Security audit

openmath-submit-theorem

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its OpenMath proof-submission purpose, but it needs review because its wallet fee-grant checks can accept overly broad spending authority and its binary install guidance lacks integrity verification.

Before installing, verify shentud from an official release with a checksum or signature, keep seed phrases out of chat, and only use narrow authz/feegrant grants with explicit allowed messages, finite spend limits, and expiration dates. Review or revoke any existing broad feegrant before trusting Status: ready; note that the manual authz examples use the date 2026-03-18T00:00:00Z, which is already in the past on 2026-09-12.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: references/submission_guidelines.md:67
Finding: Downloaded Shentu Executable Is Installed Without Cryptographic Integrity Verification
Content: View full analysis
Remediation: View remediation
' 'shentud_2.17.0_linux_amd64' | sha256sum --check - ``` 3. Where upstream signed checksums or release signatures are available, verify the signature using a separately authenticated public key. 4. Fail installation instructions explicitly if checksum or signature verification fails. 5. Pin the exact release version and artifact name rather than recommending an unverified latest binary. 6. Advise users to download checksums or signatures through an independently authenticated channel. 7. Perform verification before `chmod +x`, moving the binary into `$HOME/bin`, or invoking `shentud version`. 8. Document the expected version output only as a secondary validation step, not as an authenticity check. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/check_authz_setup.py:196
Finding: Mandatory Readiness Gate Accepts Unrestricted Fee Grants
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (40)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises an end-to-end submission capability for OpenMath proofs via a two-stage commit-reveal flow on Shentu. However, the code only calculates the proof hash locally from theorem_id, prover address, and proof detail content using protobuf-style encoding and SHA-256. There is no code for signing transactions, sending commits, revealing proofs, calling APIs, accessing wallets, or interacting with OpenMath/Shentu at all. This is a materially different primary purpose: hash computation rather than proof submission.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says the skill submits proofs to OpenMath using a two-stage commit-reveal flow. The supplied code does not construct or broadcast commit/reveal messages, hash proofs, or submit Lean/Rocq proofs. Instead, it is a diagnostic script that loads submission config, checks for a local agent key, confirms the configured address matches the local key, and queries Shentu authz and feegrant grants to determine whether the environment is ready for later authz submissions. This is materially different from the declared primary purpose, so the description does not accurately represent the code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says this skill is for submitting proofs to OpenMath using a two-stage commit-reveal flow on Shentu. The supplied code does not implement submission, commit, reveal, network interaction, or proof handling. Instead, it is a small compatibility wrapper that emits a deprecation message and forwards control to another script named check_authz_setup.py, indicating a setup/readiness or authorization-check purpose. That is a materially different primary purpose, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says this skill submits proofs to OpenMath using a two-stage commit-reveal flow. However, the supplied code only supports querying existing on-chain information after an optional delay. It invokes shentud q tx and shentud q bounty theorem, parses JSON output, and prints summaries of transaction or theorem status. There is no logic for constructing, signing, or broadcasting transactions, no proof hash commitment, no proof reveal step, and no handling of Lean/Rocq proof payloads. The code does interact with the Shentu network, but its primary purpose is status checking, which is materially different from the declared submission functionality.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 78% confidence
Finding: The recovery command is highly sensitive because it prompts the user to import an existing wallet secret into the local keyring. Even though the skill says the user should run it manually, guiding recovery in-band within an agent workflow increases the chance that users disclose mnemonics to the agent or perform risky key import on an untrusted machine.
Content: Scanner excerpt · references/init-setup.md (reported line 151)May include surrounding context.
Recover an existing key:

bash
shentud keys add agent-prover --recover --keyring-backend os

Then:

Credential Access

High

Category: Privilege Escalation
Confidence: 78% confidence
Finding: Embedding wallet recovery instructions in the skill creates a pathway for secret handling during agent-assisted setup. Recovery flows are unusually sensitive; even if the command is not auto-executed, the skill normalizes a process where users may reveal or mishandle seed phrases in the agent context, leading to account compromise.
Content: Scanner excerpt · references/init-setup.md (reported line 248)May include surrounding context.
Recover an existing key:

bash
shentud keys add agent-prover --recover --keyring-backend os

Then save:

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/authz_setup.md (reported line 67)May include surrounding context.
python3 --version command -v shentud shentud version shentud keys list --keyring-backend os

text
Least-privilege default: `shentud` installation and local key creation or recovery are manual prerequisites. The default skill flow may run read-only checks such as `command -v shentud`, `shentud version`, and `shentud keys show`, but it should not auto-install binaries or auto-create or recover keys.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/init-setup.md (reported line 127)May include surrounding context.
python3 --version command -v shentud shentud version shentud keys list --keyring-backend os

text
Least-privilege default: `shentud` installation and local key creation or recovery are manual prerequisites. The default skill flow may run read-only checks such as `command -v shentud`, `shentud version`, and `shentud keys show`, but it should not auto-install binaries or auto-create or recover keys.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/init-setup.md (reported line 145)May include surrounding context.
python3 --version command -v shentud shentud version shentud keys list --keyring-backend os

text
Least-privilege default: `shentud` installation and local key creation or recovery are manual prerequisites. The default skill flow may run read-only checks such as `command -v shentud`, `shentud version`, and `shentud keys show`, but it should not auto-install binaries or auto-create or recover keys.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/init-setup.md (reported line 229)May include surrounding context.
python3 --version command -v shentud shentud version shentud keys list --keyring-backend os

