T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:45- Finding
Plaintext Wallet Keys and Seed Phrases Recommended in Workspace .env Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Crypto Guardian
Security checks for vulnerabilities and agentic risk
Overview
The skill aims to protect crypto wallets, but it repeatedly gives unsafe advice to store wallet recovery secrets in plaintext .env files.
Review carefully before installing. Do not follow the .env seed phrase or raw private-key examples; wallet recovery phrases should stay offline or hardware-backed, and active signing should use a hardware wallet, isolated signer, or proper secret manager with narrowly scoped runtime access. If this guidance was already followed, treat the affected wallet secret as potentially exposed, move funds to a new securely generated wallet, and retire the old secret.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The recommended wallet setup says a seed phrase can be stored in
.env, which directly contradicts the earlier prohibition on storing seed phrases in files. A seed phrase is sufficient to fully recover and drain the wallet, so normalizing file-based storage in a skill meant to protect wallets materially increases the chance of catastrophic asset loss.- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This line recommends storing a seed phrase in
.env, which constitutes credential exposure guidance for the most sensitive wallet secret. If followed, compromise of the file, repository, runtime logs, or workspace gives an attacker full control over funds with immediate irreversible impact.- Content
Purpose Wallet Type Key Storage Trading/Active Software (Solflare) .env, never in files Grip/Bounty Earn Software (MetaMask) Seed phrase in .env only Long-Term Savings Hardware (Ledger) Never touches computer text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
This section normalizes
.env onlystorage for a wallet tied to active use, encouraging file-based handling of private signing material. In the context of AI agents and workspace scanning, that materially raises the chance of secret disclosure and theft of on-chain assets.- Content
Wallet Type Address Storage Used For Active DCA [DISCARDED] None (empty, was drained) Bounty Earn 0xD1089e... .env only Grip, ClawMoney Watch-Only [YOUR WALLET] TOOLS.md Monitor only New DCA Wallet TBD (new generation) Hardware Jupiter DCA (future) text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
Classifying
.env + careful handlingas 'High' security for active project funds is misleading and unsafe in this context. Users may infer that file-based key storage is an endorsed secure pattern, causing preventable key exposure in systems where workspace and environment handling are not strongly isolated.- Content
md | Security Level | Use Case | Key Storage | |----------------|----------|-------------| | Maximum | Long-term savings | Hardware wallet only | | High | Active project funds | .env + careful handling | | Medium | Daily trading | Software wallet, small balance | | Low | Testing/learning | Any, small amounts |
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description and trigger list use short, high-frequency terms such as "wallet," "crypto," and "blockchain" without narrowing context or exclusion conditions. These phrases can easily overlap with ordinary discussion about cryptocurrency or wallets, making activation boundaries unclear.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly presents
.envas a safe alternative for private keys while also stating that workspace files should be assumed public. In an agent context,.envis still a file that can be indexed, committed, logged, or exfiltrated, so this contradictory guidance can directly lead to key compromise and wallet theft.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The implementation section again endorses storing signing material in
.env, reinforcing unsafe operational practice despite the document's own warning that workspace artifacts may be exposed. In an AI-agent environment, repeated endorsement makes accidental adoption more likely and increases the chance that sensitive keys are stored where tooling, memory, or source control can leak them.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Line L127 contains Chinese text ("纸上残留的seed phrase notes") inside an otherwise English skill document. This introduces an implicit language shift without user opt-in or any documented multilingual policy, which can violate language consistency expectations.
- Content