agent ultimate bots

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:27 AM UTC
• Version: 1.0.0

Overview

This DeFi automation skill is not clearly malicious, but it can use private keys to run repeated real blockchain transactions and swaps with weak safety controls.

Install only after treating it as a high-risk DeFi automation tool: use testnet or low-value wallets, never fund a key printed in logs, pin and update dependencies, validate RPC/router/token addresses, add dry-run and per-transaction approvals, and require nonzero slippage protection before live use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: wallet.js:3

Finding

Generated Private Key Exposed Through Process Logs

Content

View full analysis

Vulnerability Details

File Location: wallet.js:3-6
Vulnerability Type: Plaintext disclosure of cryptographic credentials
Risk Level: High

Vulnerable Code

js

const wallet = ethers.Wallet.createRandom();

console.log("Address:", wallet.address);
console.log("Private Key:", wallet.privateKey);

Technical Analysis

The wallet utility writes the complete private key to standard output. Private keys are bearer credentials: possession of the key is sufficient to sign arbitrary blockchain transactions as the corresponding wallet.

Standard output may be captured by shell history tooling, terminal recording, CI/CD job logs, container logging drivers, process supervisors, or centralized observability services. Consequently, systems and users that are not authorized to control the wallet may still obtain its private key.

Attack Path

1. A user runs node wallet.js.
2. The generated private key is written to standard output.
3. A terminal recorder, CI system, container runtime, process supervisor, or another user with log access retains or reads the output.
4. The attacker imports the disclosed private key into a wallet or signing tool.
5. If assets are subsequently transferred to the generated address, the attacker signs transactions that transfer those assets elsewhere.

Impact Assessment

Disclosure provides complete control over the generated wallet. An attacker can transfer native currency and tokens, authorize token allowances, interact with contracts, and impersonate the wallet in cryptographic authentication workflows. The scope is limited to the generated wallet and any permissions or assets associated with it, but compromise is irreversible unless assets and authorities are migrated before exploitation.

Remediation

View remediation

Remediation Suggestions

• Never print private keys, seed phrases, or unencrypted keystore material.
• Print only the public wallet address.
• Store generated keys in an encrypted JSON keystore protected by a strong user-supplied password.
• Apply restrictive filesystem permissions to any keystore file.
• Prefer an operating-system secret store, hardware wallet, or managed signing service for production funds.
• Configure logging systems to redact recognized secret formats.
• Treat every key previously exposed to logs as compromised and replace it before funding the address.

T09 · Insecure Skill Coding Practices

Error

• Location: ultimate-agent.js:159

Finding

Token Swaps Execute Without Slippage Protection

Content

View full analysis

Vulnerability Details

File Location: ultimate-agent.js:159-167
Vulnerability Type: Unbounded swap slippage
Risk Level: High

Vulnerable Code

js

const amountIn = ethers.parseEther("0.00001");

const tx = await router.swapExactETHForTokens(
  0,
  [process.env.TOKEN_IN, process.env.TOKEN_OUT],
  wallet.address,
  Math.floor(Date.now() / 1000) + 600,
  { value: amountIn }
);

Technical Analysis

The first argument to swapExactETHForTokens is amountOutMin, which defines the minimum acceptable token output. It is hardcoded to zero. The transaction therefore remains valid even when the output has fallen to an economically negligible amount.

The agent does not obtain a router quote, enforce a user-defined slippage limit, inspect price impact, or bind the transaction to an expected output. The ten-minute deadline limits transaction age but does not protect its execution price.

This design makes pending swaps susceptible to adverse price movement, manipulated liquidity, front-running, and sandwich attacks.

Attack Path

1. The agent broadcasts a swap with amountOutMin set to zero.
2. An attacker monitoring the transaction pool observes the pending swap.
3. The attacker submits a higher-priority transaction that moves the pool price against the agent.
4. The agent's swap executes at the manipulated price because any output amount satisfies the zero minimum.
5. The attacker submits a following transaction that restores the pool price and realizes the difference.
6. The agent receives fewer tokens than expected while still paying the input value and transaction fees.

Impact Assessment

An attacker can extract value from each affected swap and cause the wallet to receive substantially fewer output tokens than the prevailing quote suggested. Because the application runs repeatedly, losses can recur until the hourly transaction limit is reached and can resume when that count ...[truncated 150 chars]

Remediation

View remediation

Remediation Suggestions

• Query the router or a trusted quoting service immediately before constructing the swap.
• Calculate a nonzero amountOutMin from the expected output and a strict user-configured slippage tolerance.
• Reject swaps whose estimated price impact exceeds a defined threshold.
• Confirm that quote data, reserves, and block references are sufficiently fresh.
• Use a shorter deadline appropriate to the target network.
• Consider private transaction submission or MEV-protected RPC services where available.
• Enforce per-swap and aggregate loss limits, and stop the agent after abnormal execution.

