Bifrost Slpx skills

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:23 AM UTC
• Version: 0.1.3

Overview

The skill is a coherent Bifrost liquid-staking helper, but it asks agents to run mutable npm code while handling wallet transactions and recommends persistent plaintext private-key setup.

Review before installing. Use only a pinned and independently reviewed CLI version, avoid non-interactive global installs unless you control the agent environment, and do not put a primary wallet private key in shell startup files. Prefer a hardware wallet, isolated signer, or low-value operational wallet, and independently verify transaction chain, amount, contract, and calldata before approving any mint, redeem, or claim.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:51

Finding

Unpinned npm Package Is Downloaded and Executed in a Financial Signing Context

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51-56
Additional Locations: references/commands.md, line 5; README.md, lines 8-18
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code

bash

npx -y @bifrostio/slpx-cli --version

text

If the published package uses a non-`latest` dist-tag (e.g. prerelease on `next`), pin it: `npx -y @bifrostio/slpx-cli@next --version`.

The command prefix subsequently recommended for operations is:

text

Prefix: `npx -y @bifrostio/slpx-cli`

The installation documentation also recommends an unpinned, non-interactive global installation:

bash

npx skills add bifrost-io/skills --skill bifrost-slpx --agent <agentname> -g -y

Technical Analysis

The Skill instructs the agent to use npx -y without an exact package version or verified integrity value. As a result, the npm registry determines which package release is downloaded and executed at invocation time. Both the implicit latest resolution and explicit @next dist-tag are mutable references rather than immutable version pins.

The -y option suppresses interactive confirmation, while the documented CLI is intended to run in an environment containing a wallet signing key and to submit financial transactions. The actual npm package implementation is maintained outside this audited project, so its source code, transitive dependencies, package lifecycle scripts, and runtime behavior could not be verified as part of this audit.

This creates a supply-chain trust boundary in which reviewed documentation can cause subsequently changed third-party code to execute with the agent's operating-system privileges and inherited environment.

Attack Path

1. An attacker compromises the npm publisher account, package release process, mutable dist-tag, or a transitive dependency used by @bifrostio/slpx-cli.
2. The attacker publishes a malicious release and assigns it to `la ...[truncated 1177 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @bifrostio/slpx-cli to a reviewed, exact version rather than latest, next, or an omitted version:

   bash

   npx -y @bifrostio/slpx-cli@X.Y.Z --version
   

2. Commit and enforce a lockfile containing package integrity hashes. Use deterministic installation such as npm ci in a controlled directory instead of downloading an arbitrary current release for every operation.
3. Pin the skills installer itself to an exact reviewed version and avoid unattended global installation where possible.
4. Verify package provenance, signatures, checksums, publisher identity, and the complete transitive dependency tree before allowing the package to handle signing operations.
5. Disable npm lifecycle scripts during installation when compatible with the package, or explicitly audit every lifecycle script before execution.
6. Run the CLI in a restricted environment that has access only to the resources required for the operation. Do not expose general user files or unrelated environment variables.
7. Separate transaction construction from signing. Prefer a hardware wallet or isolated signer that displays and independently confirms the chain, recipient, value, and calldata.
8. Establish an allowlist of reviewed package versions and require a fresh security review before updating the pin.

T09 · Insecure Skill Coding Practices

Error

• Location: references/private-key-env.md:14

Finding

Raw Wallet Private Key Is Persisted in a Plaintext Shell Startup File

Content

View full analysis

Vulnerability Details

File Location: references/private-key-env.md, lines 14-24
Vulnerability Type: Plaintext storage and broad process exposure of sensitive signing material
Risk Level: High

Vulnerable Code

markdown

4. **Simple local append** (they run this themselves in Terminal; **never** paste the real key into the agent):

