, this is particularly risky because email binding is described as enabling recovery if local keys are lost.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The verification step for email binding runs unpinned remote code at the point of finalizing account recovery controls. A compromised release could capture OTPs or bind the wrong email, enabling persistent unauthorized access.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The identity lookup command uses @latest, so arbitrary package code executes before returning whoami data. Even seemingly read-only identity and wallet metadata can be sensitive and useful for targeting or lateral abuse.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The command reference continues to normalize use of an unpinned package, increasing the chance that operators will execute mutable code paths repeatedly. The repeated pattern across the skill raises overall exposure rather than being an isolated documentation issue.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This login reference encourages use of an unpinned package during key-based authentication, where local keys and sessions are involved. The skill context makes this more dangerous because the package is operating in a security-critical workflow by design.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The OTP login reference fetches mutable code at runtime in a credential-handling path. A malicious update could intercept email addresses, OTP identifiers, or session artifacts and still present expected JSON output.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The whoami reference again executes an unpinned package, reinforcing a pattern of broad trust in mutable upstream code. While less severe than login, it still exposes session-bearing runtime context to a package whose contents can change at any time.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The commands table includes status --json via @latest, perpetuating unreviewed code execution even for health checks. This is a supply-chain vulnerability rather than a command-semantic issue, so the read-only nature does not eliminate the risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The key-based login entry uses mutable runtime code in the highest-sensitivity path of the skill. In context, exploitation could impact account creation, private keys, and authenticated sessions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The email login entry similarly relies on unpinned code in an authentication flow. This creates direct risk of account compromise through OTP interception or workflow manipulation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The OTP verification entry finalizes authentication using unpinned code, so a compromised release could complete login while leaking the OTP or session token. The skill’s authentication purpose increases the severity of this supply-chain weakness.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The agent registration command in the table continues the same mutable dependency pattern. Compromise could alter published agent attributes or trigger unintended account-linked actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The heartbeat command is unpinned in the table, allowing upstream-controlled code execution during routine status updates. This broadens the attack surface by making frequent low-friction invocations possible.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The whoami table entry again depends on @latest, exposing account metadata and execution context to mutable package code. The repeated pattern indicates systemic supply-chain hygiene issues in the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The bind-email entry is security-sensitive because it affects account recovery and web/mobile access, yet it uses unpinned runtime code. A malicious release could hijack recovery settings or capture email addresses and OTP flow data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The bind-email verification entry finalizes recovery changes through unpinned code, enabling interception or redirection of a highly sensitive account-control step. This is more dangerous in this skill because email binding is explicitly positioned as a fallback for lost local keys.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The wallet addresses command uses @latest, so a compromised package could enumerate and exfiltrate wallet metadata. In a platform that references on-chain balances and transfers, wallet identifiers are sensitive operational data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.