usd1 transfer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:42 AM UTC
• Version: 1.0.0

Overview

This skill appears to do what it says, but it asks for a wallet private key and can send tokens without a final confirmation, so it needs review before use.

Use this only with a disposable testnet wallet key that controls no real funds. Before broader use, replace raw private-key input with a constrained wallet/signer flow, add an explicit transaction preview and confirmation, validate chain/address/amount exactly, pin and update dependencies, and restrict network access to the required testnet endpoints.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: index.js:1

Finding

Raw Private Key Exposed to an Excessively Broad Dependency Surface

Content

View full analysis

Vulnerability Details

File Location: index.js:1-2, 13-21; package.json:12-15; package-lock.json:1242-1277
Vulnerability Type: Excessive dependency privileges and sensitive key exposure
Risk Level: Medium

Vulnerable Code

js

const { Wormhole } = require('@wormhole-foundation/sdk');
const { UniversalAddress } = require('@wormhole-foundation/sdk-base');

// ...

const transfer = await wh.tokenBridge().transfer(
  privateKey,
  chain,
  transferAmount,
  'USDC',
  new UniversalAddress(toAddress, 'hex')
);

json

"dependencies": {
  "@wormhole-foundation/sdk": "^4.9.1",
  "@wormhole-foundation/sdk-base": "^4.9.1"
}

The umbrella SDK entry in package-lock.json:1242-1277 installs adapters for Algorand, Aptos, CosmWasm, EVM, Solana, Stacks, and Sui, including their associated bridge and network components.

Technical Analysis

The handler supplies the raw wallet private key directly to the third-party Wormhole SDK. The selected umbrella SDK introduces numerous network-capable chain adapters even though the Skill defaults to Solana and only needs the components required for the selected source chain.

This dependency surface exceeds the minimum privileges and code footprint required for the declared functionality. Any dependency receiving or operating near raw signing material becomes security-critical. The lockfile also contains deprecated CosmJS cryptographic components whose package notices explicitly warn about security-relevant bugs and possible private-key risk at package-lock.json:197 and package-lock.json:522.

The audit did not identify a malicious package or confirmed key-exfiltration routine. The risk arises from exposing highly sensitive signing material to an unnecessarily broad transitive dependency graph and from retaining dependencies with explicit cryptographic security warnings.

Attack Path

1. An attacker compromises, replaces, or exploits a ...[truncated 1032 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the umbrella @wormhole-foundation/sdk dependency with the smallest reviewed set of chain-specific packages required for the supported transfer path.
2. If only Solana is supported, reject all other chains and install only the Solana and common bridge components.
3. Do not pass raw private-key strings through general application APIs. Accept a constrained signer interface, hardware-wallet adapter, isolated signing service, or callback that signs only a fully constructed and approved transaction.
4. Remove or upgrade dependency paths that include deprecated CosmJS cryptographic packages with private-key security warnings.
5. Pin exact reviewed dependency versions instead of permissive caret ranges, retain integrity hashes, and use automated dependency vulnerability and provenance scanning.
6. Display the complete transaction details and require explicit user approval before invoking the signer.
7. Run the Skill in a sandbox with outbound network access restricted to the exact testnet RPC and Wormhole endpoints required for operation.

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:5

Finding

Insufficient Financial Input Validation and Chain-Incompatible Address Handling

Content

View full analysis

Vulnerability Details

File Location: index.js:5-20; related declaration in SKILL.md:7-16
Vulnerability Type: Unsafe amount conversion, missing transaction validation, and address/asset mismatch
Risk Level: Medium

Vulnerable Code

js

async handler(input) {
  const { amount: amt, toAddress, chain = 'Solana', privateKey } = input;

  if (!amt || !toAddress || !privateKey) {
    return { status: 'failed', message: 'Missing required parameters: amount, toAddress, privateKey' };
  }

  try {
    const wh = await Wormhole('Testnet', [chain]);

    const transferAmount = BigInt(amt * 1_000_000); // USDC has 6 decimals

    const transfer = await wh.tokenBridge().transfer(
      privateKey,
      chain,
      transferAmount,
      'USDC', // Token symbol
      new UniversalAddress(toAddress, 'hex')
    );

    const txHash = transfer.txHash.toString();

Technical Analysis

Validation only checks whether the three required inputs are truthy. It does not enforce that the amount is finite, positive, within an authorized maximum, exactly representable at six-decimal precision, or free from unsafe JavaScript numeric rounding.

