Potato Tipper

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:43 AM UTC
• Version: 1.0.2

Overview

The skill is for a real on-chain tipping setup, but it asks users to run high-impact wallet transactions with raw private keys and an unpinned remote repository.

Review this skill carefully before installing or running it. Use only a dedicated low-value controller key, prefer testnet first, verify the PotatoTipper and token addresses, pin and inspect any cloned repository before running Foundry, avoid putting production private keys in shell commands, and make sure you know how to revoke both delegate settings and token operator authorization.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup_potato_tipper.sh:4
• Finding: Unpinned Remote Repository Is Used as the Foundry Execution Environment## Vulnerability Details **File Location**: `scripts/setup_potato_tipper.sh:4-11, 68-81` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash REPO_URL="https://github.com/CJ42/potato-tipper-contracts.git" REPO_DIR="${POTATO_TIPPER_REPO_DIR:-$(mktemp -d)/potato-tipper-contracts}" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" # Clone repo if not already present if [[ ! -d "$REPO_DIR/.git" ]]; then echo "Cloning Potato Tipper contracts into $REPO_DIR..." git clone "$REPO_URL" "$REPO_DIR" fi ``` The fetched repository is subsequently used as the working directory for a transaction-broadcasting Foundry invocation: ```bash cd "$REPO_DIR" export UP_ADDRESS export POTATO_TIPPER_ADDRESS export POTATO_TOKEN_ADDRESS forge script "$SCRIPT_DIR/SetupPotatoTipper.s.sol:SetupPotatoTipper" \ --rpc-url "$RPC_URL" \ --broadcast \ --private-key "$PRIVATE_KEY" ``` ### Technical Analysis The script clones a repository from an external GitHub account without pinning it to a reviewed commit or verifying its contents against an integrity hash. The effective execution environment can consequently change after this skill has been reviewed. Running Foundry from the cloned repository makes its project configuration, import mappings, source resolution, and installed libraries part of the trusted execution path. Although the requested script path is local, that script imports `forge-std` and compilation takes place in the remotely controlled project context. A compromised or maliciously modified repository may therefore affect the compilation inputs and Foundry behavior. The command combines this mutable environment with `--broadcast` and a controller private key. This turns a supply-chain compromise into a transaction-signing risk rather than merely a build-integrity issue. ### Attack Path 1. An attacker compromises the referenced GitHub repository, its maintainer account, or another mutable d ...[truncated 1333 chars]
• Remediation: ## Remediation Suggestions 1. Pin the upstream repository to a specific, reviewed commit hash rather than its mutable default branch. 2. Verify the checked-out commit and relevant file hashes before invoking Foundry; abort on any mismatch. 3. Prefer vendoring all required Solidity sources, Foundry configuration, remappings, and dependencies into the audited skill package. 4. Compile and simulate without a private key or `--broadcast`, then present the exact transaction targets, selectors, values, and calldata for user review. 5. Use a hardware wallet, keystore, or external signer that requires explicit confirmation rather than supplying a raw private key to the build process. 6. Run Foundry in a restricted environment with minimal filesystem, network, and environment-variable access. 7. Lock all transitive dependencies to immutable revisions and document a controlled process for updating and re-auditing them.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup_potato_tipper.sh:78
• Finding: Controller Private Key Is Exposed Through Process Arguments## Vulnerability Details **File Location**: `scripts/setup_potato_tipper.sh:78-81` **Vulnerability Type**: Plaintext secret exposure through command-line arguments **Risk Level**: High ### Vulnerable Code ```bash forge script "$SCRIPT_DIR/SetupPotatoTipper.s.sol:SetupPotatoTipper" \ --rpc-url "$RPC_URL" \ --broadcast \ --private-key "$PRIVATE_KEY" ``` ### Technical Analysis The script expands the user's raw controller private key into the command-line arguments of the `forge` process. Command-line arguments may be exposed through process inspection interfaces, monitoring agents, diagnostic collection, command logging, crash reports, or other local telemetry. The script originally receives the secret through the `PRIVATE_KEY` environment variable and then unnecessarily duplicates it into the process argument vector. This increases the number of places where the key may be observed and retained. The key controls an account that the workflow expects to have permission to alter Universal Profile delegate settings and make token-related calls. ### Attack Path 1. The user exports `PRIVATE_KEY` and invokes the setup wrapper. 2. The shell expands `$PRIVATE_KEY` into the `forge` process argument list. 3. A local process observer, monitoring tool, debugging utility, or telemetry collector records the process arguments while Forge is running. 4. An attacker obtains the recorded private key. 5. The attacker imports the key into a wallet or signing tool. 6. The attacker signs transactions using every permission granted to that controller until the key is revoked or the controller is removed. This path requires local process-observation capability or access to logs or telemetry that capture command arguments; it is not a remote exploit by itself. ### Impact Assessment Disclosure grants the attacker the ability to impersonate the controller account. The resulting scope depends on that controller's LSP6 permissions and other assets associated with the key. For ...[truncated 471 chars]
• Remediation: ## Remediation Suggestions 1. Remove `--private-key "$PRIVATE_KEY"` and avoid placing raw secrets in process arguments. 2. Prefer a hardware wallet, Foundry keystore, operating-system-backed secret store, or external signer that requires explicit transaction confirmation. 3. If environment-based signing is unavoidable, consume the key only in reviewed code and ensure it is never copied into argv, output, or generated files. 4. Use a dedicated least-privilege controller solely for this setup operation, then revoke or remove it after completion. 5. Disable shell tracing and ensure CI systems, process monitors, crash collectors, and audit logs redact wallet secrets. 6. Separate build and simulation from signing so the private key is unavailable while mutable build inputs are processed. 7. Rotate the controller key immediately if it may already have been exposed through process monitoring or retained logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## How It Works