   ```bash
   # zsh example — adjust the file for bash/fish as above
   echo 'export BIFROST_SKILL_PRIVATEKEY=0xYOUR_PRIVATE_KEY' >> ~/.zshrc

For fish, use set -Ux or the fish-native export style in config.fish instead of POSIX export if they prefer.

5. After editing: open a new terminal (or source the file) so the variable is loaded, then start a new agent session if they still need help.

Remind them: keep the key out of version control, shared dotfiles repos, and screen recordings; rotating the key is recommended if it was ever exposed in chat or logs.

text

### Technical Analysis

The documented setup stores a raw blockchain private key in a plaintext shell initialization file and exports it into the shell environment. Shell startup files commonly persist indefinitely, may be included in dotfile repositories or backups, and may have permissions that allow unintended local access.

Once exported, the key is inherited by every child process launched from the shell unless explicitly removed. This includes the dynamically retrieved npm CLI described elsewhere in the Skill, agent tools, subprocesses, and any compromised dependency. Environment-variable storage therefore expands access to the signing key beyond the component that strictly requires signing capability.

The warning not to paste the key into chat reduces conversational exposure but does not address plaintext persistence, child-process inheritance, endpoint compromise, backup exposure, or dependency-level theft.

### Attack Path

1. The user follows the instructions and appends the raw key to `~/.zshrc`, another sh
...[truncated 1279 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the recommendation to save raw private keys in .zshrc, .bashrc, fish universal variables, or any other plaintext startup configuration.
2. Prefer a hardware wallet, externally managed signer, or OS-backed credential store that does not expose raw key material to the CLI process.
3. If automated signing is unavoidable, use an encrypted secret manager or narrowly scoped signing service with explicit authorization policies, audit logs, and transaction constraints.
4. Provide the signing secret only to the exact process that needs it and only for the duration of one approved operation. Avoid exporting it in a parent shell or full agent session.
5. Use a dedicated low-value operational wallet with minimal balances and approvals rather than a primary wallet.
6. Require independent confirmation of chain ID, destination contract, transaction value, and calldata on a trusted signing device before authorization.
7. Enforce restrictive permissions on any unavoidable local secret file and exclude it from backups, synchronization, version control, logs, crash reports, and screen recordings.
8. Instruct existing users to remove the key from shell profiles, review shell history and synchronized dotfiles for copies, revoke unnecessary token approvals, transfer assets to a newly generated wallet, and rotate the key if exposure may have occurred.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (43)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The README instructs users to run npx skills add ... without pinning a specific version of the skills package. This creates a supply-chain risk because whatever version is latest at execution time will be fetched and run, potentially allowing a compromised or malicious release to execute code during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly recommends autonomous, non-interactive installation using --agent, -g, and -y, but does not clearly warn that this performs a global agent-scoped install and suppresses confirmation prompts. In the context of an agent skill that can drive on-chain staking and redemption flows, reducing user review around installation increases the chance of silently granting powerful functionality or malicious modifications to an agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The autonomous install example again uses unpinned npx skills, but in a more dangerous context: non-interactive, agent-targeted, global installation with -y. If the fetched package is malicious or compromised, it could install or modify agent capabilities without review, increasing the blast radius beyond a normal local interactive install.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger guidance says to use the skill whenever the user mentions broad topics like Bifrost, liquid staking, APY/TVL comparison, or claiming after redeem, even if they do not mention the CLI or skill. That breadth can cause unintended invocation in loosely related conversations, increasing the chance that the agent pulls in a transaction-capable tool unnecessarily and exposes users to confusing, risky, or premature on-chain workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs the agent to execute npx -y @bifrostio/slpx-cli --version without pinning an exact package version. Because npx resolves the latest published package at runtime, a compromised maintainer account, dependency-chain attack, or malicious new release could cause the agent to fetch and run unreviewed code, which is especially dangerous here because the same skill later supports signing and broadcasting blockchain transactions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This fallback guidance explicitly suggests using a moving dist-tag such as @next, which increases supply-chain risk beyond even latest because prerelease tags are less stable and more likely to contain unreviewed changes. In a skill that may handle configured signing wallets and on-chain execution, running code from an unpinned prerelease package could lead to wallet compromise, malicious transaction construction, or unsafe prompts to the user.