T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.sh:14- Finding
Root Command Injection Through Unsafe sed Interpolation
- Content
View full analysis
- Remediation
View remediation
Security audit
AICash Miner
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed AICash miner, but it installs persistent root-level services and stores credentials insecurely.
Review this before installing. Use only on a dedicated machine where continuous mining, network traffic, and boot-persistent services are intended. Do not pass untrusted endpoint, API key, wallet, name, or instance values. Prefer fixing the scripts first so credentials are stored in a protected config, the service runs under a dedicated unprivileged user, instance counts and service names are validated, and start/stop operations target exact owned units.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/setup.sh:110- Finding
Persistent Miner Service Runs With Unnecessary Root Privileges
- Content
View full analysis
"/etc/systemd/system/${SVC_NAME}.service" << EOF [Unit] Description=AICash Miner (${SVC_NAME}) After=network-online.target Wants=network-online.target [Service] Type=simple ExecStart=${NODE} ${INSTALL_DIR}/miner.js Restart=always RestartSec=3 Environment=HOME=/root [Install] WantedBy=multi-user.target EOF echo "Created: ${SVC_NAME}.service" done systemctl daemon-reload for i in $(seq 1 "$INSTANCES"); do SVC_NAME="${NAME}" [[ $i -gt 1 ]] && SVC_NAME="${NAME}-${i}" systemctl enable --now "${SVC_NAME}" 2>&1 | grep -v "Created symlink" echo "Started: ${SVC_NAME}" done ``` ### Technical Analysis A systemd system service runs as root unless the unit specifies another account through `User=`. The generated unit does not specify `User=` or `Group=` and explicitly sets `HOME=/root`. The miner's declared operation only requires outbound HTTPS access, read access to its configuration, and write access to a statistics file. It does not require continuing root privileges. The unit also lacks common systemd hardening directives such as `NoNewPrivileges`, `ProtectSystem`, `ProtectHome`, and restricted writable paths. Automatic restart and boot enablement are documented features relevant to 24/7 mining, but persistence does not justify running the workload as root. ### Attack Path 1. Setup creates and enables the system-level service. 2. Systemd launches Node.js and `miner.js` as root during setup and after subsequent reboots. 3. An attacker obtains a way to alter the generated miner file, abuse unsafe configuration, or exploit a r ...[truncated 536 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.sh:42- Finding
Plaintext API Key Is Persisted and Sent to an Unrestricted Endpoint
- Content
View full analysis
{ const u = new URL(url); const data = JSON.stringify(body); const req = https.request({ hostname: u.hostname, port: 443, path: u.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data), ...headers }, timeout: CONFIG.requestTimeout }, (res) => { ``` ```javascript const res = await postJSON( CONFIG.endpoint, { 'x-agent-api-key': CONFIG.apiKey }, { block_number: 999999999 } ); ``` ```javascript return (await postJSON( CONFIG.endpoint, { 'x-agent-api-key': CONFIG.apiKey }, { block_number: n } )).data; ``` ```bash sed -i "s|__ENDPOINT__|${ENDPOINT}|g; s|__API_KEY__|${API_KEY}|g; s|__WALLET__|${WALLET}|g" "$INSTALL_DIR/miner.js" ``` ### Technical Analysis The supplied API key is embedded directly into the generated `miner.js` source file. No explicit secure file mode is applied, so confidentiality depends on preexisting directory permissions and the invoking process's umask. The endpoint is completely operator-controlled and is not restricted to an AICash-owned hostname. The miner attaches the API key as `x-agent-api-key` to requests made to that endpoint. Although the implementation uses Node's HTTPS module and fixes the port to 443, HTTPS protects transport only; it does not establish that the destination is an authorized recipient of the credential. Each configured ...[truncated 1143 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.sh:19- Finding
Unbounded Creation of Boot-Persistent Mining Services
- Content
View full analysis
"/etc/systemd/system/${SVC_NAME}.service" << EOF [Unit] Description=AICash Miner (${SVC_NAME}) After=network-online.target Wants=network-online.target [Service] Type=simple ExecStart=${NODE} ${INSTALL_DIR}/miner.js Restart=always RestartSec=3 Environment=HOME=/root [Install] WantedBy=multi-user.target EOF echo "Created: ${SVC_NAME}.service" done systemctl daemon-reload for i in $(seq 1 "$INSTANCES"); do SVC_NAME="${NAME}" [[ $i -gt 1 ]] && SVC_NAME="${NAME}-${i}" systemctl enable --now "${SVC_NAME}" 2>&1 | grep -v "Created symlink" echo "Started: ${SVC_NAME}" done ``` ### Technical Analysis The `--instances` value is used as the upper bound for `seq` without validation that it is a bounded positive integer. A very large value causes the script to create and enable a correspondingly large number of system services. Every generated service runs continuously, automatically restarts, starts at boot, and repeatedly makes network requests. This turns a single unvalidated argument into persistent CPU, memory, filesystem, process, network, and remote API load. ### Attack Path 1. An attacker or unsafe deployment instruction supplies an excessive `--instances` value. 2. The privileged setup script creates many service unit files under `/etc/systemd/system`. 3. Setup enables and immediately starts each service. 4. Each process enters its permanent request-and-retry loop. 5. The host or remote API experiences resource exhaustion, and the load returns after reboot because the services are enabled. ### Impact Assessment Potential effects include ho ...[truncated 309 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/start.sh:2- Finding
Lifecycle Scripts Can Control Unrelated Services Through Substring Matching
- Content
View full analysis
