Security audit

KashDAO CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for KashDAO trading, but it asks users to install a mutable global CLI and use sensitive trading credentials with insufficiently constrained endpoint override behavior.

Install only after you are comfortable trusting the KashDAO npm package and its update process. Prefer a pinned reviewed CLI version, use a least-privilege revocable test key first, avoid custom base URLs unless they are official Kash endpoints you control, and do not point signerKeyRef at valuable keys unless you have independently reviewed the CLI behavior.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:22
Finding: Unpinned Executable npm Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:16
Finding: Authenticated API Requests Can Be Redirected to an Arbitrary Base URL
Content: View full analysis
` | Override the auto-routed base URL. | ``` ### Technical Analysis The skill exposes both an environment variable and a command-line option that can override the API base URL. No hostname allowlist, HTTPS-only requirement, certificate-pinning policy, or explicit approval mechanism is documented for nonstandard endpoints. The same client is expected to operate with `KASH_API_KEY`. If the implementation sends that credential to the configured base URL, an attacker who can influence `KASH_BASE_URL`, `--base-url`, a selected profile, or generated command arguments could redirect authenticated requests to an attacker-controlled service. Because the CLI implementation is not included in the audited project, it is not possible to confirm whether authorization headers are sent to arbitrary hosts or retained across redirects. The risk therefore arises from the documented unrestricted configuration surface and the absence of stated credential-binding protections. ### Attack Path 1. An attacker influences the environment, selected profile, automation configuration, or command arguments used by an agent. 2. The attacker sets `KASH_BASE_URL` or supplies `--base-url` with an attacker-controlled HTTPS endpoint. 3. The agent invokes an authenticated command such as a market, portfolio, webhook, quote, or trade operation. 4. If the CLI attaches `KASH_API_KEY` to requests sent to the configured host, the attacker-controlled server receives the credential and request data. 5. The attacker reuses the exposed c ...[truncated 847 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep