T09 · Insecure Skill Coding Practices
- Location
SKILL.md:54- Finding
Contradictory Guardian Co-Signing Requirements May Weaken Transaction Authorization
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:54-57;references/api-reference.md:62-65
Vulnerability Type: Inconsistent and potentially unsafe authorization configuration
Risk Level: HighVulnerable Documentation Snippets
SKILL.md:54-57:markdown **Key safeguards:** - **Dual-signature enforcement:** Every transaction requires both the agent's signature AND the Guardian's co-signature. The smart contract rejects any UserOp missing either. The agent signer alone cannot execute any transaction. - **Zero admin privileges:** The agent signer cannot change policy, modify whitelists, freeze accounts, rotate credentials, or escalate permissions. Only the human owner wallet can perform administrative actions.references/api-reference.md:62-65:markdown ### Co-Signing Tiers - **LOW** (below `guardianThreshold`): Agent signs alone - **MEDIUM** (above `guardianThreshold`): Agent + Guardian co-sign - **HIGH** (above `ownerThreshold`): Agent + Guardian + Owner all signTechnical Analysis
The primary security documentation states that every transaction requires both the agent and Guardian signatures and that the agent signer cannot execute a transaction alone. The API reference directly contradicts this guarantee by documenting a
LOWtier in which the agent signs alone.Dual-signature enforcement is presented as the core control limiting the consequences of compromise of
SIGIL_AGENT_SIGNER. If the tier model accurately reflects the deployed authorization logic, LOW-tier transactions do not benefit from the promised independent Guardian authorization. Operators relying on the stronger statement may consequently provision the signer or configure transaction thresholds under an incorrect threat model.The repository contains documentation and metadata only, so the underlying smart-contract behavior cannot be verified from the audited artifact. Nevertheless, the contradictory secur ...[truncated 1899 chars]
- Remediation
View remediation
Remediation Suggestions
- Establish the actual contract-enforced signature requirements for each transaction tier and treat the deployed smart contracts as the authoritative source.
- If every transaction requires Guardian co-signing, remove the agent-only LOW tier from
references/api-reference.mdand add automated tests proving that an agent-only UserOperation is rejected at every value level. - If LOW-tier transactions are intentionally agent-only, remove all claims that every transaction is dual-signed. Clearly document:
- The default and configurable
guardianThreshold. - Whether thresholds are calculated per transaction or cumulatively.
- Which asset valuation source and units are used.
- Applicable target and function restrictions.
- Daily spending and transaction-velocity limits.
- Whether repeated LOW-tier transactions trigger escalation.
- The default and configurable
- Default to Guardian co-signing for all transactions. If an agent-only tier is necessary, use a minimal threshold and enforce strict cumulative spending and velocity limits on-chain.
- Add specification-consistency checks to release review so absolute security claims cannot conflict with endpoint or contract documentation.
- Add integration tests for LOW, MEDIUM, and HIGH boundary values, including repeated operations immediately below each threshold.
- Provide an operator-visible description of the effective signature policy and require explicit owner confirmation before enabling any agent-only execution mode.