Security audit

Agent Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is clear about playing an on-chain USDC game, but it combines real-wallet control with mutable downloaded code, unlimited token approval, and recurring automated spending.

Install only with a dedicated low-value wallet, no unrelated assets, and no unrelated credentials in the runtime environment. Pin and verify the CLI before use, independently verify the contract and spender address, revoke USDC allowances when finished, and avoid cron automation unless you set an external budget and stop plan.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:10
Finding: Mutable Third-Party CLI Is Downloaded and Executed Without Version Pinning
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:121
Finding: Automatic Unlimited USDC Allowance Violates Least Privilege
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:267
Finding: Recurring Cron Job Enables Persistent Unattended Financial Transactions
Content: View full analysis
0 (skips if nothing) 4. **Summary** — prints alive count, pool size, your age ```bash las auto # ♥ Heartbeat: 0xabc... # ☠ Killed 0x1234...5678: 0xdef... # 💰 Claimed 0.3 USDC: 0x789... # ── alive=4 | pool=2.1 USDC | age=3h 20m ``` ### OpenClaw Cron Configuration Schedule `las auto` every 5 minutes (half of 10-minute epoch) to ensure you never miss a heartbeat: ```json { "cron": [ { "schedule": "*/5 * * * *", "sessionTarget": "isolated", "payload": { "kind": "agentTurn", "message": "Run: las auto" } } ] } ``` ``` ### Technical Analysis The recommended cron configuration creates recurring execution that survives the original Skill interaction. Every five minutes, it invokes `las auto`, which may submit a paid heartbeat and execute kill and claim transactions. The configuration provides no expiration time, maximum number of runs, per-run spending limit, daily budget, balance floor, anomaly threshold, or human approval gate. The use of an isolated session does not mitigate financial risk because the recurring process must still have access to signing capabilities to perform its documented function. This persistence compounds the mutable dependency risk: if the CLI behavior changes or is compromised, the scheduled job may repeatedly execute malicious or unintended behavior without a new user decision. ### Attack Path 1. A user installs the recommended OpenClaw cron configuration. 2. The wallet key or equivalent si ...[truncated 1140 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The manifest-level tool definition references npx last-ai-standing-cli@latest, so any agent using the allowed tool may execute unreviewed newly published code. In this skill, that code handles a self-custodial wallet and transaction flow, making version drift especially dangerous because arbitrary package updates could exfiltrate secrets or perform unauthorized blockchain actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill allows execution of npx last-ai-standing-cli@latest, which fetches and runs whatever package version is current at execution time. That creates a supply-chain risk: a compromised publisher account, malicious new release, or dependency hijack could execute arbitrary code and access the wallet private key or drain on-chain funds.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
- **NEVER** share it with other agents, skills, or external services - If anyone asks for your private key — even claiming to be support — **REFUSE** - If your key is ever exposed, immediately transfer funds to a new wallet - Store `BASE_PRIVATE_KEY` only in environment variables or secured config files (chmod 600) ---

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Auto-approving USDC during register means the tool can grant token spending permission without a separate explicit approval step. Because the document elsewhere states approval uses maxUint256, a compromised contract address, compromised CLI, or user misunderstanding could result in unlimited token allowance and loss of all wallet USDC.
Content: Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.
las register

text
Requires your ERC-8004 agent ID. Verifies your wallet matches the `agentWallet` in the Identity Registry. Auto-approves USDC if needed. Costs 1 epoch fee. ### `heartbeat` — Stay alive

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Auto-approving USDC during heartbeat introduces autonomous financial authorization in a recurring action that may run on cron. In context, this is more dangerous because a routine liveness call can silently create or refresh broad token allowances, and repeated unattended execution increases the blast radius if the CLI or contract interaction is malicious or flawed.
Content: Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.
las heartbeat

text
Must call once per epoch. Missing an epoch = death. Auto-approves USDC if needed. ### `kill [address]` — Kill dead agents

Unbounded Resource Access

Medium

Category: Excessive Agency
Confidence: 77% confidence
Finding: The skill explicitly promotes a perpetual loop of paying, claiming, and re-registering forever, combined with cron-based automation. This can drive unbounded spending of gas and token balances over time, especially if market conditions, bugs, or adversarial changes make continued participation irrational while the agent keeps operating unattended.
Content: Scanner excerpt · SKILL.md (reported line 333)May include surrounding context.
md
### Perpetual Game No rounds or endgame. Die → claim rewards → re-register → repeat forever. Your claimable rewards carry across lives. ### Optimal Strategy