forgex-skill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:12 AM UTC
• Version: 1.0.1

Overview

The skill is a crypto wallet and trading CLI guide whose sensitive capabilities are disclosed, but its documented setup and examples handle wallet secrets and exports in ways that create serious loss-of-funds risk.

Review this carefully before installing. Use only isolated test wallets first, avoid entering real private keys or passwords on the command line, do not create plaintext CSV wallet backups, verify the npm package provenance and exact version, and treat any live command as capable of causing irreversible fund loss.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:38

Finding

Unpinned Global Installation of a Security-Critical Third-Party Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:38-42
Vulnerability Type: Unpinned third-party dependency and supply-chain exposure
Risk Level: High

Vulnerable Code

bash

npm install -g forgex-cli

The installed CLI is subsequently entrusted with wallet passwords, private keys, and authorization of financial transactions. However, the installation command does not pin an exact package version or provide a lockfile, integrity hash, source revision, or signature-verification procedure.

Technical Analysis

Installing the latest version of forgex-cli globally means that the effective code depends on whatever package version npm serves at installation time. The reviewed project contains only SKILL.md; it does not include the CLI implementation or sufficient provenance information to verify its behavior.

This creates a supply-chain trust boundary around an unaudited, mutable external package. If the package publisher account, npm distribution channel, or a future release is compromised, malicious code could execute during installation or when the CLI is invoked. Global installation also makes the executable available outside a project-isolated dependency environment.

The documentation alone does not establish that the named package is malicious. The vulnerability is the unsafe, unpinned installation method for a tool that receives exceptionally sensitive credentials and transaction authority.

Attack Path

1. An attacker compromises the npm publisher account, package distribution process, or a future package release.
2. The attacker publishes a malicious version under the expected package name.
3. A user follows the documented npm install -g forgex-cli instruction.
4. npm installs the attacker-controlled version, potentially executing installation lifecycle scripts.
5. When used as documented, the CLI receives wallet passwords, private keys, backup credentials, and authority to sign transa ...[truncated 630 chars]

Remediation

View remediation

Remediation Suggestions

• Pin an audited, exact package version rather than installing the latest release implicitly.
• Publish and reference verifiable source code, a lockfile, release signatures, and package integrity hashes.
• Verify package provenance and integrity before installation.
• Prefer a project-local installation or an isolated container over global installation.
• Disable npm lifecycle scripts where operationally feasible, or separately audit every required lifecycle script.
• Run the CLI under a dedicated, least-privileged account with restricted filesystem and network access.
• Require independent transaction review or hardware-wallet confirmation for high-value operations.
• Establish a controlled update process that audits new versions before deployment.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:119

Finding

Wallet Secrets and API Credentials Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:119-150, 178-207
Vulnerability Type: Sensitive information exposure through process arguments and shell history
Risk Level: High

Vulnerable Code

bash

forgex --password "your-password" <command> [subcommand] [options]

bash

forgex config set codexApiKey "your-api-key"

# View all config
forgex config get

bash

# Add an existing wallet by private key
forgex --password "pwd" wallet add --group 1 --private-key "Base58Key..." --note "main wallet"

# Import from CSV (format: privateKey,note)
forgex --password "pwd" wallet import --group 1 --file ./wallets.csv

bash

forgex --password "pwd" wallet export-group \
  --file ./all-groups.json \
  --encrypt \
  --password "file-encryption-password"

forgex --password "pwd" wallet import-group \
  --file ./all-groups.json \
  --password "file-encryption-password"

Technical Analysis

The documentation consistently instructs users to provide wallet-database passwords, raw private keys, backup-encryption passwords, and an API key as command-line arguments. Process arguments are not a suitable secret-delivery channel.

Depending on the operating system and environment, arguments may be exposed through process inspection, shell history, terminal capture, audit logs, process monitoring, crash telemetry, automation logs, or agent conversation transcripts. Even if process-list visibility is restricted, shell history commonly persists after command completion.

