Security audit

Aavegotchi Gotchiverse

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Aavegotchi automation purpose, but it needs review because it handles a raw wallet private key and gives live blockchain transaction commands.

Install only if you are comfortable reviewing every transaction before broadcast. Prefer a dedicated low-value wallet, keystore, hardware wallet, or isolated signer instead of passing a production private key with --private-key, keep DRY_RUN as guidance rather than a real guard, and verify RPC, chain ID, contract addresses, parcel IDs, access-right settings, and costs before any live transaction.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: references/subgraph.md:14
Finding: Bearer Token Disclosure Through Unvalidated Subgraph Endpoints
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/realm-recipes.md:81
Finding: Raw Wallet Private Key Exposed in Process Command-Line Arguments
Content: View full analysis
" \ --private-key "$PRIVATE_KEY" \ --rpc-url "$BASE_MAINNET_RPC" ``` The same pattern is used for asset-affecting actions such as crafting, claiming, channeling, equipping, upgrading, reducing queue time, and changing parcel access rights. ### Technical Analysis The shell expands `"$PRIVATE_KEY"` before starting `cast`. The raw wallet key therefore becomes an argument in the spawned process command line. Depending on operating-system process visibility, container isolation, audit policy, observability tooling, shell tracing, crash collection, or endpoint-monitoring configuration, command-line arguments may be readable or retained outside the intended process. The instruction not to print or log the key does not prevent operating-system or telemetry-level collection of the expanded argument. A blockchain private key is a complete signing credential. Unlike a limited API token, possession of the key permits an attacker to generate valid signatures independently of this Skill and bypass its dry-run, simulation, destination, and explicit-confirmation instructions. ### Attack Path 1. The user exports `PRIVATE_KEY` and initiates one of the documented `cast send` commands. 2. The shell expands the variable into the raw key and passes it in the process argument vector. 3. A local user, co-tenant, compromised process, process monitor, audit collector, or telemetry agent captures the command-line arguments while the command runs or from retained logs ...[truncated 987 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/addresses.md:47
Finding: Declared DRY_RUN Safety Control Does Not Prevent Transaction Broadcasts
Content: View full analysis
" \ --private-key "$PRIVATE_KEY" \ --rpc-url "$BASE_MAINNET_RPC" ``` ### Technical Analysis `SKILL.md` states that the Skill should default to `DRY_RUN=1` and never broadcast unless explicitly instructed. The implemented recipes, however, contain direct `cast send` commands with no conditional check or enforcing wrapper. As a result, `DRY_RUN=1` is informational only. It neither changes the command behavior nor blocks signing and submission. A user or Agent can reasonably infer that retaining the default provides an execution safeguard, while the displayed broadcast command remains fully live. Simulation examples reduce risk when followed manually, but they are not coupled to the broadcast operation. There is also no atomic enforcement that the simulated destination, arguments, sender, RPC endpoint, and chain are identical to those ultimately signed. ### Attack Path 1. The environment is initialized with the documented default `DRY_RUN=1`. 2. The user or Agent assumes that this setting prevents live submission. 3. A broadcast block is selected accidentally, generated from an unsafe workflow, or executed without a separate confirmation. 4. Because the command never evaluates `DRY_RUN`, `cast send` signs the transaction. 5. The configured RPC endpoint receives and broadcasts the transaction. 6. ...[truncated 871 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (24)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/subgraph.md (reported line 15)May include surrounding context.
Reachability Smoke Tests

bash
curl -s "$GOTCHIVERSE_SUBGRAPH_URL" -H 'content-type: application/json' ${GOLDSKY_API_KEY:+-H "Authorization: Bearer $GOLDSKY_API_KEY"} --data '{"query":"{ __schema { queryType { fields { name } } } }"}' \ | python3 -c 'import json,sys; f=[x["name"] for x in json.load(sys.stdin)["data"]["__schema"]["queryType"]["fields"]]; print([n for n in ("parcel","parcels","installationTypes","tileTypes","parcelAccessRights") if n in f])' curl -s "$CORE_SUBGRAPH_URL" -H 'content-type: application/json' ${GOLDSKY_API_KEY:+-H "Authorization: Bearer $GOLDSKY_API_KEY"} --data '{"query":"{ __schema { queryType { fields { name } } } }"}' \

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/subgraph.md (reported line 18)May include surrounding context.
curl -s "$GOTCHIVERSE_SUBGRAPH_URL" -H 'content-type: application/json' ${GOLDSKY_API_KEY:+-H "Authorization: Bearer $GOLDSKY_API_KEY"} --data '{"query":"{ __schema { queryType { fields { name } } } }"}'
| python3 -c 'import json,sys; f=[x["name"] for x in json.load(sys.stdin)["data"]["__schema"]["queryType"]["fields"]]; print([n for n in ("parcel","parcels","installationTypes","tileTypes","parcelAccessRights") if n in f])'

curl -s "$CORE_SUBGRAPH_URL" -H 'content-type: application/json' ${GOLDSKY_API_KEY:+-H "Authorization: Bearer $GOLDSKY_API_KEY"} --data '{"query":"{ __schema { queryType { fields { name } } } }"}'
| python3 -c 'import json,sys; f=[x["name"] for x in json.load(sys.stdin)["data"]["__schema"]["queryType"]["fields"]]; print([n for n in ("aavegotchi","erc721Listings","erc1155Listings") if n in f])'

