XLMTools

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:44 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for live data and Stellar tooling, but its unpinned install path, broad triggers, and automatic wallet/payment setup need user review before installation.

Install only if you are comfortable running mutable npm-hosted code in your agent environment. Prefer pinned versions or an isolated sandbox, review the XLMTools npm packages separately, set an MCP budget before paid use, and be aware that first run creates a local wallet configuration and performs testnet setup automatically.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unpinned npm Packages Permit Mutable Third-Party Code Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–25; repeated at lines 237 and 245
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

# Standalone CLI (universal — works with any agent host that has Bash)
npm install -g @xlmtools/cli

# MCP server (optional fast-path for Claude Code, Cursor, Cline, OpenClaw, etc.)
claude mcp add xlmtools npx @xlmtools/mcp

The troubleshooting section repeats the same mutable package installation instructions:

text

**"Command not found: xlm"** — User needs to install: `npm install -g @xlmtools/cli`

text

**MCP tools not appearing** — User may need to install XLMTools as an MCP server: `claude mcp add xlmtools npx @xlmtools/mcp`.

Technical Analysis

Both commands reference npm packages without exact versions, integrity hashes, signatures, or a lockfile. Consequently, their effective executable payload is determined by the package registry at installation or invocation time rather than by the reviewed skill artifact.

npm install -g installs the resolved package globally and can execute npm lifecycle scripts with the invoking user's privileges. The MCP command delegates execution to npx, which may retrieve and execute the version currently published under @xlmtools/mcp. Because the audited project contains only SKILL.md, the executable package implementations and transitive dependencies cannot be reviewed or verified from this artifact.

This does not establish that either named package is malicious. It establishes a mutable supply-chain boundary through which a compromised publisher account, malicious future release, or compromised transitive dependency could introduce arbitrary code after this skill has been audited.

Attack Path

1. An attacker compromises the npm publisher account, package release process, registry delivery path, or a transitive dependency used by one of the referenced packages.
2. The att ...[truncated 1362 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each package to an exact, reviewed version rather than resolving the latest release:

   bash

   npm install -g @xlmtools/cli@<reviewed-exact-version>
   npx --yes @xlmtools/mcp@<reviewed-exact-version>
   

2. Publish cryptographic checksums or package signatures through a trusted channel and require verification before execution.

3. Supply a lockfile and software bill of materials that identify all direct and transitive dependency versions.

4. Document npm lifecycle scripts and package provenance so users can review what executes during installation.

5. Prefer a project-local, isolated installation over a global installation. Run the package in a sandbox or container with restricted filesystem and network access.

6. Use a trusted internal registry or allowlist where practical, and continuously monitor the package namespace and dependencies for publisher changes, unexpected releases, and known vulnerabilities.

7. Ensure the MCP host exposes only the minimum required directories, environment variables, credentials, and network permissions to the package.

8. Provide reproducible build instructions and immutable release artifacts so the distributed executable can be compared with reviewed source code.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger guidance is overly broad, telling the agent to invoke this skill for mentions of "latest" anything, live prices, current events, or any URL fetch. In this skill's context, invocation can lead to external requests and paid tool use, so broad matching increases the risk of unnecessary data exfiltration, unwanted network access, and unintended spending.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to install and execute an MCP server via npx @xlmtools/mcp without pinning an exact version or integrity-verified source. That creates a supply-chain risk: a later compromised or malicious package version would be fetched and executed automatically in the agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description does not prominently warn up front that first run auto-creates a wallet, writes to ~/.xlmtools/config.json, funds it, and adds a trustline. Those are state-changing blockchain and filesystem actions, and users may invoke the skill expecting passive data retrieval rather than local persistence and account modification.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The skill explicitly directs the agent to fetch remote metadata from api.xlmtools.com for runtime discovery. External transmission is expected for this kind of live-data skill, but it still creates a data exposure and trust-boundary risk because the agent may contact a remote service based on skill instructions and consume potentially adversarial metadata.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

1. **MCP tools first.** If tools named `mcp__xlmtools__*` are in your tool list, call them directly. They handle payment automatically and benefit from response caching.
2. **CLI fallback.** If no MCP tools are available, run `xlm` via the Bash tool. Same wallet, same backend, same payment flow.
3. **Runtime discovery (optional).** If you're an autonomous agent encountering XLMTools for the first time, you may fetch `https://api.xlmtools.com/.well-known/xlmtools.json` (JSON manifest) or `https://api.xlmtools.com/llms.txt` (plain text) for service metadata. If those URLs are unreachable (the hackathon demo may not be deployed yet), fall back to **this SKILL.md file** — every tool, price, and command documented here is authoritative.

## When NOT to use this skill

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This is a second unpinned runtime package execution path for the MCP server. Repeating the same unsafe install/run pattern in troubleshooting guidance increases the chance that users execute whatever package version is current at the time, including a compromised release.

Content

No source excerpt is available for this finding.