T09 · Insecure Skill Coding Practices

Warning

• Location: ultimate-agent.js:145

Finding

Autonomous Transactions Trust Unvalidated Network and Contract Configuration

Content

View full analysis

Vulnerability Details

File Location: ultimate-agent.js:145-168
Vulnerability Type: Missing blockchain network and contract validation
Risk Level: Medium

Vulnerable Code

js

async function doSwap(wallet) {
  if (txCount >= MAX_TX) return;

  const decision = await shouldSwap();

  if (!decision) {
    console.log("⛔ Skip swap (strategy)");
    return;
  }

  try {
    const router = new ethers.Contract(
      process.env.DEX_ROUTER,
      routerAbi,
      wallet
    );

    const amountIn = ethers.parseEther("0.00001");

    const tx = await router.swapExactETHForTokens(
      0,
      [process.env.TOKEN_IN, process.env.TOKEN_OUT],
      wallet.address,
      Math.floor(Date.now() / 1000) + 600,
      { value: amountIn }
    );

The recurring execution logic is:

js

async function run() {
  const provider = getProvider();
  const wallet = pickWallet(provider);
  const action = decideAction();

  console.log("🧠 Action:", action);

  if (action === "tx") await doTx(wallet);
  if (action === "api") await doAPI();
  if (action === "swap") await doSwap(wallet);
  if (action === "idle") console.log("😴 Idle");

  save();

  setTimeout(run, delay());
}

Technical Analysis

The agent constructs a payable contract directly from DEX_ROUTER and uses token addresses obtained from environment variables. It does not verify the connected chain ID, enforce a testnet or network allowlist, validate that the configured addresses are appropriate for the connected chain, inspect deployed bytecode, or confirm that the router is a trusted deployment.

The documentation recommends testing on a testnet, but the implementation does not enforce that recommendation. The recurring loop also chooses financial actions without interactive approval. The hourly control limits transaction count only; it does not impose an aggregate value or gas budget.

Environm ...[truncated 1466 chars]

Remediation

View remediation

Remediation Suggestions

• Default to dry-run mode and require explicit authorization before enabling real transactions.
• Retrieve and validate the provider chain ID against an explicit allowlist before connecting a signer.
• Enforce testnet-only operation unless a separate, deliberate production flag is enabled.
• Maintain per-chain allowlists for router and token addresses.
• Verify that configured addresses are valid, contain deployed bytecode, and match known contract code hashes where practical.
• Require interactive or policy-based approval before the first mainnet transaction and before configuration changes.
• Add maximum value-per-transaction, gas, hourly expenditure, and total-session budget controls.
• Stop execution after repeated failures or unexpected receipt and balance changes.
• Protect environment and deployment configuration with least-privilege access, integrity controls, and audited change management.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

- Adaptive learning system

## Cara Pakai
1. Isi file .env
2. Jalankan:
   node ultimate-agent.js

Known Vulnerable Dependency: axios==1.15.2 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-67313 (Axios: Excessive recursion in formDataToJSON can cause denial of service); CVE-2026-44489 (Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pol) +13 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The lockfile pins axios to 1.15.2, which the supplied advisory data identifies as affected by multiple HIGH-severity issues, including prototype-pollution-assisted header manipulation, MITM-related behavior, and denial of service. In a farming-agent context, axios is a primary outbound HTTP client, so vulnerable request handling can directly affect any network calls the skill makes to APIs or blockchain-adjacent services.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

form-data 4.0.5 is flagged as vulnerable to CRLF injection via unescaped multipart field names/filenames. If the skill constructs multipart requests using attacker-controlled field metadata, this can enable request smuggling or header injection against downstream services; the risk depends on whether multipart uploads are actually used.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

ws 8.17.1 is identified as affected by memory disclosure and memory exhaustion issues. Because ethers commonly uses WebSocket connections for blockchain providers, a vulnerable ws client can expose the agent to denial of service or unintended data exposure when connecting to malicious or compromised endpoints.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.15.2 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-67313 (Axios: Excessive recursion in formDataToJSON can cause denial of service); CVE-2026-44489 (Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pol) +13 more

