Web3 Transfer Update

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:53 AM UTC
• Version: 1.0.1

Overview

This is a coherent crypto-transfer skill, but it under-discloses mandatory remote registration and persistence of an API credential for a high-impact financial workflow.

Review before installing. Use only in a runtime where you trust the Antalpha MCP service and where API keys are stored in a proper secret store rather than logs, chat memory, or plaintext files. Confirm that antalpha-register is explicitly allowed, never provide wallet private keys or seed phrases, and only sign wallet prompts after independently checking recipient, chain, token, amount, and fees.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:45

Finding

Persistent API Credential Storage Without Security Requirements

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45–53
Vulnerability Type: Insecure handling and persistence of authentication credentials
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Registration

Before calling any transfer tool, the agent must be registered once:

1. Call `antalpha-register` to obtain an `agent_id` and `api_key`.
2. Persist the returned `agent_id` (and `api_key`).
3. Pass `agent_id` on every subsequent `transfer-request`, `transfer-status`, and `transfer-cancel` call.

If a tool returns an authentication failure, the `agent_id` is missing or invalid — re-register and retry.

Technical Analysis

The Skill explicitly instructs the agent to persist an externally issued api_key, but does not specify a secure storage mechanism or any controls governing the credential lifecycle. There are no requirements for encryption at rest, restrictive file permissions, secret-store use, log redaction, per-user isolation, expiration, rotation, revocation, or deletion.

Because this is an instruction-only Skill, the actual persistence method is delegated to the host agent or runtime. An implementation may therefore store the key in plaintext files, general-purpose memory, conversation history, logs, backups, or another location accessible across users or sessions. Persisting the API key also exceeds the minimum requirement suggested by the documented downstream calls, which explicitly require only agent_id.

The README describes the Skill as non-custodial but does not disclose this mandatory registration and credential-persistence behavior. Although the API key is not a wallet private key, it is still an authentication secret associated with a financial-transfer service and must be protected accordingly.

Attack Path

1. A user invokes the Skill for a cryptocurrency transfer.
2. The agent calls the external antalpha-register tool and receives an agent_id and `api_k ...[truncated 1312 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not persist the API key unless cross-session persistence is strictly necessary. Prefer short-lived, session-bound credentials.
2. If persistence is required, mandate an operating-system or runtime-managed secret store rather than plaintext files, conversation history, logs, environment snapshots, or general agent memory.
3. Require encryption at rest and in transit, restrictive access controls, per-user and per-agent isolation, and least-privilege credential scopes.
4. Define credential expiration, rotation, revocation, and secure deletion procedures.
5. Explicitly prohibit displaying or logging the API key, including in tool traces, debug output, error messages, telemetry, and backups.
6. Clarify whether downstream tools require the API key. If only agent_id is needed, avoid retaining the API key after registration.
7. Document the registration and credential-storage behavior in README.md so operators can make an informed security decision.
8. Require backend authorization checks and fresh user confirmation for all state-changing transfer operations, even when a valid agent credential is presented.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: web3-transfer
version: 1.0.1
description: Unified multi-chain transfer skill for BTC, EVM, and Solana. Use when a user wants to send ETH/ERC20, SOL/SPL, or BTC, including batch payouts, with preview confirmation, wallet signing, risk checks, and status follow-up through the transfer-request / transfer-status / transfer-cancel MCP tools.
author: Antalpha
requires: []
metadata:
  install:
    type: instruction-only
  mcp:
    endpoint: https://mcp-skills.ai.antalpha.com/mcp
    transport: streamable-http
  env: []
---

# Antalpha Web3 Transfer

## Persona

You are a careful, execution-oriented Web3 transfer operator.
You move funds only after the user has clearly confirmed the exact recipient, amount, and chain.
You neve

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 113)May include surrounding context.

md

## Safety Principles

- Never ask the user for a private key or seed phrase
- Never hide transfer risk warnings
- Never claim success before status confirms broadcast / completion
- Never invent USD value when price data is unavailable

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The 'Required Runtime Capability' section says the skill assumes only transfer-request, transfer-status, and transfer-cancel, but later makes antalpha-register mandatory before any transfer call. This contradiction can lead an agent to proceed under an incomplete trust model, potentially triggering unexpected outbound registration/authentication flows to the MCP service without prior declaration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to call a mandatory antalpha-register tool even though the declared runtime capability only lists transfer tools and the manifest requires array is empty. This hidden dependency can cause agents to invoke an undeclared external capability, weakening operator visibility and policy enforcement around what tools the skill actually needs to access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The README starts with fixed English and Chinese sections, indicating a language presentation decision without describing how the user can choose their preferred language. Under the policy, locale or language constraints should be opt-in or explicitly justified; this file does not state such a mechanism.

Content

No source excerpt is available for this finding.