When someone follows a Universal Profile that has Potato Tipper installed, the follow event triggers an LSP1 notification which automatically sends $POTATO tokens from the followed user's UP to the new follower's UP. Think of it as an on-chain "welcome gift" for new followers.

```
User B follows User A (LSP26)

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The quick-start instructs users to supply a raw PRIVATE_KEY directly on the command line for a setup script, but provides no warning about shell history, process inspection, logging, or use of isolated wallets. In a skill explicitly designed for AI agents to configure on-chain assets, this creates a real secret-handling risk that can lead to wallet compromise and loss of funds if the key is exposed.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrase 'anything technical around the Potato Tipper contracts repo' is overly broad and can cause the skill to activate for many loosely related requests. Because this skill includes instructions for private-key-based on-chain configuration and token operator authorization, unintended invocation materially increases the chance an agent will surface or follow high-impact transactional guidance without clear user intent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill presents a 'one-click' setup flow that sets Universal Profile data keys and authorizes an operator budget using a private key, but it does not foreground a strong warning that this grants spending authority and changes on-chain permissions/configuration. In the context of an agent skill, this is dangerous because it can normalize sensitive actions as routine setup, increasing the likelihood of a user or agent executing irreversible transactions without understanding the security consequences.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill describes three actions that change Universal Profile state, including setting delegates, writing settings, and authorizing PotatoTipper as an operator with a tipping budget, but it does not clearly warn that these are persistent on-chain permission and spending-authority changes. Users may execute the setup without appreciating that they are granting an operator the ability to spend tokens up to the approved budget or altering account behavior through delegate configuration.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation instructs users to pass a raw PRIVATE_KEY via an environment variable in a shell command without any safety guidance. This is dangerous because shell history, process inspection, CI logs, and shared terminal environments can expose the key, enabling full compromise of the controlling EOA and any assets or permissions tied to it.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This documentation recommends granting LSP6 permissions to let a tipping contract spend native LYX, including `SUPER_TRANSFERVALUE`, and only briefly notes that it 'can be dangerous' without clearly warning that this permission can enable unrestricted value transfers from the user's Universal Profile. In the context of a skill that helps agents set up on-chain tipping and explicitly requires a private key, under-emphasizing this risk can lead operators to overgrant permissions and expose user funds to theft or full-balance draining if the contract or configuration is flawed.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The markdown presents copy-pastable code that performs live state-changing wallet operations—setting Universal Profile data and authorizing a token operator—without explicit warnings about irreversible on-chain effects, token authority, or the need for informed approval. In the context of an agent skill intended to automate setup using sensitive credentials, omission of these warnings makes accidental or over-broad authorization significantly more likely.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The example does more than profile setup: it authorizes the PotatoTipper contract as an operator over the user's POTATO token balance, enabling future token transfers up to the approved amount. In a skill that explicitly says it requires a private key and helps agents perform setup, bundling this authority grant into example setup code materially increases the risk that an agent or user will grant spending power without fully understanding the consequences.

Description-Behavior Mismatch

Low

• Confidence: 79% confidence
• Finding: The ethers example labeled as connection/setup also writes concrete tipping settings to the Universal Profile, which exceeds a minimal 'connect' action and can silently alter on-chain behavior. While less severe than token operator approval, hidden default configuration in setup flows can cause unintended automated tipping behavior or misconfiguration by agents reusing the sample verbatim.

Static analysis

No suspicious patterns detected.