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The project declares axios version 1.15.2, which the finding reports as having multiple known advisories, including man-in-the-middle/prototype-pollution-related and denial-of-service issues. In an agent that may fetch remote data or interact with blockchain infrastructure, a vulnerable HTTP client can expose requests, headers, or process stability, increasing operational and potentially financial risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This routine performs a real asset swap on-chain using wallet funds, with amount, router, and token path taken from configuration and with no explicit warning or approval step. In an agent skill, that means the code can irreversibly trade assets and incur loss, MEV/slippage harm, or swaps into attacker-chosen tokens if configuration is tampered with.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code generates a real cryptocurrency wallet and immediately prints its private key to stdout, which is a direct secret disclosure. Console output is commonly captured by terminals, logs, CI systems, shell history tooling, or remote observability platforms, so anyone with access to those outputs can take full control of the wallet and any funds sent to it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill advertises automatic blockchain transactions, smart swaps, and dApp interaction but does not prominently warn that these actions may move real funds, trigger approvals, or cause irreversible on-chain effects. In the context of DeFi automation, the absence of explicit safety constraints, confirmation requirements, and mainnet risk warnings materially increases the chance of financial loss from misuse or misunderstanding.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The hardcoded external URL causes periodic transmission to a third-party domain. Although the transmitted payload here appears minimal, repeated unsolicited contact with an external service creates an unnecessary communication channel and can expose runtime environment details such as source IP, frequency, and availability.

Content

Scanner excerpt · agent.js (reported line 15)May include surrounding context.

js

}

  if (pick === "api") {
    axios.get("https://api.coingecko.com/api/v3/ping")
      .then(() => console.log("🌐 API success"))
      .catch(() => console.log("❌ API fail"));
  }

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill makes an outbound HTTP request to a third-party service without any documented user-facing purpose or consent flow. Even though the request is only a ping to CoinGecko, unexpected network activity expands the attack surface, can leak execution metadata such as IP and timing, and is inconsistent with a minimal local 'farming agent' loop.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill ingests raw private keys from environment variables and immediately constructs signing wallets, enabling the code to spend funds as soon as it runs. In this context, the absence of any disclosure, consent boundary, or safer signing architecture makes secret misuse and unintended fund movement significantly more dangerous.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · ultimate-agent.js (reported line 134)May include surrounding context.

js

async function doAPI() {
  try {
    await axios.get("https://api.coingecko.com/api/v3/ping");
    console.log("🌐 API OK");
  } catch {
    console.log("❌ API FAIL");

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · ultimate-agent.js (reported line 212)May include surrounding context.

js

async function doAPI() {
  try {
    await axios.get("https://api.coingecko.com/api/v3/ping");
    console.log("🌐 API OK");
  } catch {
    console.log("❌ API FAIL");

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code is presented as swap/dApp logic, but it autonomously executes live on-chain swaps from configured private-key wallets with no interactive user approval, policy gate, or transaction preview. In an agent-skill context, this is dangerous because loading the skill can directly cause financial actions and asset conversion without informed consent, making misuse or accidental loss much more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code performs an outbound call to an external API without warning, gating, or explanation. While the specific endpoint is not obviously sensitive, silent egress is risky in agent skills because it can be repurposed for tracking, beaconing, or future data transmission with only minor code changes.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency uses a caret range (^1.15.2), which permits automatic installation of newer minor/patch releases rather than an exact reviewed version. This weakens build reproducibility and increases supply-chain risk because future installs may pull code that was not explicitly tested or approved.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json

"license": "ISC",
  "type": "commonjs",
  "dependencies": {
    "axios": "^1.15.2",
    "dotenv": "^17.4.2",
    "ethers": "^6.16.0"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency uses a caret range (^17.4.2) instead of an exact version, allowing different code to be installed over time. In an agent skill context, this creates avoidable supply-chain exposure and undermines reproducibility of reviewed behavior.

Content

Scanner excerpt · package.json (reported line 15)May include surrounding context.

json

"type": "commonjs",
  "dependencies": {
    "axios": "^1.15.2",
    "dotenv": "^17.4.2",
    "ethers": "^6.16.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency uses a caret range (^6.16.0), which allows unreviewed future releases to be resolved during installation. Because ethers is commonly used for blockchain transaction handling, unexpected dependency changes can be especially risky in a farming-agent or wallet-interacting skill.

Content

Scanner excerpt · package.json (reported line 16)May include surrounding context.

json

"dependencies": {
    "axios": "^1.15.2",
    "dotenv": "^17.4.2",
    "ethers": "^6.16.0"
  }
}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The inline comments switch to Indonesian ('ambil success rate', 'strategi sederhana', 'kalau harga rendah ATAU success tinggi → swap') without any indication that language choice is optional or intended for a specific locale. This creates a language policy concern because the file imposes a specific language in natural-language instructions/comments without user opt-in or documented justification.

Content

No source excerpt is available for this finding.