text
Least-privilege default: `shentud` installation and local key creation or recovery are manual prerequisites. The default skill flow may run read-only checks such as `command -v shentud`, `shentud version`, and `shentud keys show`, but it should not auto-install binaries or auto-create or recover keys.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/init-setup.md (reported line 242)May include surrounding context.
python3 --version command -v shentud shentud version shentud keys list --keyring-backend os

text
Least-privilege default: `shentud` installation and local key creation or recovery are manual prerequisites. The default skill flow may run read-only checks such as `command -v shentud`, `shentud version`, and `shentud keys show`, but it should not auto-install binaries or auto-create or recover keys.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/submission_guidelines.md (reported line 19)May include surrounding context.
python3 --version command -v shentud shentud version shentud keys list --keyring-backend os

text
Least-privilege default: `shentud` installation and local key creation or recovery are manual prerequisites. The default skill flow may run read-only checks such as `command -v shentud`, `shentud version`, and `shentud keys show`, but it should not auto-install binaries or auto-create or recover keys.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/submission_guidelines.md (reported line 163)May include surrounding context.
python3 --version command -v shentud shentud version shentud keys list --keyring-backend os

text
Least-privilege default: `shentud` installation and local key creation or recovery are manual prerequisites. The default skill flow may run read-only checks such as `command -v shentud`, `shentud version`, and `shentud keys show`, but it should not auto-install binaries or auto-create or recover keys.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/submission_guidelines.md (reported line 226)May include surrounding context.
python3 --version command -v shentud shentud version shentud keys list --keyring-backend os

text
Least-privilege default: `shentud` installation and local key creation or recovery are manual prerequisites. The default skill flow may run read-only checks such as `command -v shentud`, `shentud version`, and `shentud keys show`, but it should not auto-install binaries or auto-create or recover keys.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/submission_guidelines.md (reported line 280)May include surrounding context.
python3 --version command -v shentud shentud version shentud keys list --keyring-backend os

text
Least-privilege default: `shentud` installation and local key creation or recovery are manual prerequisites. The default skill flow may run read-only checks such as `command -v shentud`, `shentud version`, and `shentud keys show`, but it should not auto-install binaries or auto-create or recover keys.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/submission_guidelines.md (reported line 289)May include surrounding context.
python3 --version command -v shentud shentud version shentud keys list --keyring-backend os

text
Least-privilege default: `shentud` installation and local key creation or recovery are manual prerequisites. The default skill flow may run read-only checks such as `command -v shentud`, `shentud version`, and `shentud keys show`, but it should not auto-install binaries or auto-create or recover keys.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/check_authz_setup.py (reported line 107)May include surrounding context.
python
python3 --version command -v shentud shentud version shentud keys list --keyring-backend os ``` Least-privilege default: `shentud` installation and local key creation or recovery are manual prerequisites. The default skill flow may run read-only checks such as `command -v shentud`, `shentud version`, and `shentud keys show`, but it should not auto-install binaries or auto-create or recover keys.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_submission.py (reported line 47)May include surrounding context.
python
python3 --version command -v shentud shentud version shentud keys list --keyring-backend os ``` Least-privilege default: `shentud` installation and local key creation or recovery are manual prerequisites. The default skill flow may run read-only checks such as `command -v shentud`, `shentud version`, and `shentud keys show`, but it should not auto-install binaries or auto-create or recover keys.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_submission.py (reported line 60)May include surrounding context.
python
python3 --version command -v shentud shentud version shentud keys list --keyring-backend os ``` Least-privilege default: `shentud` installation and local key creation or recovery are manual prerequisites. The default skill flow may run read-only checks such as `command -v shentud`, `shentud version`, and `shentud keys show`, but it should not auto-install binaries or auto-create or recover keys.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/submission_config.py (reported line 276)May include surrounding context.
python
python3 --version command -v shentud shentud version shentud keys list --keyring-backend os ``` Least-privilege default: `shentud` installation and local key creation or recovery are manual prerequisites. The default skill flow may run read-only checks such as `command -v shentud`, `shentud version`, and `shentud keys show`, but it should not auto-install binaries or auto-create or recover keys.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/check_authz_setup.py (reported line 13)May include surrounding context.
python
from pathlib import Path from submission_config import ( KEYRING_BACKEND, SubmissionConfig, SubmissionConfigError, authz_onboarding_text,

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/check_authz_setup.py (reported line 108)May include surrounding context.
python
from pathlib import Path from submission_config import ( KEYRING_BACKEND, SubmissionConfig, SubmissionConfigError, authz_onboarding_text,

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_submission.py (reported line 17)May include surrounding context.
python
from pathlib import Path from submission_config import ( KEYRING_BACKEND, SubmissionConfig, SubmissionConfigError, authz_onboarding_text,

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_submission.py (reported line 47)May include surrounding context.
python
from pathlib import Path from submission_config import ( KEYRING_BACKEND, SubmissionConfig, SubmissionConfigError, authz_onboarding_text,

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_submission.py (reported line 60)May include surrounding context.
python
from pathlib import Path from submission_config import ( KEYRING_BACKEND, SubmissionConfig, SubmissionConfigError, authz_onboarding_text,

Static analysis

No suspicious patterns detected.