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documented cast send command signs and broadcasts a live transaction using a raw private key, but the surrounding guidance does not explicitly warn that this changes parcel permissions onchain and may be costly or difficult to reverse. In an agent skill context, this increases the chance of accidental execution, especially if an automation system moves from simulation to broadcast without strong user confirmation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This broadcast example performs live whitelist-based access-right updates with cast send, again using a private key and without a prominent warning about modifying authorization settings onchain. Because access-control changes can unintentionally open parcel actions to others or lock intended operators out, accidental execution can have meaningful operational consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file provides broadcast examples that submit live, state-changing transactions to a blockchain using a private key, but it does not explicitly warn that these actions are irreversible and can consume assets or alter game state. In an agent skill that automates crafting and upgrades, omission of a clear safety warning increases the chance of unintended on-chain execution by users or downstream automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The recipe instructs users to pass a raw private key via --private-key on the command line without any warning, which can expose the secret through shell history, process listings, logs, agent traces, or telemetry. In an automation-focused skill, this is especially dangerous because users may paste production keys into scripted workflows, enabling wallet compromise and unauthorized transactions if the key is captured.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The reference repeatedly instructs use of $PRIVATE_KEY for transaction signing without any safety guidance on secret handling. In agent or CLI workflows, this can normalize unsafe practices such as exporting raw keys into shell history, logs, process tables, or shared environments, leading to wallet compromise and loss of on-chain assets.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says the skill supports 'parcel access-right management', which implies both inspection and execution of access-right changes, but this file only documents read/preflight operations (getParcelsAccessRights, whitelist ID lookup, and verifyAccessRight). In contrast, the rest of the file includes explicit broadcast recipes for state-changing workflows, so the absence of any access-right modification operation indicates the documented behavior is narrower than the claimed capability.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document provides cast send examples for live state-changing transactions signed with a private key, but it does not clearly warn that these actions are irreversible and can spend gas or mutate on-chain assets. In a wallet-operating skill for game assets on mainnet, that omission increases the chance of accidental broadcasts, especially if a user confuses simulation and broadcast steps.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest claims the skill operates crafting of installations/tiles, building on parcels, installation upgrades, and craft/upgrade queue management. This reference file documents building operations and some harvesting/channeling flows, but it contains no recipes for crafting, upgrading installations, or managing craft/upgrade queues, creating a mismatch between the claimed workflow coverage and the actual documented operations here.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/addresses.md (reported line 21)May include surrounding context.
md
# Subgraph Queries (Base) Endpoints: - `GOTCHIVERSE_SUBGRAPH_URL=https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/gotchiverse-base/prod/gn` - `CORE_SUBGRAPH_URL=https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/aavegotchi-core-base/prod/gn` Notes:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/addresses.md (reported line 22)May include surrounding context.
md
# Subgraph Queries (Base) Endpoints: - `GOTCHIVERSE_SUBGRAPH_URL=https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/gotchiverse-base/prod/gn` - `CORE_SUBGRAPH_URL=https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/aavegotchi-core-base/prod/gn` Notes:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/addresses.md (reported line 43)May include surrounding context.
md
# Subgraph Queries (Base) Endpoints: - `GOTCHIVERSE_SUBGRAPH_URL=https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/gotchiverse-base/prod/gn` - `CORE_SUBGRAPH_URL=https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/aavegotchi-core-base/prod/gn` Notes:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/addresses.md (reported line 44)May include surrounding context.
md
# Subgraph Queries (Base) Endpoints: - `GOTCHIVERSE_SUBGRAPH_URL=https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/gotchiverse-base/prod/gn` - `CORE_SUBGRAPH_URL=https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/aavegotchi-core-base/prod/gn` Notes:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/subgraph.md (reported line 4)May include surrounding context.
md
# Subgraph Queries (Base) Endpoints: - `GOTCHIVERSE_SUBGRAPH_URL=https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/gotchiverse-base/prod/gn` - `CORE_SUBGRAPH_URL=https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/aavegotchi-core-base/prod/gn` Notes:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/subgraph.md (reported line 5)May include surrounding context.
md
# Subgraph Queries (Base) Endpoints: - `GOTCHIVERSE_SUBGRAPH_URL=https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/gotchiverse-base/prod/gn` - `CORE_SUBGRAPH_URL=https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/aavegotchi-core-base/prod/gn` Notes:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/access-rights.md (reported line 38)May include surrounding context.
Reachability Smoke Tests

