Security audit

DeepBook CLI. Watch, Make & Take the Sui Market

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent DeepBook CLI guide, but it handles wallet keys and live on-chain trading in ways that need careful review before use.

Install only after reviewing the CLI source/package provenance. Prefer a pinned, project-local install; never place private keys or API keys in command arguments, chat, or tool-call text; use stdin, a keychain, hardware wallet, or another protected signer. Require explicit human approval before any mainnet trade, deposit, withdrawal, swap, manager creation, or margin action, and verify network, pool, manager ID, amounts, and dry-run output first.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:18
Finding: Unpinned Third-Party Package Installed Globally
Content: View full analysis
Remediation: View remediation
``` 2. Document the official npm package scope, source repository, publisher identity, and expected package integrity digest. 3. Verify package provenance and integrity before installation, including npm provenance attestations where available. 4. Prefer a project-local installation with a committed lockfile over global installation: ```bash npm install --save-exact deepbook-cli@ npx deepbook --version ``` 5. Install with a dedicated, least-privileged account and avoid `sudo`. 6. Review package lifecycle scripts and transitive dependencies before approving version updates. 7. Establish an explicit upgrade process in which each new package version is reviewed before changing the pin. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:131
Finding: Private Keys Accepted Through Command-Line Arguments
Content: View full analysis
` - `deepbook config set-trade-cap ` - `deepbook config set-read-key [apiKey]` (or `--stdin`) - `deepbook config set-stream-key [apiKey]` (or `--stdin`) - `deepbook config set-provider-base-url ` - `deepbook config set-provider-stream-base-url ` - `deepbook config import-key [privateKey]` (or `--stdin`, optional `--alias`) - `deepbook account details` - `deepbook account list` - `deepbook account balance [--coin ]` - `deepbook account import [privateKey]` (or `--stdin`) ``` The Skill also documents the following global option: ```markdown - `--private-key ` ``` ### Technical Analysis The documented interfaces allow a wallet private key to be supplied directly as a positional argument or through the global `--private-key` option. Command-line arguments are an inappropriate transport mechanism for signing keys because they may be retained or exposed through: - Shell history files. - Process listings and process-inspection interfaces. - Terminal session recording. - Agent tool-call transcripts and execution logs. - Debugging, monitoring, or command-auditing systems. - Copy-and-paste buffers and operational documentation. The Skill states that private keys must never be printed or logged and offers `--stdin` for import commands. Those controls partially mitigate the issue but do not prevent users or agents from selecting the explicitly documented argument-based forms. The global `--private-key` option is especially problematic because the shown documentation does not identify a safer equivalent for that invocation ...[truncated 1320 chars]
Remediation: View remediation
| ...`, which can still expose the key through history or process arguments. Prefer hidden prompting or protected file-descriptor redirection. 5. Ensure files under `~/.deepbook` use restrictive permissions, such as owner-only access, and encrypt stored private-key material using an appropriate credential-management mechanism. 6. Redact private keys from command telemetry, exception messages, debug logs, and agent transcripts. 7. Add warnings and runtime rejection for command-line key arguments, followed by removal of the insecure interface in a documented migration. 8. Encourage users to rotate any private key previously supplied through a command-line argument if its confidentiality cannot be assured. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly documents commands that accept private keys as positional arguments or flags, which can expose secrets through shell history, process listings, terminal logs, and agent telemetry. Although the file says 'Never print or log private keys,' it still promotes unsafe input patterns, making accidental key disclosure likely in real use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill provides step-by-step instructions for creating managers, depositing funds, executing spot trades, withdrawing assets, and performing margin close operations, but it does not prominently warn that these are live on-chain actions that can be irreversible and may result in loss of funds. In an agent skill context, this is especially risky because automation may follow the workflow directly and omit human confirmation before value-moving actions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.