Security audit

Transact

Security checks across malware telemetry and agentic risk

Overview

This crypto transaction skill is mostly disclosed and purpose-aligned, but its high-impact signing ability is paired with under-scoped network and command authority that needs review.

Install only if you intend to let an agent prepare and sign crypto transactions. Use a test wallet first, avoid pasting production private keys or seed phrases, review every queued transaction, simulate multi-step batches, and only approve custom RPC or backend URLs you trust. For stricter environments, pin the CLI version and restrict npx/backend/RPC access externally.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The manifest and description frame the skill as EVM-focused, but the prerequisites also permit Solana signing flows. That scope mismatch can cause reviewers or policy engines to underestimate what assets and signing capabilities the skill can reach, which is dangerous in a transaction-signing skill handling real funds.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The documented command surface includes login, account inspection, cron, deploy, and secret-management operations that go beyond the stated purpose of building and signing transaction requests. In a high-risk crypto context, unnecessary auth and secret-handling features enlarge the attack surface and increase the chance of credential misuse, persistent access, or unintended privileged actions.

Scope Creep

High

Confidence: 93% confidence
Finding: The compatibility text says the CLI can target staging and use user-supplied RPC endpoints, but the permissions manifest declares outbound network access only to api.aomi.dev. This inconsistency means operators may believe egress is tightly constrained when the documented workflow contemplates additional destinations, creating a risk of hidden data exfiltration, unreviewed third-party RPC exposure, or signing against unintended infrastructure.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The safety justification asserts outbound traffic is restricted to api.aomi.dev, yet the same document instructs use of staging and arbitrary RPC endpoints. In a wallet-signing skill, misleading safety claims are especially dangerous because they can cause users and platforms to trust the skill's network boundaries while secrets, transaction data, or account activity may be sent elsewhere.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The trigger criteria are broad enough to match generic crypto, finance, wallet, and assistant requests, which can cause the skill to activate in situations where users only wanted information rather than transaction-capable tooling. Because this skill can ultimately stage wallet-signed actions, overbroad routing increases the risk of accidental invocation of a high-privilege capability.

Session Persistence

Medium

Category: Rogue Agent
Content: - **Shell allowlist** scopes execution to `aomi` and `npx @aomi-labs/client@latest` only — no arbitrary subprocesses. - **Network allowlist** restricts outbound traffic to `api.aomi.dev`. User-supplied `--rpc-url` endpoints are resolved by the CLI itself; operators must review them before allowing signing. - **File scope** is read+write to `~/.aomi/` only; identity files (`SOUL.md`, `MEMORY.md`, `AGENTS.md`) are deny-listed against writes per OWASP AST03 mitigation #3. - **No blind signing.** Multi-step flows go through `aomi tx simulate` on a forked chain before `aomi tx sign`. Drain-vector calldata fields (`recipient`, `onBehalfOf`, `mintRecipient`, `_to`) are blocked at simulation time when they do not equal `msg.sender` — see [drain-vectors.md](references/drain-vectors.md). - **Opaque credentials.** The skill never fabricates, derives, or echoes credential values; setup commands run only when the user explicitly asks and supplies the value in this turn. Full rules in [gotchas.md → Hard Rules](references/gotchas.md#hard-rules).
Confidence: 76% confidence
Finding: write to `~/.aomi

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.