T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:103
- Finding
- Private Key Exposure Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 103–118 **Vulnerability Type**: Private key exposure through process arguments **Risk Level**: High The skill explicitly instructs the agent to pass a wallet private key to `cast send` through the `--private-key` command-line argument: ```bash # Mint vETH (stake native ETH) cast send <VETH_CONTRACT> \ "depositWithETH()" --value <AMOUNT_IN_WEI> \ --rpc-url <RPC_URL> --private-key <PRIVATE_KEY> # Redeem vETH (unstake) cast send <VETH_CONTRACT> \ "redeem(uint256,address,address)" <SHARES_IN_WEI> <USER_ADDR> <USER_ADDR> \ --rpc-url <RPC_URL> --private-key <PRIVATE_KEY> # Claim ETH (withdraw completed redemptions) cast send <VETH_CONTRACT> \ "withdrawCompleteToETH()" \ --rpc-url <RPC_URL> --private-key <PRIVATE_KEY> ``` ### Technical Analysis Supplying a private key as a command-line argument places the secret in the process argument vector. Depending on the host configuration and execution environment, command arguments may be exposed through: - Process inspection facilities and monitoring tools - Shell history - Terminal or session recording - Agent tool-call and command-execution logs - Audit telemetry, crash reports, or diagnostic output - CI/CD or orchestration logs The skill also supports reading `BIFROST_PRIVATE_KEY` from the environment and directs the agent to use it for signing. If the agent interpolates that value into the documented command, the secret moves from the environment into a more broadly observable process argument. The instruction at line 201 to “never echo private keys” does not mitigate this issue because passing the key in the command itself can disclose it without explicitly printing it in user-facing output. ### Attack Path 1. A user enables agent-side signing by setting `BIFROST_PRIVATE_KEY` or otherwise supplying a ra ...[truncated 1311 chars]
- Remediation
- ## Remediation Suggestions 1. Remove every example and instruction that passes private keys through `--private-key`. 2. Make manual signing the recommended workflow so the skill produces unsigned transaction details without handling wallet secrets. 3. For automated signing, use a Foundry keystore account, hardware wallet, external signer, or dedicated signing service that does not place raw key material in process arguments. 4. Require interactive or protected credential retrieval and ensure passwords and key material are not included in command strings, tool-call records, or logs. 5. Do not request that users paste private keys into the agent conversation. 6. Avoid expanding `BIFROST_PRIVATE_KEY` into a shell command. If environment-based signing remains supported, use a trusted signer integration that consumes the secret internally without exposing it in arguments or diagnostic output. 7. Redact secrets at all execution and telemetry layers, including shell tracing, agent logs, audit logs, errors, and crash reports. 8. Recommend a dedicated, minimally funded wallet for automation and document immediate key rotation and asset migration procedures if exposure is suspected.