openmath-claim-reward

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 7:12 AM UTC
• Version: 1.0.4

Overview

This skill is a disclosed Shentu reward query and withdrawal helper, with sensitive wallet-signing steps that users must confirm carefully.

Install only if you trust the local shentud binary and the Shentu RPC node you use. Do not paste a wallet recovery phrase into chat; if recovery is needed, handle it directly in the trusted terminal or official wallet flow. Before any withdrawal, confirm the key name, resolved wallet address, chain ID, node URL, gas settings, and that you intend to withdraw all claimable reward buckets.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code is a read-only query utility. In rewards mode it calls shentud q bounty rewards and summarizes imported/proof rewards; in tx mode it calls shentud q tx and summarizes transaction status. There is no command that submits a withdrawal transaction or claims rewards. Because the declared purpose says the skill claims earned rewards and can withdraw verified Shentu rewards, while the actual code only queries reward availability and tx status, this is a material description-behavior mismatch. The extra tx-status functionality is also undeclared.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 71% confidence

Finding

The skill instructs the user to recover or import a wallet into the local OS keyring, which is sensitive operational guidance because it leads to handling seed-based wallet credentials on the local machine. While not overtly malicious, encouraging key recovery inside a general-purpose agent workflow increases the chance of unsafe secret handling, accidental prompt capture, terminal logging, or user confusion that could expose recovery material.

Content

Scanner excerpt · references/init-setup.md (reported line 116)May include surrounding context.

If no existing local key matches prover_address, stop and ask the user to recover or import the wallet key for that address:

bash

shentud keys add <key-name> --recover --keyring-backend os

Do not generate a new random key for withdrawal unless the user explicitly intends to use a different wallet address.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/init-setup.md (reported line 104)May include surrounding context.

2. If either reward bucket is non-empty, make sure a local os keyring key controls the same address:

bash

shentud keys list --keyring-backend os
shentud keys show <key-name> -a --keyring-backend os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/init-setup.md (reported line 110)May include surrounding context.

2. If either reward bucket is non-empty, make sure a local os keyring key controls the same address:

bash

shentud keys list --keyring-backend os
shentud keys show <key-name> -a --keyring-backend os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/reward_claim_flow.md (reported line 52)May include surrounding context.

2. If either reward bucket is non-empty, make sure a local os keyring key controls the same address:

bash

shentud keys list --keyring-backend os
shentud keys show <key-name> -a --keyring-backend os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/reward_claim_flow.md (reported line 53)May include surrounding context.

2. If either reward bucket is non-empty, make sure a local os keyring key controls the same address:

bash

shentud keys list --keyring-backend os
shentud keys show <key-name> -a --keyring-backend os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/reward_claim_flow.md (reported line 61)May include surrounding context.

2. If either reward bucket is non-empty, make sure a local os keyring key controls the same address:

bash

shentud keys list --keyring-backend os
shentud keys show <key-name> -a --keyring-backend os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/reward_config.py (reported line 106)May include surrounding context.

python

2. If either reward bucket is non-empty, make sure a local `os` keyring key controls the same address:

```bash
shentud keys list --keyring-backend os
shentud keys show <key-name> -a --keyring-backend os
```

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill uses sensitive capabilities including environment-variable access, file reads, and shell execution, but it does not declare any explicit tool scope or permission boundaries. In a reward-withdrawal skill, this matters because shell access plus config/env discovery can reach secrets, local key metadata, and broadcast-capable commands without a machine-readable restriction layer.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/init-setup.md (reported line 15)May include surrounding context.

md

For read-only reward queries, an explicit address is enough. A config file is only needed when the address is omitted and the skill must auto-discover `prover_address`.

For withdrawals, the local signing key must control the same address as `prover_address`. Do not create a new random key for withdrawal unless it is the same wallet that owns the rewards.

Shared config resolution order:
1. `--config <path>`

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/query_reward_status.py (reported line 28)May include surrounding context.

python

def run_shentud_query(args: list[str]) -> dict:
    try:
        result = subprocess.run(
            ["shentud", *args, "-o", "json"],
            capture_output=True,
            text=True,

Static analysis

No suspicious patterns detected.