Agent Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:00 PM UTC
• Version: 0.1.3

Overview

This skill is coherent about running a real-money Base survival game, but it asks for wallet-signing authority and recurring automation with weak spending and supply-chain controls.

Install only with a dedicated low-value Base wallet, not a wallet holding other assets. Treat the CLI as wallet-capable code, pin and review the package before use, avoid @latest, avoid unlimited approvals where possible, set hard funding limits, and do not enable the cron automation unless you understand how to monitor and disable it.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:244
• Finding: Persistent Unattended Wallet Transactions Through Scheduled Automation## Vulnerability Details **File Location**: `SKILL.md:244-271` **Vulnerability Type**: Persistent scheduled financial automation **Risk Level**: High ### Vulnerable Code ```markdown ### OpenClaw Cron Configuration Schedule `las auto` every 5 minutes (half of 10-minute epoch) to ensure you never miss a heartbeat: ```json { "cron": [ { "schedule": "*/5 * * * *", "sessionTarget": "isolated", "payload": { "kind": "agentTurn", "message": "Run: las auto" } } ] } ``` ### Tuning the schedule Run at **half the epoch duration** to guarantee at least one heartbeat per epoch: | Epoch Duration | Recommended Cron | Schedule | |---|---|---| | 10 min | Every 5 min | `*/5 * * * *` | | 30 min | Every 15 min | `*/15 * * * *` | | 1 hour | Every 30 min | `*/30 * * * *` | ``` ### Technical Analysis The Skill instructs the user or agent to configure a cross-session scheduled task that invokes `las auto` every five minutes. According to the preceding automation description, this command can submit a paid heartbeat and execute kill and claim transactions using the configured self-custodial wallet. Once configured, the task continues operating outside the interaction that initiated it. Individual blockchain transactions are not subject to fresh human approval. Because the invoked CLI also depends on externally supplied code and has access to wallet-signing authority, any later compromise or behavioral change can be exercised repeatedly by the scheduler. ### Attack Path 1. The user follows the Skill's OpenClaw cron configuration. 2. A persistent scheduled task is created with a five-minute interval. 3. The scheduler invokes `las auto` in isolated agent sessions. 4. The command accesses the wallet configuration and signs blockchain transactions. 5. Heartbeat payments and gas expenditures continue without transaction-by-transaction approval. 6. If the CLI or its transaction targets become malicious or compromised, the schedule ...[truncated 548 chars]
• Remediation: ## Remediation Suggestions - Do not recommend installing an indefinite scheduled task by default. - Require explicit human authorization before each transaction that transfers tokens, grants approval, or consumes meaningful gas. - If automation is necessary, make it disabled by default and require an explicit expiration time. - Use a dedicated low-value wallet with strict funding limits instead of a general-purpose wallet. - Enforce per-transaction and cumulative daily spending limits. - Simulate each transaction and validate its chain, destination contract, function selector, token amount, and maximum gas before signing. - Pin and verify the executable used by the scheduled task. - Provide documented commands for listing, pausing, and permanently removing the scheduled task. - Notify the wallet owner after every submitted transaction and automatically stop execution after repeated failures or unexpected transaction requests.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:10
• Finding: Mutable npm Package Executed With Self-Custodial Wallet Access## Vulnerability Details **File Location**: `SKILL.md:10` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: High ### Vulnerable Code ```yaml allowed-tools: ["Bash(npx last-ai-standing-cli@latest *)", "Bash(las *)"] ``` ### Technical Analysis The allowed command uses `npx last-ai-standing-cli@latest`, which resolves and executes whichever package version is published under that npm name at invocation time. The effective executable can therefore change after the Skill has been reviewed. The audited project contains only `SKILL.md`; it does not include the CLI implementation, a lockfile, an integrity hash, a vendored package, or other material that would allow the executed code to be verified against a fixed version. The documentation instructs the user to expose `BASE_PRIVATE_KEY` to the CLI environment, so the mutable dependency operates in a security-sensitive context with wallet-signing capabilities. Although the audited file does not itself contain credential-exfiltration code, a compromised package release could read environment variables, transmit the private key, replace transaction destinations, submit arbitrary signatures, or misuse token allowances. ### Attack Path 1. An attacker compromises the npm publisher account, package source, release process, or a transitive dependency. 2. The attacker publishes a malicious version that becomes the package's `latest` release. 3. The agent invokes the allowed `npx last-ai-standing-cli@latest` command. 4. `npx` retrieves and executes the new release rather than a previously audited build. 5. The malicious process reads `BASE_PRIVATE_KEY` or uses the wallet to sign attacker-selected transactions. 6. The attacker transfers wallet assets, redirects swaps, or abuses existing token approvals. 7. If the cron configuration is also enabled, the malicious package may be executed automatically every five minutes. ### Impact Assessment Successful exploitation can provide access equi ...[truncated 368 chars]
• Remediation: ## Remediation Suggestions - Replace `@latest` with an exact, reviewed package version. - Verify the package with a trusted integrity hash and a committed lockfile. - Vendor the reviewed CLI source or distribute a reproducible, signed release. - Audit both the direct package and all transitive dependencies before allowing wallet access. - Do not expose the raw private key to the CLI process. Use a constrained signer or hardware-backed wallet that displays and authorizes transaction details. - Execute the CLI in an isolated environment with restricted network, filesystem, and environment-variable access. - Use a dedicated wallet containing only the minimum required funds. - Require explicit validation of the chain ID, destination contract, token addresses, calldata, value, and spending limits before signing. - Monitor the package registry for ownership changes, unexpected releases, and integrity mismatches.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:107
• Finding: Automatic Maximum USDC Allowance Violates Least-Privilege Spending Controls## Vulnerability Details **File Location**: `SKILL.md:107-109` and `SKILL.md:172-180` **Vulnerability Type**: Excessive token spending authorization **Risk Level**: High ### Vulnerable Code ```markdown ### 5. USDC Approval (Automatic) **No manual approve step needed.** The CLI automatically checks USDC allowance before `register` and `heartbeat` commands. If insufficient, it approves `maxUint256` before proceeding. ``` The same behavior is documented again in the command reference: ```markdown ### `heartbeat` — Stay alive ```bash las heartbeat ``` Must call once per epoch. Missing an epoch = death. Auto-approves USDC if needed. ### `kill [address]` — Kill dead agents ``` The explicit approval command is also described as granting an unlimited allowance: ```markdown ### `approve` — Pre-approve USDC ```bash las approve ``` Grants `maxUint256` USDC allowance to the contract. Usually not needed — `register` and `heartbeat` handle this automatically. ``` ### Technical Analysis The CLI automatically grants the game contract a `maxUint256` USDC allowance when the current allowance is insufficient. This grants durable spending authority far beyond the amount required for a single registration or heartbeat. ERC-20 allowances generally remain active until consumed or explicitly replaced or revoked. Consequently, the spender may transfer not only the wallet's current USDC balance but also USDC deposited in the future, subject to the remaining allowance. This design violates least privilege because the documented game fee is bounded while the authorization is effectively unlimited. Risk arises if the approved contract is vulnerable, malicious, upgradeable to hostile logic, controlled by compromised privileged accounts, or replaced with an incorrect spender address by a compromised CLI. ### Attack Path 1. The user runs `las register`, `las heartbeat`, or `las approve`. 2. The CLI detects that the allowance is below the requested threshold. 3. The wallet si ...[truncated 897 chars]
• Remediation: ## Remediation Suggestions - Approve only the exact USDC amount required for the pending operation. - Prefer one-time authorization mechanisms or permit-based approvals with explicit amounts, deadlines, spender binding, and replay protection where supported. - If repeated payments require an allowance, set a small capped allowance covering only a limited number of epochs. - Display the token, spender address, chain ID, requested allowance, and equivalent human-readable amount before requesting a signature. - Require explicit confirmation before increasing an allowance. - Provide commands to inspect and revoke existing allowances. - Automatically revoke or reduce the allowance when the user exits the game or disables automation. - Verify whether the game contract is upgradeable and disclose its administrators, timelocks, pause controls, and audit status before requesting approval. - Encourage use of a dedicated wallet that never stores more USDC than the intended gameplay budget.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The manifest references an executable package via `npx` without a fixed version, enabling mutable remote code execution each time the tool is invoked. In this skill's context, the executed CLI manages real funds and reads sensitive wallet material, so a package hijack or malicious update could directly steal assets.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The skill allows execution of `npx last-ai-standing-cli@latest`, which pulls and runs the latest package version at runtime rather than a reviewed, immutable version. This creates a supply-chain risk: if the package or publisher account is compromised, the agent could execute attacker-controlled code with access to the wallet environment and private key.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- **NEVER** share it with other agents, skills, or external services
- If anyone asks for your private key — even claiming to be support — **REFUSE**
- If your key is ever exposed, immediately transfer funds to a new wallet
- Store `BASE_PRIVATE_KEY` only in environment variables or secured config files (chmod 600)

