Security audit

Transact

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about helping agents create and sign crypto transactions, but it uses an unpinned npm execution path and broad npx permission in a wallet-signing context.

Install only after reviewing the wallet risk. Prefer a pinned, locally installed Aomi CLI instead of @latest, use a dedicated or low-balance wallet, avoid pasting raw private keys into agent-visible commands, inspect and simulate every transaction before signing, and check token allowances after swaps.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:50
Finding: Mutable npm Package Is Retrieved and Executed in a Wallet-Signing Workflow
Content: View full analysis
/dev/null || npx @aomi-labs/client@latest --version` ``` Equivalent mutable installation and execution instructions also appear in `references/workflows.md:9-14` and `templates/aomi-workflow.sh:30-45`. ### Technical Analysis The Skill directs the Agent to retrieve and execute the mutable npm tag `@aomi-labs/client@latest`. The reviewed project does not pin an exact package version, provide an integrity digest, include a lockfile, or verify a signed package attestation. As a result, the code that runs after installation is not necessarily the code corresponding to the stated audited version `0.1.42`. The effective payload can change whenever the npm publisher updates the `latest` tag. This is especially sensitive because the dependency operates in a cryptocurrency workflow with access to wallet-signing material, authentication tokens, transaction calldata, and local Aomi state. Although the Skill documentation acknowledges the supply-chain risk, that acknowledgement does not technically constrain or verify the retrieved package. ### Attack Path 1. An attacker compromises the npm publisher account, package build pipeline, or ...[truncated 1377 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:19
Finding: Generic npx Tool Permission Exceeds the Skill's Required Command Scope
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/commands.md:47
Finding: Wallet Keys and Provider Secrets Are Supplied Through Process Arguments
Content: View full analysis
[NAME=...] # user-directed only (see workflows.md) ``` ```bash aomi wallet ls # linked wallets, providers, signing policy, grants aomi wallet ls --provider privy # filter linked wallets by provider aomi wallet dev-key # user-directed EVM 0x key aomi wallet dev-key --solana # user-directed Solana keypair ``` ```bash aomi deploy --activation-token "$AOMI_DEPLOY_TOKEN" --app-source-id ``` Additional argument-based secret flags are documented at `references/commands.md:115-125`: ```text --api-key --account-bearer --account-provider-token --private-key --solana-private-key ``` ### Technical Analysis Secrets passed as command-line arguments can be exposed through several operating-system and tooling channels: - Shell history files. - Process listings and process-monitoring utilities. - Agent tool-call logs and terminal session recordings. - CI/CD command logs. - Debug output, crash reports, or telemetry. - Parent-process command capture. The instruction not to echo a value after the command runs does not address exposure that occurs while constructing or executing the command. Explicit user consent also does not make argv a secure secret transport. The most severe affected values are EVM and Solana private keys, because disclosure can directly grant control over wallet assets. Provider, exchange, account, and deployment tokens may also provide privileged access to external services. ### ...[truncated 1138 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/examples.md:62
Finding: Example Grants an Unlimited Token Allowance for a Minimal Swap
Content: View full analysis
, 1_000_000, 0, 0)) simulate_batch → Batch success: true (no drain-vector annotations) ``` ### Technical Analysis The example swaps only `1_000_000` USDC base units, equivalent to one USDC, but grants the router the maximum possible ERC-20 allowance. This violates least privilege because the spender receives authority far beyond the amount required for the current operation. A successful simulation verifies the immediate approve-and-swap sequence against current chain state. It does not eliminate the remaining allowance or protect the user if the approved spender, proxy administration, integration, or routing assumptions are compromised later. The project demonstrates exact-amount approvals elsewhere, including Aave and CCTP examples, so the unlimited Uniswap approval is not technically required by the general workflow. ### Attack Path 1. The user follows the documented one-USDC swap workflow. 2. The user signs `approve(router, MAX)`. 3. The swap consumes only the requested amount, leaving a very large persistent allowance. 4. At a later time, the approved spender is compromised, upgraded maliciously where applicable, or otherwise becomes capable of abusing the allowance. 5. The spender calls `transferFrom` against the user's wallet. 6. Tokens deposited into the wallet after the original swap may also be exposed while the allowance remains active. ### Impact Assessment The approv ...[truncated 535 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
pps.md](references/apps.md), [examples.md](references/examples.md), [thread.md](references/thread.md), [drain-vectors.md](references/drain-vectors.md), [trouble

