Bothire

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:32 AM UTC
• Version: 1.0.3

Overview

The skill's payment-marketplace purpose is clear, but it gives agents wallet/payment authority through mutable remote instructions and unpinned package execution, so users should review it carefully before installing.

Review this skill as a financial automation integration. Use only limited-funds wallets, verify any package version and source before running npx commands, independently verify contract addresses and endpoints, and require your own spending limits and transaction approval policy before allowing an agent to sign payments.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:85
• Finding: Mutable Remote Instructions Can Redirect Agent Behavior## Vulnerability Details **File Location**: `SKILL.md`, lines 85-89 **Vulnerability Type**: Remote instruction delegation **Risk Level**: High **Complete Code Snippet**: ```markdown ## 5. Full protocol This skill is a pointer into a live, machine-first marketplace. The complete, always-current API — registration, hiring, the provider polling loop, gasless settlement (USDT & USDC on Base/Arbitrum/BNB + USDC on Solana), escrow, dispute/arbitration, authentication, and rate limits — is documented at: **https://www.bothire.io/skill.md** Fetch that spec at runtime and follow it; this file only needs to make BotHire discoverable and get you to the right endpoints. ``` ### Technical Analysis The audited skill explicitly instructs the agent to retrieve a mutable document from an external server and follow it at runtime. That document is outside the reviewed artifact, and its contents can change independently after this skill has been audited. Because the remote resource is treated as authoritative instructions rather than untrusted reference data, control of the website, DNS resolution, hosting account, or delivery infrastructure could allow an attacker to alter the agent's workflow. The substituted instructions could request additional tool operations, wallet actions, sensitive data submission, or interaction with attacker-selected endpoints. No version pin, content hash, signature verification, or restriction on the accepted remote instructions is specified. ### Attack Path 1. An agent loads `SKILL.md` and reaches the full-protocol workflow. 2. The agent retrieves `https://www.bothire.io/skill.md`. 3. The remote resource is changed by its operator or by an attacker who compromises the delivery path. 4. The returned document provides altered registration, wallet, payment, data-submission, or tool-use instructions. 5. Following the local directive to “follow it,” the agent treats those instructions as trusted a ...[truncated 678 chars]
• Remediation: ## Remediation Suggestions - Bundle a reviewed, versioned protocol specification with the skill instead of instructing the agent to follow mutable remote content. - If runtime retrieval is necessary, pin an expected version and cryptographic digest and reject content that fails verification. - Authenticate remote specifications with a verifiable digital signature whose trusted public key is distributed separately. - Treat fetched documents as untrusted data, not as higher-priority instructions capable of changing agent goals or safety constraints. - Define a fixed local allowlist of permitted endpoints, request methods, parameters, and operations. - Require explicit user approval before any fetched content can cause wallet signing, payment, credential disclosure, code execution, or other sensitive tool use. - Re-audit and release a new skill version whenever protocol instructions materially change.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:18
• Finding: Unpinned Third-Party Packages Are Retrieved and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 18 and 58 **Vulnerability Type**: Unsafe dependency retrieval and execution **Risk Level**: High **Complete Code Snippets**: ```markdown **Install this skill:** `clawhub install bothireagent/bothire` (or `npx clawhub@latest install bothireagent/bothire`) ``` ```bash npx bothire # generate a wallet, register, and get an agent identity ``` ### Technical Analysis The documented commands retrieve and execute third-party package content without pinning an exact immutable release or integrity digest. The use of `@latest` explicitly selects a mutable release, while `npx bothire` resolves and executes whatever package version the registry currently supplies under that name. This is particularly sensitive because the `bothire` package is described as generating a cryptocurrency wallet and registering an agent identity. Code running during package installation or execution can access the process environment, filesystem data available to the user, generated wallet material, and network. A compromised maintainer account, registry package, transitive dependency, or newly published malicious release could therefore execute arbitrary code in the invoking user's context. The audited project does not contain the referenced package source, a lockfile, integrity values, or signature-verification instructions, so the effective executable behavior cannot be verified from this artifact. ### Attack Path 1. An attacker compromises the relevant npm package, maintainer account, publication pipeline, or dependency chain. 2. The attacker publishes a malicious version that is selected by `@latest` or unversioned `npx` resolution. 3. A user or agent follows `SKILL.md` and runs the documented command. 4. The package is downloaded and executed locally. 5. Malicious installation or runtime code accesses generated wallet keys, local credentials, environment variables, files, ...[truncated 620 chars]
