T08 · Insecure Dependencies
Warning
- Location
scripts/cyberdyne.sh:61- Finding
Unpinned npm Package Is Downloaded and Executed at Runtime
- Content
View full analysis
- Remediation
View remediation
Security audit
CYBERDYNE
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its stated marketplace purpose, but it handles real wallet funds and credentials while relying on unpinned npm code and a credential-bearing API endpoint override.
Review carefully before installing. Use a dedicated low-value wallet, avoid importing valuable private keys on the command line, pin and verify the `cyberdyne-mcp` package before use, keep `CYBERDYNE_API_URL` on the official HTTPS endpoint unless using separate development credentials, and manually inspect every transaction or approval before signing or funding.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cyberdyne.sh:17- Finding
Bearer Credential Can Be Forwarded to an Unrestricted API Endpoint
- Content
View full analysis
``` 4. The wrapper constructs a request to the attacker-controlled endpoint. 5. The request includes: ```http Authorization: Bearer cyb_... ``` 6. The attacker records the credent ...[truncated 1071 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (34)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/cyberdyne.sh tasks
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/cyberdyne.sh tasks
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/cyberdyne.sh tasks
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/cyberdyne.sh tasks
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/cyberdyne.sh tasks
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/cyberdyne.sh tasks
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/cyberdyne.sh tasks
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/cyberdyne.sh tasks
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/cyberdyne.sh tasks
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill documents shell-based setup and execution paths (
npx,curl, wrapper scripts) but does not declare anypermissionsorallowed-toolsscope. That omission increases the chance an agent may be granted overly broad execution capability by default, which is risky here because the documented commands mint wallets, store keys, and initiate on-chain funding actions.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
Using
npx -y cyberdyne-mcpwithout a pinned version causes the latest package to be fetched and executed at runtime. If the package is compromised upstream, typosquatted, or a malicious release is published, an agent could run attacker-controlled code with access to local files, credentials, wallet material, and network connectivity.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
This is another instance of runtime execution of an unpinned npm package via
npx -y cyberdyne-mcp. Because the skill is financial and wallet-related, compromise of the fetched package could directly lead to credential theft or unauthorized blockchain transactions.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
The MCP server registration command invokes an unpinned package from npm. In this context, the package is intended to become part of an agent's toolchain, so a malicious or changed upstream release could persistently alter agent behavior and exfiltrate secrets.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
This command again relies on fetching the latest
cyberdyne-mcppackage at execution time. Repeated unpinned examples normalize unsafe supply-chain practice, making accidental execution of an unreviewed release more likely.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
The unpinned
npxinvocation appears in a section about posting and funding bounties. Because the command path can mint wallets, save keys, and sign/fund blockchain transactions, executing a malicious package version would have direct financial impact.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
budget — you must then authorize, which requires a signer):
bash curl -sS -X POST "$CYBERDYNE_API_URL/api/tasks" \ -H "Authorization: Bearer $CYB_KEY" -H "Content-Type: application/json" \ -d '{"title":"Photo-verify storefront","category":"groundtruth", "reward_usd":0.10,"quantity":2,"duration_min":10,"difficulty":"easy",
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
This example instructs
launch-and-fundvia an unpinned npm package in a token-funding workflow. In a high-value path involving wallets and tokens, remote-package drift is particularly dangerous because it can turn routine funding into arbitrary code execution and asset theft.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
The Bankr-wallet beta funding example still uses an unpinned
npxpackage fetch. Since this flow interacts with custodial wallet APIs and signing endpoints, compromise could expose API keys or trigger unauthorized signing/funding actions.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
The remediation text for stale keys instructs rerunning
npx -y cyberdyne-mcp onboard, again without version pinning. Even support and recovery steps should not fetch arbitrary latest code when those steps handle wallet and identity artifacts.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
The resources section promotes global installation or execution of the package without any documented version pinning strategy. That broadens supply-chain exposure because users may treat the package as trusted infrastructure while it can change independently of the reviewed skill text.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The documentation instructs users to run
npx -y cyberdyne-mcp, which fetches and executes the latest package version at runtime without pinning. That creates a supply-chain risk: if the package or one of its dependencies is compromised, users may execute malicious code while onboarding wallets or handling API credentials.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Post a task
bash curl -sS -X POST "$API/api/tasks" \ -H "Authorization: Bearer $CYB_KEY" -H "Content-Type: application/json" \ -d '{ "title": "Photo-verify the storefront is open",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Authorize (freeze the budget)
bash curl -sS -X POST "$API/api/tasks/$TASK_ID/authorize" \ -H "Authorization: Bearer $CYB_KEY" -H "Content-Type: application/json" \ -d '{ "signedPayment": "<base64 x402 auth-capture payload>", "fee_tx_hash": "0x…" }'
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The walkthrough instructs users to execute
npx -y cyberdyne-mcpwithout pinning an exact package version. That causes live retrieval of whatever package version is current at execution time, creating a supply-chain risk where a malicious publish, compromised maintainer account, or breaking update could run arbitrary code on the user's machine and access the generated wallet, API keys, or imported private keys.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
Using unpinned
npx -y cyberdyne-mcpis especially dangerous here because the same command path supports--import 0xYOUR_PRIVATE_KEY. If the fetched package is malicious or compromised, it could immediately exfiltrate the imported private key and drain on-chain assets or impersonate the user permanently.- Content
Static analysis
No suspicious patterns detected.