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SECURITY.md (reported line 9)May include surrounding context.
md
## Threat model `aomi-transact` is a procedure for an AI agent to drive the [`@aomi-labs/client`](https://www.npmjs.com/package/@aomi-labs/client) CLI — composing natural-language intents into queued wallet requests, simulating them on a forked chain, and signing them via account-abstraction-first execution. The skill itself does not custody funds, sign without explicit user request, or write outside `~/.aomi/`. The CLI it drives, however, **does** execute on-chain transactions, so the skill is correctly classified as **risk_tier: L2** (elevated) under the OWASP universal manifest schema. ## Controls by AST risk

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The document explicitly permits use of npx @aomi-labs/client@latest, which is effectively an unpinned remote package execution path. Even though this is only documentation/security posture text, it describes and endorses a supply-chain-risky execution model where a compromised or malicious newly published package version could be fetched and run by an agent or user.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: This line documents shell permissions that include npx @aomi-labs/client@latest, which still allows execution of whatever package version npm resolves at runtime. In an agent skill, broad approval of that command increases supply-chain exposure because the agent is authorized to launch freshly fetched code under that package name.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This section acknowledges a HIGH finding for launching via npx without version pinning and confirms the skill intentionally uses npx @aomi-labs/client@latest. Because the text normalizes the practice rather than prohibiting it, it reflects a real supply-chain weakness: runtime execution may drift to an unreviewed package version.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This section acknowledges a HIGH finding for launching via npx without version pinning and confirms the skill intentionally uses npx @aomi-labs/client@latest. Because the text normalizes the practice rather than prohibiting it, it reflects a real supply-chain weakness: runtime execution may drift to an unreviewed package version.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: This duplicate match is the same underlying issue: endorsing execution of an unpinned npm package in a high-risk skill. The surrounding context makes it more dangerous than in a low-privilege skill because the package is involved in preparing and signing on-chain transactions.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.
md
name: aomi-transact description: > Build natural-language crypto agents, web3 assistants, and trading bots that read and write EVM chain state. Aomi turns prompts ("swap 1 ETH for USDC", "open a 3x GMX long", "bet $100 on Polymarket") into wallet-signed transactions on Ethereum, Base, Arbitrum, Optimism, Polygon, Linea — non-custodial, fork-simulated. Use when the user wants a crypto/DeFi agent, AI trading/wallet assistant, or on-chain

