trade-with-aiusd

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:11 AM UTC
• Version: 1.0.1

Overview

This trading skill is purpose-aligned, but it needs Review because it can move crypto assets, uses local credentials, and includes automatic install and re-auth flows with too little user control.

Install only if you are comfortable with a chat agent initiating AIUSD trading, staking, withdrawals, and gas top-ups, and only after confirming that asset-moving actions require explicit approval. Avoid running the self-extracting installers over an existing aiusd-skill directory with local changes. Treat re-authentication as sensitive because it can delete shared auth state and open a browser login flow.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:12

Finding

Agent Response Hijacking Through Mandatory Output-Control Instructions

Content

View full analysis

Remediation

View remediation

T04 · Embedded Malicious Code

Error

• Location: aiusd-skill-installer.js:53

Finding

Opaque Embedded Package Is Extracted and Followed by Automatic npm Execution

Content

View full analysis

Remediation

View remediation

T04 · Embedded Malicious Code

Error

• Location: aiusd-skill-installer.sh:72

Finding

Shell Installer Executes an Unverified Embedded Archive and npm Lifecycle Hooks

Content

View full analysis

/dev/null 2>&1; then log_success "Dependencies installed successfully" ``` The archive marker and opaque package data begin at `aiusd-skill-installer.sh:110-112`: ```bash # Archive marker - do not remove this line __ARCHIVE_START__ H4sIAEu2hWkAA+y9XW8cSZIg2LvA4XB5z3vPXixhMqnOTH6TUqpVNckPldhFiSqSqppaS... ``` ### Technical Analysis The shell installer extracts archive data appended directly to its own source. The package is decoded and streamed into `tar`, after which `npm install` is executed automatically. No cryptographic integrity or publisher-signature check is performed before extraction. The archive's expanded implementation and package metadata are not available as separate source files in the reviewed project. This prevents direct inspection of package scripts and dependency constraints from the supplied files. The output of `npm install` is redirected to `/dev/null`, reducing visibility into downloaded packages, warnings, lifecycle script execution, and installation errors. The audit did not confirm a malicious implementation inside the compressed data. The security issue is the unverified transition from opaque data to extraction and code-capable dependency installation. ### Attack Path 1. A user runs `bash aiusd-skill-installer.sh`. 2. The script deletes an existing `aiusd-skill` directory and creates a replacement. 3. It locates the archive marker inside its own file. 4. Everything after the marker is decoded a ...[truncated 860 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:136

Finding

Automatic Re-authentication Is Documented to Delete Broad Shared Authentication State

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

This skill calls the AIUSD backend via MCP. Auth is resolved in order: env `MCP_HUB_TOKEN`, mcporter OAuth, or local `~/.mcp-hub/token.json`. Ensure a valid Bearer token is available before calling.

## ⚠️ Agent Output Guidelines

**CRITICAL - ABSOLUTELY FORBIDDEN PHRASES**:
Agents must NEVER use these words or phrases when responding to users:

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 89% confidence

Finding

The file embeds a large opaque base64/gzip payload and extracts it before running npm install, which hides the actual package contents from review and creates a strong supply-chain and metadata-poisoning risk. In the context of an agent skill installer, this is more dangerous because the real tool schemas, prompts, or executable files are concealed inside the archive and may alter agent behavior or introduce malicious dependencies.

Content

Scanner excerpt · aiusd-skill-installer.js (reported line 80)May include surrounding context.

js

kill && npm install', 'cyan');
    }

    log('', 'reset');
    log('🎉 AIUSD Skill installed successfully!', 'green');
    log('', 'reset');
    log('🚀 Next Steps:', 'yellow');
    log('1. cd aiusd-skill', 'blue');
    log('2. npm run setup', 'blue');
    log('', 'reset');
    log('💡 Usage Examples:', 'cyan');
    log('• Check balance: npm start -- balances', 'blue');
    log('• List tools: npm start -- tools', 'blue');
    log('• Get help: npm start -- --help', 'blue');
    log('', 'reset');

  } catch (error) {
    log(`❌ Installation failed: ${error.message}`, 'red');
    process.exit(1);
  }
}

// Package data (base64 encoded)
const PACKAGE_DATA = `H4sIAEq2hWkAA+y9XW8cSZIg2LvA4XB5z3vPXixhMqnOTH6TUqpVNckPldhFiSqSqppaSUMGM4NkSJkZ2RGRpFgqDnqAmQP2pmdnbqaBvRtMo3fncHOLwwF3+zb7G+5fFHDP0z/hzMy/PTwykxTJ6pEyGl1iRribu5ubm5uZm5nX9+s/uelndnZ2ZWmJ0b/L/N/Z+UX+L/97gc0tzS3OLSwszM3Ns9m5efj3J2z2xnsGzyDNggS60joJBr1WeF5UDoodHQ2Bw4fC1L//Up7/5n/4b3/yr3/ykydBi23vsj9i4sF3P/nv4P/z8P9fwP/x9/