The config get example immediately following API-key configuration also creates uncertainty about whether sensitive configuration values are redacted when displayed. The implementation is unavailable, so actual output behavior cannot be confirmed; API-key output exposure is therefore a hardening concern rather than a separately confirmed disclosure.

Attack Path

1. A user follows the documented examples an ...[truncated 1255 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all secret-bearing command-line options from recommended workflows.
• Read passwords and private keys from a non-echoing interactive prompt.
• For automation, accept secrets through permission-restricted file descriptors, an OS credential store, or a dedicated secrets manager.
• Avoid ordinary environment variables for long-lived wallet secrets because they can also leak through diagnostics and child processes.
• Ensure secret buffers are cleared when no longer needed and never written to application logs.
• Redact API keys, private keys, passwords, and sensitive configuration values from all output, including JSON and error messages.
• Make config get return masked values for secret fields.
• Add prominent instructions for clearing any shell history that may already contain real secrets and rotating exposed credentials.
• Prevent agents and automation systems from retaining secret-bearing commands in transcripts.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:188

Finding

Wallet Group Exported to an Unencrypted CSV File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:188-202
Vulnerability Type: Plaintext storage of wallet private keys
Risk Level: Critical

Vulnerable Code

bash

# Import from CSV (format: privateKey,note)
forgex --password "pwd" wallet import --group 1 --file ./wallets.csv

bash

# Export group as CSV
forgex --password "pwd" wallet export --group 1 --file ./backup.csv

# Export all groups as encrypted JSON
forgex --password "pwd" wallet export-group \
  --file ./all-groups.json \
  --encrypt \
  --password "file-encryption-password"

Technical Analysis

The documented CSV import format explicitly contains privateKey,note. The corresponding group export example writes backup.csv without an encryption option, while encryption is shown only for the separate all-groups JSON export. This indicates that the standard CSV backup workflow places wallet material in a plaintext file.

Plaintext private-key files are vulnerable to accidental repository commits, cloud synchronization, endpoint indexing, permissive filesystem modes, backup retention, malware collection, shared-directory access, and forensic recovery after deletion. File extensions such as .csv may also cause spreadsheet applications or preview services to copy or upload their contents.

Because possession of a blockchain private key is generally sufficient to authorize transactions, filesystem access to this backup can become direct control over every exported wallet.

Attack Path

1. A user runs the documented CSV export command.
2. The CLI writes wallet private keys into backup.csv without encryption.
3. The file is retained with ordinary permissions, synchronized to cloud storage, included in a system backup, attached to a support request, opened by another application, or accidentally committed to source control.
4. An attacker obtains read access to the file through local compromise, shared storage, leaked ...[truncated 703 chars]

Remediation

View remediation

Remediation Suggestions

• Encrypt every export containing private keys by default using a modern authenticated-encryption construction.
• Require an explicit, strongly worded unsafe override before allowing plaintext export.
• Derive encryption keys from backup passphrases using a memory-hard KDF with a unique salt and strong parameters.
• Obtain backup passphrases through a non-echoing prompt rather than command-line arguments.
• Create backup files atomically with owner-only permissions, such as mode 0600 on supported systems.
• Refuse to export into known source-control trees, shared directories, or insecure filesystems unless explicitly overridden.
• Provide integrity and version metadata so backup tampering can be detected.
• Document secure offline storage, restoration testing, retention limits, and key rotation procedures.
• Warn users that deleting an unencrypted file may not remove copies from backups, repository history, cloud synchronization, or storage media.
• If a plaintext export has existed, migrate all affected assets and authorities to newly generated wallets rather than relying solely on file deletion.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents private-key handling, wallet export/import, and live fund transfer operations but does not prominently warn users about sensitive credential exposure, secure storage, or the irreversible nature of blockchain transactions. In this context, the omission is more dangerous because the skill is explicitly designed for high-risk financial actions such as bulk wallet management, token launches, sniping, and automated trading, which increases the chance of accidental loss or key compromise.

Content

No source excerpt is available for this finding.