The expression amt * 1_000_000 performs IEEE-754 floating-point arithmetic before converting the result to BigInt. Values containing unsupported fractional precision can cause conversion failures, while sufficiently large values can lose precision and produce a transfer amount different from the value the user intended.

The Skill documentation identifies the asset as USD1 and defaults the source chain to Solana. The implementation instead selects the token using the generic string USDC and constructs every destination as a hexadecimal UniversalAddress. Native Solana addresses use Base58 rather than hexadecimal notation. No chain-specific validation confirms that the supplied address, token identifier, and chain are mutually compatible.

The code also does n ...[truncated 1700 chars]

Remediation

View remediation

Remediation Suggestions

1. Accept the amount as a decimal string rather than a JavaScript number.
2. Parse the amount using exact fixed-point arithmetic. Reject signs, exponent notation, non-digits, more than six fractional digits, zero, negative values, and values above a configured transfer ceiling.
3. Convert the validated decimal string directly into base units without first performing floating-point multiplication.
4. Maintain an explicit allowlist of supported chains. If the Skill only supports Solana, reject every other chain.
5. Validate recipient addresses with the selected chain's native address parser. Do not force all addresses through hexadecimal decoding.
6. Resolve USD1 using a verified testnet token contract or mint identifier rather than the ambiguous symbol USDC.
7. Verify that the configured token identifier, decimals, bridge contract, source chain, and network all match before signing.
8. Generate a transaction preview containing the exact base-unit amount, human-readable amount, token identifier, source chain, destination, fees, and network.
9. Require explicit user confirmation after displaying the preview and immediately before invoking the signer.
10. Return distinct validation errors without exposing the private key or other sensitive wallet information.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill accepts a raw private key as input and immediately uses it to authorize a blockchain transfer. This is dangerous because agent skills often receive inputs from higher-level orchestration, logs, or untrusted contexts, so collecting and using private keys directly greatly increases the chance of key theft, accidental disclosure, or unauthorized fund movement.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code performs an irreversible token transfer as soon as the required parameters are present, with no confirmation, policy checks, allowlist enforcement, or user-visible warning. In an agent setting, this is especially risky because malformed prompts, prompt injection elsewhere, or operator mistakes could trigger real asset movement to an attacker-controlled address with no recovery path.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

ws 8.19.0 is present in the dependency tree and the reported advisories describe memory disclosure and memory-exhaustion denial of service in WebSocket handling. This is a true dependency risk because the project includes multiple blockchain/network SDKs that commonly maintain WebSocket connections to RPC endpoints, increasing the chance the vulnerable code is reachable in real deployments.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.4 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

axios 1.13.4 is directly pinned in the lockfile and the advisory set includes SSRF/proxy-bypass and prototype-pollution-related MITM/credential risks. In a cross-chain transfer skill that likely performs outbound RPC/API calls, flaws in HTTP client request handling are especially relevant because they can affect trust boundaries, proxy enforcement, and credentialed requests to blockchain infrastructure.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: bigint-buffer==1.1.5 — 1 advisory(ies): CVE-2025-3194 (bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

bigint-buffer 1.1.5 is pinned and the advisory reports a buffer overflow in toBigIntLE(). Because this dependency appears in Solana-related serialization/layout tooling, malformed binary inputs from network or chain data could potentially trigger memory-safety issues or process instability where native components are involved, making this more serious than a typical pure-JS parsing bug.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

