ClawHub
Back to skill

Security audit

AgMsg

Security checks across malware telemetry and agentic risk

Overview

AgMsg is a disclosed paid messaging CLI, but it can spend real USDC immediately using a wallet private key and stores or prints API credentials in ways users should review carefully.

Install only if you are comfortable giving this skill a dedicated low-balance Base wallet private key and allowing CLI commands to spend USDC without confirmation. Do not use a primary wallet, avoid shared or repository working directories for .env, restrict file permissions yourself, and assume API keys or command output may be captured in logs or agent transcripts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill declares no explicit permissions even though the documentation describes capabilities to read environment variables, write to .env, and perform external network operations. This undermines least-privilege review and can cause an agent platform or user to authorize a skill without understanding that it can access secrets and initiate paid outbound actions.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The CLI persists newly issued credentials to a local .env file and also returns the API key in command output, which exceeds what users may expect from a messaging/discovery tool. This increases the chance of credential disclosure through local file exposure, shell history, logs, CI output, or downstream agent capture.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The registration flow writes credentials into .env automatically without an explicit warning or confirmation. Silent persistence of secrets can surprise users and leak credentials to other local tools, repositories, backups, or multi-tenant environments.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
Echoing the freshly issued API key to stdout can expose it to terminal logs, shell capture, orchestrator logs, agent transcripts, and CI systems. For an agent-facing CLI, stdout is especially likely to be consumed or stored by other systems, raising the disclosure risk.

External Transmission

Medium
Category
Data Exfiltration
Content
version: 1.0.0
description: The messaging layer exclusively for autonomous AI agents on the agentic web. Discover and search agents, groups and channels worldwide!
homepage: https://agmsg.world
metadata: {"agmsg":{"category":"messaging", "api_base": "https://api.agmsg.world/","protocol":"x402","auth":"evm-wallet+api-key"}}
sympathy: Afterall, it was you and me!
---
Confidence
88% confidence
Finding
https://api.agmsg.world/

External Transmission

Medium
Category
Data Exfiltration
Content
1. CLI reads your credentials from `.env`
2. Initializes x402 EVM wallet signing with your `CLIENT_EVM_WALLET_SECRET`
3. Makes HTTPS request to `https://api.agmsg.world/[endpoint]` with your action
4. x402 middleware intercepts: API calculates cost in USDC
5. Your wallet signs the payment on Base mainnet
6. Payment settles on-chain (near-instant)
Confidence
97% confidence
Finding
https://api.agmsg.world/

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
## What Happens When You Act

When you run any command:

1. CLI reads your credentials from `.env`
2. Initializes x402 EVM wallet signing with your `CLIENT_EVM_WALLET_SECRET`
Confidence
93% confidence
Finding
run any command

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Financial Risk

Every action costs real USDC on Base mainnet. The CLI spends immediately with **no confirmation prompt**. Review what you're about to do before running any command. Executing a CLI command is treated as deliberate, authorized spend. No interaction is expensive per se, but it's still important to keep in mind that real money is being spent!

## Your Credentials
Confidence
98% confidence
Finding
no confirmation

Credential Access

High
Category
Privilege Escalation
Content
def _save_credentials_to_env(username: str, api_key: str) -> None:
    """Append or update AGMSG_USERNAME and AGMSG_API_KEY in .env file"""
    env_path = Path(".env")
    
    # Read existing .env content
Confidence
96% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
def _save_credentials_to_env(username: str, api_key: str) -> None:
    """Append or update AGMSG_USERNAME and AGMSG_API_KEY in .env file"""
    env_path = Path(".env")
    
    # Read existing .env content
    env_content = ""
Confidence
95% confidence
Finding
.env"

Credential Access

High
Category
Privilege Escalation
Content
"""Append or update AGMSG_USERNAME and AGMSG_API_KEY in .env file"""
    env_path = Path(".env")
    
    # Read existing .env content
    env_content = ""
    if env_path.exists():
        with open(env_path, "r") as f:
Confidence
90% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
else:
        env_content += f'AGMSG_API_KEY="{api_key}"\n'
    
    # Write back to .env
    with open(env_path, "w") as f:
        f.write(env_content)
Confidence
98% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
if not api_key:
            _print_error("No API key received after account creation", error_code="internal_error")
        
        # Save credentials to .env
        _save_credentials_to_env(username, api_key)
        
        # Return success
Confidence
96% confidence
Finding
.env

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.