Bifrost Slpx Stake

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:21 AM UTC
• Version: 0.1.0

Overview

The skill is coherent for Bifrost staking, but it needs review because it can use raw wallet private keys while performing real financial transactions.

Install only if you are comfortable with a skill that helps prepare and optionally broadcast staking transactions. Prefer manual signing or a hardware wallet/keystore workflow, use a dedicated minimally funded wallet, and do not paste or expose a primary wallet private key to the agent.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:103

Finding

Private Key Exposure Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 103–118
Vulnerability Type: Private key exposure through process arguments
Risk Level: High

The skill explicitly instructs the agent to pass a wallet private key to cast send through the --private-key command-line argument:

bash

# Mint vETH (stake native ETH)
cast send <VETH_CONTRACT> \
  "depositWithETH()" --value <AMOUNT_IN_WEI> \
  --rpc-url <RPC_URL> --private-key <PRIVATE_KEY>

# Redeem vETH (unstake)
cast send <VETH_CONTRACT> \
  "redeem(uint256,address,address)" <SHARES_IN_WEI> <USER_ADDR> <USER_ADDR> \
  --rpc-url <RPC_URL> --private-key <PRIVATE_KEY>

# Claim ETH (withdraw completed redemptions)
cast send <VETH_CONTRACT> \
  "withdrawCompleteToETH()" \
  --rpc-url <RPC_URL> --private-key <PRIVATE_KEY>

Technical Analysis

Supplying a private key as a command-line argument places the secret in the process argument vector. Depending on the host configuration and execution environment, command arguments may be exposed through:

• Process inspection facilities and monitoring tools
• Shell history
• Terminal or session recording
• Agent tool-call and command-execution logs
• Audit telemetry, crash reports, or diagnostic output
• CI/CD or orchestration logs

The skill also supports reading BIFROST_PRIVATE_KEY from the environment and directs the agent to use it for signing. If the agent interpolates that value into the documented command, the secret moves from the environment into a more broadly observable process argument.

The instruction at line 201 to “never echo private keys” does not mitigate this issue because passing the key in the command itself can disclose it without explicitly printing it in user-facing output.

Attack Path

1. A user enables agent-side signing by setting BIFROST_PRIVATE_KEY or otherwise supplying a ra ...[truncated 1311 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove every example and instruction that passes private keys through --private-key.
2. Make manual signing the recommended workflow so the skill produces unsigned transaction details without handling wallet secrets.
3. For automated signing, use a Foundry keystore account, hardware wallet, external signer, or dedicated signing service that does not place raw key material in process arguments.
4. Require interactive or protected credential retrieval and ensure passwords and key material are not included in command strings, tool-call records, or logs.
5. Do not request that users paste private keys into the agent conversation.
6. Avoid expanding BIFROST_PRIVATE_KEY into a shell command. If environment-based signing remains supported, use a trusted signer integration that consumes the secret internally without exposing it in arguments or diagnostic output.
7. Redact secrets at all execution and telemetry layers, including shell tracing, agent logs, audit logs, errors, and crash reports.
8. Recommend a dedicated, minimally funded wallet for automation and document immediate key rotation and asset migration procedures if exposure is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

"<FUNCTION_SIGNATURE>(<ARG_TYPES>)(<RETURN_TYPES>)" <ARGS> \
  --rpc-url <RPC_URL>

# Method B: curl (if cast unavailable)
curl -s -X POST <RPC_URL> \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"eth_call","params":[{"to":"<VETH_CONTRACT>","data":"<SELECTOR><ENCODED_ARGS>"},"latest"]}'