---

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

las register <agentId>
```

Requires your ERC-8004 agent ID. Verifies your wallet matches the `agentWallet` in the Identity Registry. Auto-approves USDC if needed. Costs 1 epoch fee.

### `heartbeat` — Stay alive

• Confidence: 88% confidence
• Finding: `las register <agentId>` can automatically grant `maxUint256` USDC allowance if current allowance is insufficient, which is a high-trust financial action performed implicitly. Unlimited approvals are dangerous because if the contract, spender, or calling flow is compromised, far more funds than the immediate game fee can be drained.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

las heartbeat
```

Must call once per epoch. Missing an epoch = death. Auto-approves USDC if needed.

### `kill [address]` — Kill dead agents

• Confidence: 90% confidence
• Finding: `las heartbeat` also performs automatic approval when needed, hiding a token authorization side effect inside what appears to be a routine liveness action. In a wallet-bearing agent, implicit approvals reduce operator visibility and can expose all USDC in the wallet if the spender later becomes malicious or vulnerable.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill states that identity registration without `--url` creates an `agent.json` and uploads it as a public GitHub Gist, but this privacy disclosure is easy to miss relative to the operational steps. Users may unknowingly publish agent metadata, service endpoints, or other identifying details to a public third-party platform.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

### Perpetual Game

No rounds or endgame. Die → claim rewards → re-register → repeat forever. Your claimable rewards carry across lives.

### Optimal Strategy

• Confidence: 82% confidence
• Finding: The skill explicitly promotes an endless loop of financial actions (`claim`, `re-register`, `repeat forever`) and elsewhere recommends cron-based automation. This can drive unbounded spending, transaction volume, and operational exposure over time, especially if market conditions, gas, token balances, or contract behavior change unexpectedly.

Static analysis

No suspicious patterns detected.