Gougoubi Claim All Rewards

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:23 AM UTC
• Version: 1.0.2

Overview

This skill is for real crypto reward claiming, but it relies on unbundled local scripts and does not clearly bound or warn about transaction effects.

Install only if you already trust the separate Gougoubi project scripts you will run. Before any non-dry-run claim, inspect the actual script source, verify it comes from the intended repository or release, confirm the network, contract addresses, signer, gas, recipients, and calldata, and use a least-privilege wallet or environment with no unrelated secrets exposed.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:77

Finding

Unbundled Relative Script Entry Points Can Execute Attacker-Controlled Code

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md, lines 77-91
• README.md, lines 23-31
• INSTALL.md, lines 24-30

Vulnerability Type: T07: Tool Hijacking and Spoofing
Risk Level: High

Vulnerable Code

SKILL.md, lines 77-91:

markdown

## Project Scripts

- `scripts/pbft-claim-rewards-profile-method.mjs`
- `scripts/pbft-claim-rewards-quick.mjs`
- `scripts/pbft-claim-three-address-rewards.mjs`

## Script Entry Points

- Preferred profile path: `scripts/pbft-claim-rewards-profile-method.mjs`
- Fast one-click path: `scripts/pbft-claim-rewards-quick.mjs`
- Deep scan path: `scripts/pbft-claim-three-address-rewards.mjs`
- `node scripts/pbft-claim-rewards-profile-method.mjs --help`
- `node scripts/pbft-claim-rewards-profile-method.mjs --dry-run`
- `node scripts/pbft-claim-rewards-quick.mjs --dry-run`
- `node scripts/pbft-claim-three-address-rewards.mjs --dry-run`

README.md, lines 23-31:

markdown

Script entry:

- `scripts/pbft-claim-rewards-profile-method.mjs`
- `scripts/pbft-claim-rewards-quick.mjs`
- `node scripts/pbft-claim-rewards-profile-method.mjs --help`
- `node scripts/pbft-claim-rewards-profile-method.mjs --dry-run`
- `node scripts/pbft-claim-rewards-quick.mjs --dry-run`

INSTALL.md, lines 24-30:

markdown

If the local project scripts are available, verify the public entrypoints first:

```bash
node scripts/pbft-claim-rewards-profile-method.mjs --help
node scripts/pbft-claim-rewards-profile-method.mjs --dry-run
node scripts/pbft-claim-rewards-quick.mjs --dry-run

text

### Technical Analysis

The audited package contains only documentation and metadata files; it does not contain the referenced `scripts/` directory or any of the advertised JavaScript entry points. Nevertheless, the Skill repeatedly directs the agent or operator to execute those scripts using paths relative to the current working directory.

Relative path resoluti
...[truncated 2577 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle every required JavaScript entry point inside the published Skill package so its implementation can be audited together with the instructions.
2. Resolve executable paths from a trusted, immutable Skill installation directory rather than from the current working directory.
3. Before execution, verify that the resolved path remains within the expected Skill directory and is a regular file rather than a symbolic link.
4. Publish cryptographic checksums or signed release artifacts and verify script integrity before invocation.
5. Pin installation instructions to a trusted repository and immutable commit or release instead of relying on unspecified local project files.
6. Treat --help and --dry-run as potentially executable operations; run them only after source and integrity validation.
7. Document and validate the expected chain ID, RPC endpoint, contract addresses, claim function selectors, and transaction recipients.
8. Require explicit user review and approval of transaction destination, contract, value, calldata, network, gas parameters, and signer before broadcasting.
9. Run claim tooling with least privilege and avoid exposing unrelated credentials, wallet secrets, or unrestricted filesystem access.
10. Fail closed when the bundled and verified scripts are unavailable instead of searching the current project for similarly named files.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README promotes 'one-click' and bulk reward claiming across multiple addresses but does not clearly warn that running the scripts may submit real blockchain transactions, spend gas, and change on-chain state. In an agent or automation context, this omission increases the chance that a user or higher-level system invokes the skill assuming it is informational or low-risk, leading to unintended transactions and fees.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.