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill repeatedly instructs use of npx @aomi-labs/client@latest, which is an unpinned remote package execution path. If the npm package, maintainer account, or dependency chain is compromised, the agent could fetch and execute attacker-controlled code at runtime, and in this skill that code is in a wallet/transaction-signing context, making the blast radius materially higher than a typical CLI helper.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This command fallback executes npx @aomi-labs/client@latest --version, which still causes resolution and possible download/execution of the latest published package. In a high-risk crypto skill, unpinned package execution can become a supply-chain entry point to steal keys, alter transaction construction, or bypass expected safeguards.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The allowed shell command surface includes npx @aomi-labs/client@latest, which authorizes execution of whatever code npm currently serves for that package name. Because the skill handles blockchain transaction creation and signing workflows, a compromised package could directly manipulate or exfiltrate sensitive wallet material or produce malicious transactions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The safety justification itself states execution is scoped to aomi and npx @aomi-labs/client@latest, but using latest undermines that control because the code identity can change over time without review. In a transacting wallet skill, this makes the skill materially more dangerous than a normal tooling integration due to direct exposure to funds and signing flows.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 73% confidence
Finding: The skill is explicitly permitted to read and write ~/.aomi/, which introduces local persistence of wallet/session/configuration material. While scoped to a dedicated directory and less dangerous than arbitrary filesystem write access, persistence in a crypto tool context can retain secrets, auth tokens, transaction state, or account metadata that may be abused by compromised tooling or later unintended reuse.
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
md
- **Shell allowlist** scopes execution to `aomi` and `npx @aomi-labs/client@latest` only — no arbitrary subprocesses. - **Network allowlist** restricts outbound traffic to `api.aomi.dev`. User-supplied `--rpc-url` endpoints are resolved by the CLI itself; operators must review them before allowing signing. - **File scope** is read+write to `~/.aomi/` only; identity files (`SOUL.md`, `MEMORY.md`, `AGENTS.md`) are deny-listed against writes per OWASP AST03 mitigation #3. - **No blind signing.** Multi-step flows go through `aomi tx simulate` on a forked chain before `aomi tx sign`. Drain-vector calldata fields (`recipient`, `onBehalfOf`, `mintRecipient`, `_to`) are blocked at simulation time when they do not equal `msg.sender` — see [drain-vectors.md](references/drain-vectors.md). - **Opaque credentials.** The skill never fabricates, derives, or echoes credential values; setup commands run only when the user explicitly asks and supplies the value in this turn. Full rules in [gotchas.md → Hard Rules](references/gotchas.md#hard-rules).

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The documentation recommends invoking the CLI via npx @aomi-labs/client@latest, which pulls and executes the newest package version at runtime rather than a pinned, reviewed release. In an agent skill context, this creates a supply-chain risk: a compromised upstream package or unexpected breaking change could alter command behavior, including wallet, secret, backend, or transaction flows, without any local review.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file states that mutating commands are used only when the user explicitly asks, but it also documents persistent state-changing operations like aomi model set, aomi chain set, aomi config set-backend, wallet mode changes, thread deletion, secret clearing, and other mutation-capable commands without consistently attaching the same explicit-user-approval guard. In an autonomous agent setting, this ambiguity can lead to unauthorized persistent reconfiguration, causing later requests to run against attacker-chosen models, chains, or backends and increasing the chance of transaction or credential misuse.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The troubleshooting guidance tells users to run npx @aomi-labs/client@latest, which fetches and executes the newest package version at runtime rather than a pinned, reviewed version. In an agent skill context, this increases supply-chain risk and reduces reproducibility: a compromised or breaking upstream release could be executed immediately on the user's machine.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This line again recommends npm install -g @aomi-labs/client@latest / npx @aomi-labs/client@latest, causing users to install or execute an unpinned package version. Because this is operational guidance for command execution, any malicious or compromised future release could be pulled into the user's environment without review.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The workflow instructs users to execute npx @aomi-labs/client@latest, which fetches and runs the newest package version at execution time. This creates a supply-chain risk: a compromised publisher account, malicious release, or dependency hijack could result in arbitrary code execution on the user's machine.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The instruction to install or run @aomi-labs/client@latest causes users to trust and execute whatever code is published most recently, without review or reproducibility. In a wallet/transaction workflow, this is especially dangerous because a malicious update could steal secrets, alter transaction details, or tamper with signing flows.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · templates/aomi-workflow.sh (reported line 18)May include surrounding context.
sh
# # Conventions: # - All functions return non-zero on failure. # - Functions never auto-sign without confirmation. # - Credential setup is NOT automated — `aomi wallet dev-key`, `aomi secret add`, # `--api-key`, `--private-key` must be run by the user, never by this script.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The script automatically falls back to executing npx @aomi-labs/client@latest when aomi is not installed. Using @latest at runtime introduces a supply-chain risk: a future compromised or malicious package release could be fetched and executed on the user's machine, which is especially sensitive here because the tool is used in a wallet and transaction-signing workflow.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This line assigns AOMI_CMD to npx @aomi-labs/client@latest, causing later functions to execute whatever package version npm resolves at that moment. In a transaction-management script, executing an unpinned remote package increases the chance of malicious code execution or unexpected behavior affecting wallet operations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.