/dev/null echo "Started: $svc" done ``` From `scripts/stop.sh`: ```bash for svc in $(systemctl list-units --type=service --all --no-legend | grep "aicash-miner" | awk '{print $1}'); do systemctl stop "$svc" && systemctl disable "$svc" 2>/dev/null echo "Stopped: $svc" done ``` From `scripts/status.sh`: ```bash for svc in $(systemctl list-units --type=service --all --no-legend | grep "aicash-miner" | awk '{print $1}'); do name=$(echo "$svc" | sed 's/.service//') status=$(systemctl is-active "$svc") echo "${name}: ${status}" done ``` ### Technical Analysis The scripts select units by searching the entire textual output of `systemctl list-units` for the substring `aicash-miner`. They do not verify that a unit was created by this Skill or that its name follows an exact trusted pattern. The start script does more than start matched services: `enable --now` also makes every match boot-persistent. The stop script correspondingly stops and disables every match. Therefore, unrelated or attacker-created services whose unit listing contains the substring can have their runtime and boot state changed. There is also a functional inconsistency: setup supports arbitrary names through `--name`, but the management scripts only discover names containing the hard-coded `aicash-miner` substring. ### Attack Path 1. An unrelated or attacker-controlled systemd unit is created with `aicash-miner` somewhere in the matched unit-list output. 2. A privileged operator invokes `scripts/start.sh` or `scripts/stop.sh`. 3. The grep pipeline includes the unrela ...[truncated 717 chars]- Remediation
View remediation
.service`. - Validate each unit name against a strict anchored pattern before passing it to `systemctl`. - Do not parse human-oriented `systemctl list-units` output with `grep` and `awk`. - Separate starting from enabling: a normal start operation should not silently add boot persistence. - Ensure custom names accepted by setup are either safely tracked by management scripts or remove the custom-name option. - Add an uninstall operation that stops and disables exact owned units, removes their unit files, performs `daemon-reload`, and securely removes secret-bearing generated files when requested. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/setup.sh --api-key <KEY> --wallet <WALLET> --endpoint <ENDPOINT>
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/setup.sh --api-key <KEY> --wallet <WALLET> --endpoint <ENDPOINT>
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/setup.sh --api-key <KEY> --wallet <WALLET> --endpoint <ENDPOINT>
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script embeds the API key, wallet, and endpoint directly into /root/.openclaw/workspace/aicash/miner.js via string substitution, causing long-lived credential persistence on disk. Any later file read, backup, log collection, or compromise of the host exposes the secrets, and there is no warning or safer secret-handling path despite this running as root.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises automation that will use environment-derived secrets and perform system-level actions, but it declares no tool scope or permission boundaries. In an agent setting, missing explicit permissions increases the chance that the skill can access credentials or execute setup behavior without clear user consent or policy enforcement.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill requests sensitive inputs including an API key, wallet address, and mining endpoint, but it does not include warnings about secure handling, storage, logging, or exposure risk. In combination with automated setup and 24/7 operation, poor credential hygiene could leak secrets, expose wallet-linked activity, or connect users to untrusted endpoints.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs users to run a setup script that creates and starts persistent systemd mining services, but this side effect is not prominently disclosed as a warning. That is dangerous because users may unknowingly install long-running background processes that consume resources, survive session end, and are harder to notice or remove.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script creates systemd unit files under /etc/systemd/system and immediately enables and starts them without any explicit confirmation. This establishes privileged, boot-persistent execution that can survive the initial setup and continue making network requests indefinitely, increasing the blast radius if the miner or endpoint is malicious or misconfigured.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The use of systemctl enable --now makes the miner auto-start immediately and on future boots, creating persistence. In the context of an unvetted crypto-mining skill running as root, persistence is more dangerous because it maintains ongoing resource consumption and network activity even after the user may think setup is complete.
- Content
sh for i in $(seq 1 "$INSTANCES"); do SVC_NAME="${NAME}" [[ $i -gt 1 ]] && SVC_NAME="${NAME}-${i}" systemctl enable --now "${SVC_NAME}" 2>&1 | grep -v "Created symlink" echo "Started: ${SVC_NAME}" done
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 96% confidence
- Finding
The script enumerates all systemd services whose unit names contain "aicash-miner" and runs
systemctl enable --nowon them, causing immediate execution and persistence across reboots. In the context of a crypto-mining skill, establishing automatic startup is a strong persistence mechanism that can keep unwanted mining or other payloads running continuously, especially if a similarly named rogue service already exists on the host.- Content
sh #!/bin/bash for svc in $(systemctl list-units --type=service --all --no-legend | grep "aicash-miner" | awk '{print $1}'); do systemctl enable --now "$svc" 2>/dev/null echo "Started: $svc" done
Static analysis
No suspicious patterns detected.