Dashpass

• Outcome: Review
• Latest audit: Jun 17, 2026 · 12:42 PM UTC
• Version: 0.9.0

Overview

This appears to be a real credential-vault tool, but it needs Review because it can expose or change high-value secrets and some protections are weaker than described.

Install only if you are comfortable giving this skill access to a Dash identity key that can decrypt and mutate the vault. Use testnet or a dedicated identity, avoid storing the vault’s own WIF as an exportable credential, disable caching for sensitive use with `DASHPASS_CACHE=none`, avoid `eval` workflows when possible, and do not rely on `get --mutual` as real human approval in this version.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The contract stores sensitive metadata such as service name, label, credential type, security level, status, expiry, and rotation linkage in plaintext on-chain while the skill description strongly implies that credentials are only decryptable by the user. Even if the secret value is encrypted, this metadata can reveal what services a user uses, what kinds of secrets they hold, which credentials are high value, and when they rotate or revoke them, enabling profiling and targeted attacks.

Description-Behavior Mismatch

Low

• Confidence: 83% confidence
• Finding: The contract includes an on-chain accessLog document that records service, action, agentId, and timestamp, which expands the data exposure beyond simple credential storage into behavioral auditing. In the context of a credential vault, this can leak usage patterns, agent identities, and timing information that help an observer infer operational activity, sensitive integrations, or moments of credential rotation and export.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The documentation states that the `delete` command can permanently remove credentials from the blockchain, which conflicts with the earlier on-chain/immutable storage model. In a secrets-management skill, this can mislead users into believing compromised or obsolete secrets are fully erased when they may still remain recoverable or historically accessible, creating retention and incident-response risk.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The `env` command intentionally decrypts stored secrets and prints them as shell `export` statements, which moves the tool beyond passive vault storage into active secret injection into process environments. Environment variables are commonly exposed to child processes, shell history/workflows, debug logs, crash reports, and co-tenant inspection on some systems, so this materially increases secret exposure risk.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The service-to-environment mapping includes `dashpass-wif -> CRITICAL_WIF`, allowing the vault's own wallet private key to be decrypted and exported as a normal environment variable. Exposing the root signing/decryption key to the shell environment undermines the vault's trust boundary: any process inheriting that environment can steal the key and use it to decrypt secrets or perform identity operations.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill’s activation guidance is broad enough to trigger on many ordinary discussions about credentials, passwords, tokens, and secret handling. In a security-sensitive skill that can store, retrieve, export, and recover secrets, overbroad activation increases the chance the agent invokes the skill in contexts where secret-management actions were not explicitly intended, creating unnecessary exposure or unsafe automation paths.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The `env` documentation recommends `eval $(node dashpass-cli.mjs env ...)`, which causes the shell to execute whatever text the command outputs. Because this skill handles decrypted secrets, any output-manipulation bug, malicious service-name handling, or compromised CLI could turn credential export into arbitrary command execution and also exposes secrets in the shell environment where child processes and logs may access them.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document explicitly describes a flow where decrypted secrets are handed to the AI agent in plaintext, while also making strong trust-minimizing claims that can downplay the residual risk of secret exposure at the application layer. Even if the encryption and key handling are sound at rest and in transit, plaintext delivery to an agent creates a real exfiltration path through prompts, tool outputs, logs, memory, downstream API calls, or other connected skills.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The `env` command emits decrypted credentials directly to stdout as shell-ready exports without a prominent warning at the point of use. In agent and CLI contexts, stdout is frequently captured by logs, wrappers, notebooks, transcripts, or orchestration layers, so this can leak secrets even when the user only intended convenient injection.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code persists both secret shares to local disk under the same user-controlled directory with no explicit runtime disclosure, consent, or stronger separation boundary. While file mode 0600 reduces exposure to other local users, malware, backup agents, shell history mistakes, or accidental exfiltration can capture both shares and fully reconstruct the private key, which undermines the claimed protection model.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The function performs decryption immediately when given both shares and ciphertext, with no user-facing confirmation, policy gate, or interactive notice at execution time. In the context of a credential vault for AI agents, silent decryption increases the risk that compromised automation, a confused deputy flow, or unintended agent behavior can access plaintext secrets without the operator realizing it.

Session Persistence

Medium

• Category: Rogue Agent

Content

If an agent misbehaves or a key is compromised:
- **Instant:** Delete the `CRITICAL_WIF` environment variable → agent loses all access immediately
- **Permanent:** Rotate the WIF → all old ciphertext becomes undecryptable
- **On-chain:** Revoke the Identity key → no more write access to the blockchain

## Local cache

• Confidence: 87% confidence
• Finding: write access to the blockchain ## Local cache DashPass caches encrypted credential data in `~/.dashpass

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.