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill repeatedly instructs agents to execute npx -y @bifrostio/slpx-cli without pinning an exact package version. This creates a supply-chain risk: a future malicious or compromised npm release could be fetched and executed automatically, and in this skill context the package can access signing-wallet workflows and prepare or broadcast blockchain transactions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This example uses unpinned npx execution of @bifrostio/slpx-cli, allowing whatever version is current at execution time to run. Because the documented tool supports wallet-aware on-chain operations, a compromised package version could lead to credential exposure, malicious transaction generation, or deceptive outputs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The command invokes an npm package via npx without version pinning, which is a known remote-code-execution supply-chain exposure. In this skill, the risk is amplified because the CLI is positioned for financial operations and may run where a default signing key is configured.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

An unpinned npx command means the executed code is mutable over time and controlled by the npm supply chain rather than the reviewed skill contents. If the package or one of its delivery channels is compromised, an agent could run attacker-controlled code while handling crypto-related tasks.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This invocation fetches and executes the latest matching npm package at runtime. In a wallet-enabled staking skill, that is dangerous because an attacker who controls a release could influence balances, status responses, unsigned transaction previews, or signing flows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill documentation normalizes use of floating npx installs for APY queries. Even though this specific command is read-oriented, the same package also supports transaction-affecting operations, so compromise of the package can still result in arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

Running npx -y @bifrostio/slpx-cli without a version allows silent package drift and execution of newly published code. Given the DeFi/crypto context, this increases the blast radius from misinformation to wallet misuse or system compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This example demonstrates unpinned installation and execution from npm, which is a genuine supply-chain weakness. Since the skill encourages agent automation, operators may mistakenly treat these commands as safe templates, increasing the chance of repeated vulnerable execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The command relies on a floating package reference from npm, exposing the agent to unauthorized code changes outside source review. In combination with access to RPC endpoints and possibly signing configuration, this could enable harmful blockchain interactions or local compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This unpinned npx example creates a trust-on-first-use dependency on the current npm state rather than on the reviewed skill. Because the CLI spans both informational and transactional functionality, compromise could affect on-chain decisions and system security alike.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill instructs direct execution of a mutable npm package version. In a protocol-overview command, attackers could manipulate output data to influence financial choices or exploit the host by delivering malicious package code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

Because this command is unpinned, the actual code executed can change without any modification to the skill file. In a crypto workflow, that makes the documentation itself a vector for repeatable supply-chain compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This balance-query example still executes a mutable npm package via npx. Even if intended as read-only, arbitrary code execution occurs before any CLI-level permission boundaries, so the host environment remains exposed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The command invites agents to fetch and run the latest package release automatically. In environments where a default signing wallet may exist, malicious package updates could harvest addresses, env vars, or transaction-related metadata.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

Unpinned execution from npm is a real supply-chain vulnerability, not just a documentation issue, because users often copy these examples directly into automation. The asset-management context makes compromise more dangerous than in a generic toy utility.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This batch balance command still depends on an unpinned remote package, so the risk of malicious release execution remains. The batch nature may also increase data exposure by processing multiple user addresses at once.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The status command is documented with floating npx resolution, which allows arbitrary future code to run in the agent environment. Because status can omit an address and fall back to the default signing wallet, package compromise has direct wallet-adjacent relevance.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This example has the same unpinned npx supply-chain risk as the others. The risk is heightened here because the command deals with redemption queue state for a wallet address, making it more useful for attacker reconnaissance or deception.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence

Finding

This mint example combines unpinned npm execution with a transaction-affecting command. A compromised package version could alter transaction parameters, redirect funds, abuse approvals, or exfiltrate signing material before or during broadcast.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.