Security audit

Easy Mining

Security checks for vulnerabilities and agentic risk

Overview

The skill’s mining-farm purpose is coherent, but it asks users to expose a powerful API key in chat or CLI and can trigger miner operations without a code-enforced confirmation gate.

Review before installing. Use only narrowly scoped, revocable Nonce keys, avoid pasting production secrets into ordinary chat, rotate any key shared this way, and treat write operations such as reboot, firmware update, network scan, and pool configuration as admin actions that need explicit out-of-band confirmation.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/mcp_client.py:288
Finding: Nonce API Key Is Exposed Through AI Conversations and Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/mcp_client.py:142
Finding: Privileged Nonce Credential Is Forwarded to a Third-Party MCP Relay
Content: View full analysis
Dict[str, Any]: return get_client().call_tool( "easy-mining-get-workspace", {"api_key": api_key}, ) def create_task_batch( api_key: str, farm_id: str, task_name: str, miner_ids: List[str], params: Optional[Dict[str, Any]] = None, ) -> Dict[str, Any]: args: Dict[str, Any] = { "api_key": api_key, "farm_id": farm_id, "task_name": task_name, "miner_ids": miner_ids, } if params: args["params"] = params return get_client().call_tool("easy-mining-create-task-batch", args) ``` ### Technical Analysis The transmission is disclosed in the project documentation and is necessary for ...[truncated 2032 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/mcp_client.py:253
Finding: Operational Write Actions Do Not Enforce the Documented Secondary Confirmation
Content: View full analysis
Dict[str, Any]: args: Dict[str, Any] = { "api_key": api_key, "farm_id": farm_id, "task_name": task_name, "miner_ids": miner_ids, } if params: args["params"] = params return get_client().call_tool("easy-mining-create-task-batch", args) ``` The CLI describes confirmation only in help text: ```python ct_p = subparsers.add_parser( "create-task", help="Create task batch (WRITE - confirm first!)", ) ct_p.add_argument("--api-key", required=True, help="Nonce API key") ct_p.add_argument("--farm-id", required=True, help="Farm ID") ct_p.add_argument( "--task-name", required=True, choices=[ "miner.system.reboot", "miner.power_mode.update", "miner.firmware.update", "miner.network.scan", "miner.pool.config", "miner.light.flash", ], help="Task type", ) ct_p.add_argument("--miner-ids", nargs="+", required=True, help="Miner IDs") ct_p.add_argument("--params", type=json.loads, help="Task params as JSON string") ``` The command dispatch performs no prompt, confirmation-token validation, or precondition check: ```python elif args.command == "create-task": result = create_task_batch( args.api_key, args.farm_id, args.task_name, args.miner_ids, params=getattr(args, "params", None), ) ``` ### Technical Analysis `SKILL.md` states that all write operations require secondary confirmation and that the affected miner list must be displa ...[truncated 1994 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
md
notes: | Thin MCP client wrapper — all Nonce API logic runs on Antalpha MCP Server. User provides their own Nonce API Key per request (not stored server-side). Get API Key from: https://app.nonce.app → Settings → API Keys --- # Easy Mining Skill 🦐

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README explicitly instructs users to paste a live Nonce API key into AI chat, which is a sensitive secret that may be logged, retained, exposed to other tools, or mishandled by the agent framework. This is especially dangerous because the skill can perform operational actions on mining infrastructure, so compromise of the key could expose farm telemetry and enable unauthorized write operations such as rebooting miners or changing power modes.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The setup instructions tell the user to reveal the API key in natural-language conversation, which creates unnecessary secret exposure through chat transcripts, telemetry, prompt history, and possible downstream tool access. In this skill's context, the key is tied to mining-farm management and can likely grant access to operational data and privileged actions, increasing the consequences of leakage beyond simple read-only account access.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The English instructions repeat the same insecure pattern by asking the user to provide the API key directly to the AI, normalizing unsafe handling of credentials. Because this skill supports write operations on miners and farm configuration, a leaked key could allow unauthorized monitoring, task creation, miner reboot, firmware actions, or other disruptive changes depending on key scope.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill exposes networked MCP capabilities, including both read and write operations, but does not declare an explicit allowlist or permissions boundary. In an agent environment, missing tool scope increases the chance of overbroad invocation or unintended access to sensitive farm-management actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation text is very broad and includes many generic natural-language phrases around mining, status, revenue, and reboot operations. This can cause the skill to activate in unintended contexts, increasing the chance that sensitive farm data is queried or operational actions are proposed when the user did not intend to use this skill.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly tells users to paste their Nonce API key into chat for verification. Chat channels are often logged, retained, or exposed to other tools and model context, so collecting credentials this way creates a real risk of credential leakage and subsequent unauthorized access to mining-farm data and controls.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document claims write actions require explicit confirmation, yet it provides a directly executable CLI example that invokes the write tool without any technical confirmation gate. Users or downstream agents may treat the example as approved procedure and perform disruptive miner operations immediately.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file lists write-capable operations such as reboot, power mode changes, firmware update, pool configuration, and network scanning without any warning that they can disrupt miners, reduce hashrate, interrupt revenue, or alter fleet behavior. In this skill context, natural-language access to operational controls makes missing safety prompts more dangerous because an agent could translate an ambiguous request into a costly batch action.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The reference exposes miner.network.scan and miner.pool.config, which extend beyond passive farm monitoring into infrastructure discovery and miner reconfiguration. In a mining-management skill, these actions can materially alter device connectivity or enumerate internal network assets, so documenting them without clear scope justification increases the risk of misuse or over-privileged agent behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script accepts a sensitive Nonce API key from the CLI and forwards it to a remote MCP server for every tool call, but the execution path does not present a clear user-facing warning that credentials are being sent to a third-party endpoint (mcp-skills.ai.antalpha.com). In this skill context, that is especially sensitive because the same key enables visibility and potentially control over mining-farm infrastructure, so users need explicit notice and trust boundaries before transmission.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The CLI exposes write-capable operations beyond the manifest's stated batch actions, including miner.pool.config, miner.network.scan, and miner.light.flash. In a mining-farm management skill, undocumented operational commands are more dangerous because they can change pool settings or trigger network-wide actions on production hardware without users or reviewers understanding the full control surface. Pool reconfiguration in particular can redirect mining rewards or disrupt operations, making the impact materially higher than a simple documentation mismatch.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Several task descriptions and the warning note are presented in Chinese, while the rest of the document is in English, with no indication that the skill is intentionally region-specific or that users may choose their preferred language. This can violate language/locale policy when a specific language is imposed without opt-in or justification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code exposes an additional capability, easy-mining-list-agents, that is not disclosed in the skill description. Hidden or undocumented functionality weakens user consent and reviewability because operators may authorize a mining-management skill without realizing it can also enumerate agents/infrastructure components. In this context the risk is limited because the function appears read-only, but it still expands the accessible attack surface beyond the declared scope.
Content: No source excerpt is available for this finding.