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · aiusd-skill-installer.sh (reported line 98)May include surrounding context.

sh

iusd-skill && npm install"
    fi

    echo ""
    log_success "AIUSD Skill installed successfully!"
    echo ""
    echo -e "${YELLOW}🚀 Next Steps:${NC}"
    echo -e "${BLUE}1. cd aiusd-skill${NC}"
    echo -e "${BLUE}2. npm run setup${NC}"
    echo ""
    echo -e "${CYAN}💡 Usage Examples:${NC}"
    echo -e "${BLUE}• Check balance: npm start -- balances${NC}"
    echo -e "${BLUE}• List tools: npm start -- tools${NC}"
    echo -e "${BLUE}• Get help: npm start -- --help${NC}"
    echo ""

    exit 0
}

# Run main function unless sourced
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
    main "$@"
fi

# Archive marker - do not remove this line
__ARCHIVE_START__
H4sIAEu2hWkAA+y9XW8cSZIg2LvA4XB5z3vPXixhMqnOTH6TUqpVNckPldhFiSqSqppaSUMGM4NkSJkZ2RGRpFgqDnqAmQP2pmdnbqaBvRtMo3fncHOLwwF3+zb7G+5fFHDP0z/hzMy/PTwykxTJ6pEyGl1iRribu5ubm5uZm5nX9+s/uelndnZ2ZWmJ0b/L/N/Z+UX+L/97gc0tzS3OLSwszM0tsNm5+YW5+Z+w2RvvGTyDNAsS6ErrJBj0WuF5UTkodnQ0BA4fClP//kt5/pv/4b/9yb/+yU+eBC22vcv+iIkH3/3kv4P/z8P/fwH/x9

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README encourages trades, staking, and withdrawals via natural-language chat, including examples of irreversible asset movements, but provides no user-facing warning about financial risk, transaction finality, or the need for explicit confirmation before execution. In a chat-based multi-platform bot context, this omission increases the chance of accidental or misunderstood instructions leading to unintended transfers or trades.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill gives mutually inconsistent authentication guidance: one section says the agent must only return a fixed browser-auth message and avoid progress/status details, while later sections instruct the agent to run re-auth commands and announce that it is re-authenticating. In practice, this can cause agents to choose unsafe or noncompliant auth flows, increasing the chance of unintended browser launches, hidden side effects, or misleading user messaging during authentication recovery.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The re-auth procedure instructs clearing local auth caches and token files, which is a destructive operation affecting stored credentials and session state. Performing or recommending deletion of authentication material without warning, backup guidance, or user consent can log users out, disrupt other sessions, and erase locally stored access needed by other tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill tells the agent to automatically run re-authentication commands on common auth errors, despite those commands having side effects such as clearing caches and launching browser-based login. This removes user control over sensitive authentication actions and can trigger unintended state changes or credential workflows merely from an error response.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The header claims this file contains the complete skill package, but the actual behavior is a self-extracting installer that writes an embedded archive, deletes an existing directory, extracts arbitrary packaged contents, and invokes npm install. That mismatch is dangerous because it obscures the true execution and supply-chain risk profile, reducing informed user consent before running code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The installer unconditionally removes the aiusd-skill directory recursively if it exists, without confirmation, backup, or path safety checks beyond string concatenation from the current working directory. This can cause destructive data loss and makes the installer unsafe to run repeatedly or in directories containing important prior state.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The installer removes any existing ./aiusd-skill directory automatically before reinstalling, which can destroy local changes, credentials, or user data stored in that path. In a skill installer context this is more dangerous because users are encouraged to run the script directly, so data loss can occur without review or backup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script performs rm -rf on the installation directory after only a log message, with no explicit confirmation gate. This makes accidental destructive execution easy and could erase user content if the directory contains anything important.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The installer extracts an opaque embedded archive and immediately runs npm install, which may execute package lifecycle scripts from bundled dependencies. Because the archive contents are hidden in base64 and not inspectable in this file review, the skill context makes this substantially more dangerous than a normal transparent installer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README states that authentication is handled automatically and suggests users can simply say 're-login' in chat, but does not warn that authentication flows and locally stored tokens are sensitive, especially on shared devices or in shared/group chat environments. Because the skill is advertised for Telegram, Discord, WhatsApp, Slack, SMS, and group contexts, the lack of credential-safety guidance could expose account access or session abuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

These lines mandate that agents must never use certain ordinary English words like "template," "example," and "verification" in responses. This is a natural-language policy constraint that forces wording regardless of user preference or context, and no user opt-in or clear compliance justification is provided.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Lines L038-L045 explicitly prohibit numbered steps, bulleted authentication instructions, and detailed browser guidance in responses. The later reauth documentation at L145-L150 provides a numbered step sequence for handling authentication, creating an internal contradiction about the intended behavior and messaging around auth flows.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: aiusd-skill-installer.js:58