bash
curl -s "$GOTCHIVERSE_SUBGRAPH_URL" -H 'content-type: application/json' ${GOLDSKY_API_KEY:+-H "Authorization: Bearer $GOLDSKY_API_KEY"} --data '{"query":"{ __schema { queryType { fields { name } } } }"}' \ | python3 -c 'import json,sys; f=[x["name"] for x in json.load(sys.stdin)["data"]["__schema"]["queryType"]["fields"]]; print([n for n in ("parcel","parcels","installationTypes","tileTypes","parcelAccessRights") if n in f])' curl -s "$CORE_SUBGRAPH_URL" -H 'content-type: application/json' ${GOLDSKY_API_KEY:+-H "Authorization: Bearer $GOLDSKY_API_KEY"} --data '{"query":"{ __schema { queryType { fields { name } } } }"}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/subgraph.md (reported line 15)May include surrounding context.
Reachability Smoke Tests

bash
curl -s "$GOTCHIVERSE_SUBGRAPH_URL" -H 'content-type: application/json' ${GOLDSKY_API_KEY:+-H "Authorization: Bearer $GOLDSKY_API_KEY"} --data '{"query":"{ __schema { queryType { fields { name } } } }"}' \ | python3 -c 'import json,sys; f=[x["name"] for x in json.load(sys.stdin)["data"]["__schema"]["queryType"]["fields"]]; print([n for n in ("parcel","parcels","installationTypes","tileTypes","parcelAccessRights") if n in f])' curl -s "$CORE_SUBGRAPH_URL" -H 'content-type: application/json' ${GOLDSKY_API_KEY:+-H "Authorization: Bearer $GOLDSKY_API_KEY"} --data '{"query":"{ __schema { queryType { fields { name } } } }"}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/subgraph.md (reported line 18)May include surrounding context.
curl -s "$GOTCHIVERSE_SUBGRAPH_URL" -H 'content-type: application/json' ${GOLDSKY_API_KEY:+-H "Authorization: Bearer $GOLDSKY_API_KEY"} --data '{"query":"{ __schema { queryType { fields { name } } } }"}'
| python3 -c 'import json,sys; f=[x["name"] for x in json.load(sys.stdin)["data"]["__schema"]["queryType"]["fields"]]; print([n for n in ("parcel","parcels","installationTypes","tileTypes","parcelAccessRights") if n in f])'

curl -s "$CORE_SUBGRAPH_URL" -H 'content-type: application/json' ${GOLDSKY_API_KEY:+-H "Authorization: Bearer $GOLDSKY_API_KEY"} --data '{"query":"{ __schema { queryType { fields { name } } } }"}'
| python3 -c 'import json,sys; f=[x["name"] for x in json.load(sys.stdin)["data"]["__schema"]["queryType"]["fields"]]; print([n for n in ("aavegotchi","erc721Listings","erc1155Listings") if n in f])'

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/subgraph.md (reported line 25)May include surrounding context.
Parcel by ID

bash
curl -s "$GOTCHIVERSE_SUBGRAPH_URL" -H 'content-type: application/json' ${GOLDSKY_API_KEY:+-H "Authorization: Bearer $GOLDSKY_API_KEY"} --data '{ "query":"query($id:ID!){ parcel(id:$id){ id tokenId parcelId owner coordinateX coordinateY district size surveyRound lastChanneledAlchemica lastClaimedAlchemica remainingAlchemica totalAlchemicaClaimed equippedInstallationsBalance equippedTilesBalance equippedInstallations{ id installationType name level alchemicaType capacity harvestRate craftTime prerequisites alchemicaCost } equippedTiles{ id tileType name width height craftTime alchemicaCost } } }", "variables":{"id":"59"} }'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The command uses cast send with a supplied private key, which will submit a live transaction to craft tiles onchain, consuming gas and potentially spending in-game resources irreversibly. Because the file is an operational runbook for real Base mainnet interactions, omission of an explicit warning increases the chance that a user copies the command believing it is only a verification step.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This batch craft example broadcasts a state-changing transaction using --private-key, which can consume gas and commit multiple crafting actions at once. In the context of a blockchain gameplay skill, batching amplifies the risk of unintended asset consumption because a mistaken command can affect several tile crafts in one irreversible submission.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The claimTiles broadcast command submits a real transaction with the user's private key, incurring gas and changing onchain queue state. Even though claiming is typically less destructive than crafting, it remains irreversible operationally and can surprise users who mistake the example for a read-only command.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: reduceCraftTime is a live state-changing transaction that can spend GLTR and gas irreversibly, yet the example lacks any warning of that effect. In this skill's context, reducing craft time directly consumes game resources, so a copied command with wrong queue IDs or block amounts can cause immediate, unrecoverable loss of value.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

External Script Fetching

Reachability Smoke Tests

External Script Fetching

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Description-Behavior Mismatch

Missing User Warnings

Description-Behavior Mismatch

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Reachability Smoke Tests

External Transmission

Reachability Smoke Tests

External Transmission

External Transmission

Parcel by ID

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Static analysis