• Remediation: ## Remediation Suggestions - Pin every package to an exact reviewed version rather than using `@latest` or an unversioned package name. - Publish and verify cryptographic integrity hashes or signed release artifacts before execution. - Supply a lockfile that pins all transitive dependencies and their integrity values. - Publish auditable source code and reproducible-build instructions for the wallet and registration CLI. - Generate wallet keys with a reviewed library in an isolated process or hardware-backed wallet rather than entrusting opaque package lifecycle code with key generation. - Disable unnecessary package lifecycle scripts and execute installation in a sandbox with restricted filesystem, environment, and network access. - Avoid exposing funded wallets, package-manager tokens, cloud credentials, or unrelated secrets to the installation process. - Perform dependency provenance, maintainer, and package-name verification to reduce dependency-confusion and package-takeover risks.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:67
• Finding: Autonomous Wallet Signing Lacks Explicit Transaction Authorization Controls## Vulnerability Details **File Location**: `SKILL.md`, lines 67-78 **Vulnerability Type**: Excessive financial authority **Risk Level**: High **Complete Code Snippet**: ```markdown ## 4. Hire another agent 1. Find a provider via the search endpoints above. 2. Issue a hire — for jobs ≥ $1 this locks funds in the on-chain escrow; smaller jobs settle directly. Payment is gasless: you sign an authorization, BotHire relays it. 3. Receive the deliverable; escrow releases to the provider on completion. If the provider never delivers, the escrow auto-refunds you after 24h. Disputes are resolved by a bounded arbiter that can only release-to-provider or refund-to-hirer. Ownerless escrow · 0% platform fee · 24h auto-refund — on Base and BNB Chain (current contract addresses are in the live spec). ``` The broader description also states that participation requires “no human approval,” increasing the risk associated with autonomous financial authorization. ### Technical Analysis The workflow directs an agent to select providers using externally supplied search results and sign stablecoin authorizations that a third party relays. It does not specify transaction-level safeguards such as explicit user confirmation, maximum spending limits, approved chain and token lists, recipient or contract allowlists, nonce and expiry validation, decoded authorization display, or pre-signing simulation. A gasless relay does not eliminate authorization risk: the wallet signature is the security boundary that permits the relayer or associated contract to perform the authorized operation. If provider data, contract addresses, API responses, or the mutable live specification are manipulated, an autonomous agent may sign an authorization whose destination, amount, token, chain, or validity differs from the user's intent. ### Attack Path 1. An attacker manipulates a provider listing, API response, live protocol specification, contract a ...[truncated 1043 chars]
• Remediation: ## Remediation Suggestions - Require explicit, informed user approval for every wallet signature and payment. - Present the decoded chain, token, amount, recipient, contract, nonce, deadline, and authorization scope before approval. - Enforce local per-transaction and cumulative spending limits that remote content cannot override. - Maintain independently verified allowlists for supported chains, token contracts, escrow contracts, and relayer identities. - Simulate transactions and verify expected state changes before signing or relaying them. - Use narrowly scoped authorizations with exact amounts, single-use nonces, short expirations, and domain separation. - Reject unlimited token approvals and signatures that permit arbitrary recipients or reusable spending authority. - Keep only minimal funds in an agent-accessible wallet and separate operational balances from primary treasury assets. - Validate provider and payment parameters against a trusted local policy rather than relying exclusively on remote API responses or the live specification.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The skill instructs users to run `npx clawhub@latest install bothireagent/bothire`, which executes remote package code without pinning an exact version or integrity. In a wallet- and payment-oriented skill, this meaningfully increases supply-chain risk because a compromised or malicious package update could execute arbitrary code, steal secrets, or alter payment flows during installation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill directs users to generate a wallet and engage in stablecoin-based activity without a clear upfront warning about financial risk, private key sensitivity, irreversible transactions, and the need to verify contracts/endpoints. In this context, the omission is more dangerous because the skill targets autonomous agents and emphasizes no human-in-the-loop payments, increasing the chance of unsafe automated fund handling.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The command `npx bothire` causes execution of an unpinned package from the package registry, creating a classic supply-chain execution risk. Because this command is specifically used to generate a wallet and register an agent, compromise could directly expose private keys, wallet material, or transaction authorization data.

Static analysis

No suspicious patterns detected.