Security audit

gigaverse

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Gigaverse game automation skill, but it handles wallet keys, tokens, paid blockchain actions, and autonomous account changes in ways users should review carefully before installing.

Install only if you are comfortable giving the skill control of a dedicated, low-value Gigaverse wallet. Do not import a wallet with meaningful funds or NFTs. Prefer interactive mode, review every onchain purchase or mint, avoid the npx purchase path until dependencies are pinned, and treat ~/.secrets/gigaverse-private-key.txt and ~/.secrets/gigaverse-jwt.txt as high-value credentials.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:299
Finding: Explicit User Advertising Opt-Out Is Overridden
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup.sh:58
Finding: Wallet Private Keys Are Exposed Through Visible Input and Process Arguments
Content: View full analysis
/dev/null; then ADDRESS=$(cast wallet address "$PRIVATE_KEY" 2>/dev/null) else ADDRESS=$(node -e " const { privateKeyToAccount } = require('viem/accounts'); const account = privateKeyToAccount('$PRIVATE_KEY'); console.log(account.address); " 2>/dev/null || echo "") fi ``` The documented direct invocation also places the key in the shell command: ```bash $0 import "0x..." ``` From `scripts/auth.sh`: ```bash PRIVATE_KEY=$(cat "$KEY_FILE") SIGNATURE=$(node -e " const { privateKeyToAccount } = require('viem/accounts'); async function sign() { const account = privateKeyToAccount('$PRIVATE_KEY'); const signature = await account.signMessage({ message: '$MESS ...[truncated 2705 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/purchase-juice.ts:1
Finding: Unpinned and Undeclared Runtime Package Execution in Private-Key Purchase Flow
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (63)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation instructs storage of private keys and addresses in local secret files without declaring permissions or foregrounding that secret-management is a core function. For an agent skill, hidden or downplayed credential handling materially increases the chance of unsafe deployment or misuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation instructs storage of private keys and addresses in local secret files without declaring permissions or foregrounding that secret-management is a core function. For an agent skill, hidden or downplayed credential handling materially increases the chance of unsafe deployment or misuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation instructs storage of private keys and addresses in local secret files without declaring permissions or foregrounding that secret-management is a core function. For an agent skill, hidden or downplayed credential handling materially increases the chance of unsafe deployment or misuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documentation instructs storage of private keys and addresses in local secret files without declaring permissions or foregrounding that secret-management is a core function. For an agent skill, hidden or downplayed credential handling materially increases the chance of unsafe deployment or misuse.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The lockfile pins ws to version 8.18.3, and the finding cites known advisories for uninitialized memory disclosure and memory-exhaustion denial of service. Because this skill appears to use viem, which depends on ws for WebSocket connectivity, any runtime path that opens WebSocket connections to untrusted or attacker-influenced endpoints could expose the agent to data leakage or process instability.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · CONFIG.md (reported line 135)May include surrounding context.
Option 2: Manual Config

bash
mkdir -p ~/.config/gigaverse cat > ~/.config/gigaverse/config.json << 'EOF' {

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · HEARTBEAT.md (reported line 22)May include surrounding context.
Track State

Create or update your state file (e.g. memory/heartbeat-state.json):

json
{

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The heartbeat instructions extend the skill from gameplay help into periodic monitoring of player status and re-engagement nudges, including notifying the user when they have not played in 24+ hours. That broadens the operational scope into engagement tracking and behavioral prompting, which can create unwanted surveillance-like behavior and autonomous outreach beyond the user’s immediate request.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to read a JWT from a local secrets file in the user's home directory, expanding the skill's access to sensitive credentials. Any skill guidance that normalizes direct secret-file access increases the risk of credential exposure, misuse in downstream requests, or accidental leakage through logs and prompts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The JWT handling example uses a bearer token for authenticated API access without any warning about secret sensitivity, storage, logging, or scope minimization. This omission makes it more likely that implementers will copy the pattern unsafely and expose long-lived credentials during normal operation or debugging.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation authorizes autonomous level-up actions that change account/game state using authenticated requests, which goes beyond passive gameplay assistance. Allowing the agent to spend resources and alter character progression automatically increases the chance of unintended transactions or irreversible in-game decisions without contemporaneous user approval.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The autonomous level-up flow performs authenticated, state-changing game actions without a clear warning that the agent may spend resources and permanently change account progression. In context, this is risky because the action is not merely informational; it alters the user's assets and strategy choices automatically.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: This POST request sends an authenticated external command to level up a character, causing a remote state change tied to the user's account. Because it uses a bearer token and modifies game progression, it creates a direct channel for automated external actions that could be triggered without sufficient user oversight.
Content: Scanner excerpt · HEARTBEAT.md (reported line 158)May include surrounding context.
md
# defensive: 6 (Max HP), 7 (Max Armor), 3 (Shield DEF) # balanced: 6 (Max HP), 0 (Sword ATK), 3 (Shield DEF) curl -X POST https://gigaverse.io/api/game/skill/levelup \ -H "Authorization: Bearer $JWT" \ -H "Content-Type: application/json" \ -d '{"skillId": 1, "statId": CHOSEN_STAT, "noobId": YOUR_NOOB_ID}'

