T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:58- Finding
Remote Foundry Installer Is Downloaded and Executed Without Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Cannon
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent Cannon documentation, but it deserves review because its setup and examples can expose users to unsafe remote installation and private-key handling during irreversible blockchain operations.
Review this skill before installing if it will be used around funded wallets or production deployments. Prefer isolated development environments, pinned and verified tool installation, hardware or managed signers instead of raw private keys, dry-runs before any real network action, and careful review of package contents before publishing to the on-chain registry or IPFS.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:57- Finding
Unpinned Packages Are Installed Globally from Mutable Registry Sources
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:196- Finding
Deployment Private Keys Are Passed Through Process Command-Line Arguments
- Content
View full analysis
` — Private key for deployment (or set `CANNON_PRIVATE_KEY` env var) - `--private-key ` — Private key for transactions (or set `CANNON_PRIVATE_KEY` env var) - `--private-key ` — Private key with publish permissions (or set `CANNON_PRIVATE_KEY` env var) - `--private-key ` — Owner's private key - `--private-key ` — Private key ``` ### Technical Analysis When `$KEY` is expanded by the shell, the private key becomes part of the Cannon process argument vector. Depending on the operating system and environment, command-line arguments may be observable through process inspection, diagnostic tooling, audit systems, monitoring agents, crash reports, shell wrappers, or CI/CD logging. The skill does mention alternatives such as `CANNON_PRIVATE_KEY` and stdin. However, the prominent mainnet deployment and publishing examples use the command-line form, encouraging unsafe secret handling for operations involving real funds and permanent package-management authority. The examined documentation does not prove that Cannon sends the raw private key over the network. A typical blockchain client signs transactions locally and sends signed transaction data to an RPC endpoint. The confirmed ...[truncated 1373 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The skill recommends piping a remote script directly into bash (
curl ... | bash) to install Foundry. This is a real supply-chain risk because it executes network-fetched code without verification, exposing users to compromise if the host, transport, or upstream distribution path is tampered with. In this skill's context, the danger is heightened because the tool manages blockchain deployments and may coexist with private keys, RPC credentials, and other sensitive developer secrets.- Content
md Before using this skill, ensure these tools are installed: - **Node.js 18+** and **pnpm** - `npm install -g pnpm` - **Foundry** (forge, anvil, cast) - `curl -L https://foundry.paradigm.xyz | bash && foundryup` - **Cannon CLI** - `pnpm add -g @usecannon/cli` Verify installation:
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
text Options: - `--no-confirm` — Skip confirmation prompt - `--ipfs` — Delete only unreferenced IPFS packages ## Verify Command
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The CLI documentation explicitly instructs users to pass a private key via a command-line flag or environment variable, but it does not include any warning about secret handling risks such as shell history exposure, process listing visibility, CI log leakage, or accidental sharing of environment configuration. In a deployment tool for Ethereum, these credentials directly control funds and package publishing authority, so omission of operational safety guidance materially increases the chance of credential compromise.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - `--write-deployments <dir>` — Output directory for deployment files - `--upgrade-from <ref>` — Upgrade from existing package (only if auto-detected package is wrong) Note: If `cannon <package>` is run and the command isn't recognized, Cannon automatically executes `cannon run <package>`. ## Run Command
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The publish command documents use of a private key and RPC endpoint but does not warn that publishing may expose transaction metadata, package contents, or related deployment information to external RPC, registry, and IPFS-adjacent services. For a package manager that publishes on-chain and to external infrastructure, users should be clearly informed that sensitive operational data may leave their environment.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
text Options: - `--no-confirm` — Skip confirmation prompt - `--ipfs` — Delete only unreferenced IPFS packages ## Verify Command
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 65% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
text Options: - `--no-confirm` — Skip confirmation prompt - `--ipfs` — Delete only unreferenced IPFS packages ## Verify Command
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation explains that publishing makes a package available on the on-chain registry and IPFS, but it does not prominently warn users before the publish workflow that published artifacts are publicly accessible and effectively permanent. In this skill context, users may publish deployment metadata, ABIs, transaction data, and potentially source code, creating a real risk of unintended disclosure of sensitive project information.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The clean command section documents cache deletion commands but does not clearly warn that these operations remove local cached artifacts and may disrupt offline reuse or force re-fetching of packages. While this is not a confidentiality or code-execution issue, it can still lead to accidental data loss or workflow disruption if users run the command without understanding its destructive effect.
- Content