ws 8.17.1 is another vulnerable WebSocket version in the tree, with the same memory disclosure and DoS advisories. Since this project aggregates many network-facing blockchain clients, multiple vulnerable ws instances increase attack surface and make runtime exposure more likely, especially for services subscribing to chain events or RPC streams.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

form-data 4.0.5 is pinned and the advisory describes CRLF injection via unescaped multipart field names/filenames. If this skill or its transitive SDKs construct multipart requests using untrusted input, an attacker could manipulate request structure or smuggle headers/content, which is particularly concerning in systems that interact with remote APIs or upload endpoints.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code initiates a transfer of token symbol 'USDC' at L21, but the returned success message at L30 says it transferred 'USD1'. This is an active contradiction in user-facing intent/documentation rather than a mere omission, and could mislead users about what asset was sent.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @protobufjs/utf8==1.1.0 — 1 advisory(ies): CVE-2026-44288 (protobufjs has overlong UTF-8 decoding)

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The lockfile includes @protobufjs/utf8 1.1.0, which the scan maps to an overlong UTF-8 decoding issue. In a package-lock.json this is a real supply-chain exposure because the vulnerable version is pinned, though the practical risk depends on whether untrusted protobuf/UTF-8 data is processed at runtime. Given this project pulls in broad cross-chain SDK dependencies, the issue is plausible but likely lower impact than direct RCE-style flaws.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: bn.js==5.2.2 — 1 advisory(ies): CVE-2026-2739 (bn.js affected by an infinite loop)

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

bn.js 5.2.2 is present and the advisory indicates an infinite-loop condition, which is generally a denial-of-service risk when attacker-controlled inputs reach big-number parsing or arithmetic paths. In this project, many blockchain SDKs manipulate large numeric values, so the vulnerable code may be exercised, though impact is likely limited to availability rather than compromise of confidentiality or integrity.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: elliptic==6.6.1 — 1 advisory(ies): CVE-2025-14505 (Elliptic Uses a Cryptographic Primitive with a Risky Implementation)

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

elliptic 6.6.1 is included through deprecated CosmJS cryptography components, and even the package metadata warns of security-relevant bugs affecting private-key handling. This is a real cryptographic hygiene issue, though exploitability depends on whether the skill actually uses those Cosmos/Injective signing paths and manages sensitive keys through the affected library.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: bn.js==4.12.2 — 1 advisory(ies): CVE-2026-2739 (bn.js affected by an infinite loop)

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

bn.js 4.12.2 appears as a nested dependency under elliptic and inherits the same infinite-loop DoS class of risk. This is a true lockfile-level vulnerability, but its practical impact is bounded by whether attacker-controlled numeric material reaches those nested cryptographic/math operations during runtime.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

follow-redirects 1.15.11 is present and the advisory indicates authentication headers may leak across cross-domain redirects. In a network-heavy transfer skill, HTTP clients may contact third-party RPC or API endpoints; if redirects are followed automatically while carrying sensitive headers, credentials or API tokens could be exposed to an attacker-controlled host.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The dependency uses a caret version range, which allows npm to install newer minor and patch releases than the one originally reviewed. This can introduce supply-chain risk if a future upstream release is compromised, buggy, or behaviorally incompatible, especially in a package that appears related to asset transfer functionality.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json

"license": "ISC",
  "type": "commonjs",
  "dependencies": {
    "@wormhole-foundation/sdk": "^4.9.1",
    "@wormhole-foundation/sdk-base": "^4.9.1"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The dependency is not pinned to an exact version, so future installations may resolve to different minor or patch releases than were originally tested. That creates avoidable supply-chain exposure and can lead to unexpected code being pulled into environments that handle cross-chain or financial operations.

Content

Scanner excerpt · package.json (reported line 15)May include surrounding context.

json

"type": "commonjs",
  "dependencies": {
    "@wormhole-foundation/sdk": "^4.9.1",
    "@wormhole-foundation/sdk-base": "^4.9.1"
  }
}

Static analysis

No suspicious patterns detected.