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The README instructs users to run npx skills add gigaverse-games/play without pinning a specific version of the skills package. This causes execution of whatever version is current at install time, which creates a supply-chain risk if the package is compromised, updated maliciously, or changed incompatibly. In the context of an agent skill that interfaces with wallets and blockchain gameplay, unexpected code execution is more sensitive because it may affect credentials, transactions, or agent behavior.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documentation clearly instructs use of shell commands, network access, and reading/writing secret files, but it declares no corresponding tool scope or permissions. This weakens isolation and user awareness, making it easier for an agent runtime to grant broader capabilities than expected for a skill that handles private keys and JWTs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file describes the skill with generic phrases like 'Enter the Gigaverse as an AI agent' and 'Create a wallet, quest through dungeons, battle echoes, and earn rewards' but does not define concrete trigger phrases, invocation scope, or exclusion conditions. In a skill-discovery context, this can make activation boundaries unclear and increase the chance of unintended invocation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: Using npx skills add gigaverse-games/play without a pinned version allows whatever package is current at install time to be fetched and executed. That creates a supply-chain risk where a compromised or changed package could alter the installed skill behavior, including behavior around wallet and token handling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: Although there is a key-handling warning, the skill moves quickly into wallet setup, authentication, and financially consequential behavior without a prominent upfront risk summary for irreversible blockchain actions. In a gaming-themed skill, that context makes accidental consent more likely because users may not expect real-value operations and token persistence.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
Check your status:

bash
curl https://gigaverse.io/api/game/account/YOUR_ADDRESS curl https://gigaverse.io/api/factions/player/YOUR_ADDRESS

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.
Check Juice Status

bash
curl https://gigaverse.io/api/gigajuice/player/YOUR_ADDRESS

Agent Notification Behavior

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 344)May include surrounding context.
-H "Authorization: Bearer $JWT" | jq '.entities[] | select(.ID_CID == "2")'

Check current level

curl https://gigaverse.io/api/offchain/skills/progress/YOUR_NOOB_ID

text
### Level Up

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The authentication request sends a signed wallet message, address, timestamp, and agent metadata to the remote service, resulting in issuance of a bearer JWT that is then stored locally. This is security-sensitive transmission because compromise of the JWT or misuse of the auth flow can enable account actions, and the extra agent metadata creates additional tracking/privacy exposure not surfaced in the top-level description.
Content: Scanner excerpt · SKILL.md (reported line 418)May include surrounding context.
md
# 2. Sign message with your wallet # 3. Submit to API (with agent metadata!) curl -X POST https://gigaverse.io/api/user/auth \ -H "Content-Type: application/json" \ -d '{ "signature": "0x...",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 87% confidence
Finding: The minimal sequence demonstrates repeated use of a locally stored bearer token to perform authenticated remote actions, including dungeon state changes. In the context of a skill that also documents secret-file locations, this becomes dangerous because it operationalizes remote account actions without pairing them with explicit permission scoping or token-protection requirements.
Content: Scanner excerpt · SKILL.md (reported line 465)May include surrounding context.

Minimal cURL Sequence

bash
BASE="https://gigaverse.io/api"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This endpoint sends a wallet-derived signature, address, message, and agent metadata to an external service to obtain a JWT. Although authentication is expected behavior, it still constitutes transmission of sensitive authentication material to a third-party domain, and in an agent setting this can expose credentials or enable session issuance outside the user's direct oversight.
Content: Scanner excerpt · references/api.md (reported line 79)May include surrounding context.
Request

bash
curl -X POST https://gigaverse.io/api/user/auth \ -H "Content-Type: application/json" \ -d '{ "signature": "0x...",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 127)May include surrounding context.
Confirm identity and check game access.

bash
curl https://gigaverse.io/api/user/me \ -H "Authorization: Bearer YOUR_JWT"

Overview

A.I.G

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tp4

Tp4

Tp4

Tp4

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

Session Persistence

Option 2: Manual Config

Session Persistence

Track State

Description-Behavior Mismatch

Context-Inappropriate Capability

Missing User Warnings

Description-Behavior Mismatch

Missing User Warnings

External Transmission

Rp1

Undeclared Tool Scope

Vague Triggers

Rp1

Missing User Warnings

External Transmission

External Transmission

Check Juice Status

Agent Notification Behavior

External Transmission

Check current level

External Transmission

External Transmission

Minimal cURL Sequence

External Transmission

Request

External Transmission