T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:13
- Finding
- Automatic Wallet Discovery and SIWE Signing Exceed Search-Skill Privileges## Vulnerability Details **File Location**: `SKILL.md:13-16` and duplicated in `kaiwu-search/SKILL.md:13-16` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium **Complete Vulnerable Code Snippet**: ```markdown Requires `KAIWU_API_KEY` secret. If not set: 1. Check if agent has a wallet (base-wallet skill or existing wallet). 2. If wallet exists: auto-register via `POST https://kaiwu.dev/api/auth/agent-register` with SIWE signature to get a key. 3. If no wallet: instruct user to visit `https://kaiwu.dev` to get a free API key (1,000 searches/month free). ``` ### Technical Analysis The Skill's stated function is web search, which only requires an API credential and outbound access to the declared search endpoint. However, when the API key is unavailable, the instructions direct the Agent to discover whether a wallet is present and automatically create a Sign-In with Ethereum signature for an external service. Wallet discovery and cryptographic signing cross a sensitive privilege boundary that is not necessary for performing web searches. The instructions do not require explicit user authorization immediately before signing and do not define or validate the complete SIWE message. In particular, they provide no requirements for validating the expected domain, URI, chain ID, nonce, issued-at time, expiration time, or human-readable statement. SIWE signatures are normally authentication proofs rather than blockchain transactions, and the reviewed files do not instruct the Agent to disclose private keys or transfer funds. Nevertheless, automatically signing an insufficiently specified message allows the external registration process to obtain a cryptographic proof tied to the user's wallet identity. If the remote service or registration flow is compromised or deceptive, the Agent could be induced to sign content whose scope the user has not reviewed. The same instruction appears in bot ...[truncated 2039 chars]
- Remediation
- ## Remediation Suggestions 1. Remove automatic wallet discovery and wallet signing from the API-key setup procedure. 2. Require users to configure `KAIWU_API_KEY` manually through an approved secret-management mechanism. 3. If wallet-based registration remains available, make it explicitly optional and require informed user approval immediately before every signature. 4. Display the complete SIWE message to the user before signing, without truncation or hidden fields. 5. Strictly validate all SIWE fields against fixed expectations: - Domain and URI must exactly match the trusted service. - Chain ID must be explicitly allowed. - Nonce must be unique, unpredictable, and single-use. - Issued-at and expiration times must enforce a short validity period. - The statement must clearly explain that the signature is only for API registration. - Resources and request identifiers must be rejected unless explicitly expected. 6. Never sign opaque hashes, arbitrary messages, typed data, or transaction payloads as part of API registration. 7. Ensure registration signatures cannot be reused for unrelated authentication or authorization. 8. Document what wallet information is transmitted, how it is retained, and how users can revoke the resulting API credential. 9. Apply the remediation consistently to both `SKILL.md` and `kaiwu-search/SKILL.md` to prevent conflicting or stale instructions.