ClawHub
Back to skill

Security audit

Chitin Cert

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent certificate-issuance integration, with disclosed blockchain/API behavior and no evidence of hidden exfiltration or persistence.

Before installing, treat certificate issuance as public and durable: confirm every recipient, title, evidence URL, and metadata field before minting, protect `ck_` API keys, use trusted webhook endpoints, and prefer a pinned or otherwise verified MCP server package instead of running the unpinned `npx -y` command blindly.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
skill.md:302
Finding

Unpinned npm Package Is Downloaded and Executed Without Confirmation

Content
View full analysis

Vulnerability Details

File Location: skill.md:302
Additional Location: llms.txt:68
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

bash
npx -y chitin-mcp-server

Technical Analysis

The documented command uses npx to resolve and execute chitin-mcp-server from the npm ecosystem. It does not specify an exact package version or verify an integrity hash. The -y option automatically accepts installation prompts, reducing the opportunity for the user to inspect the resolved package and version before execution.

Consequently, the code executed by this command can change after the reviewed Skill package has been published. The MCP server's implementation is not included in the audited project, so its behavior could not be statically verified. This creates a supply-chain risk if the package, a future release, its transitive dependencies, or its maintainer account is compromised.

Attack Path

  1. An attacker compromises the npm package, its maintainer account, or a transitive dependency and publishes a malicious release.
  2. A user or agent follows the Skill documentation and runs npx -y chitin-mcp-server.
  3. npx resolves the unpinned package to the affected release and downloads it.
  4. The package's executable code runs locally without an interactive installation confirmation.
  5. The malicious payload accesses resources available to the invoking process or performs unauthorized actions under that user's privileges.

Impact Assessment

Successful exploitation would allow arbitrary code execution with the permissions of the user or agent that launches the MCP server. Depending on the execution environment, exposed resources could include local files, environment variables, wallet-related configuration, API credentials, network access, and data available to the MCP process.

The issue does not itself establish privilege escalation, persistence, or credentia ...[truncated 133 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact reviewed version rather than resolving the latest release:

    bash
    npx -y chitin-mcp-server@<reviewed-exact-version>

  2. Prefer installing through a committed lockfile so the package and all transitive dependencies resolve reproducibly.

  3. Verify registry provenance and package integrity before execution, including npm integrity metadata and publisher identity.

  4. Remove -y where unattended installation is unnecessary so users can review the resolved package before execution.

  5. Audit the MCP server and its dependency tree before recommending it as executable tooling.

  6. Run the MCP server with least privilege in an isolated environment, exposing only the files, environment variables, credentials, and network destinations required for its operation.

  7. Establish a controlled upgrade process in which newer versions are reviewed and tested before the pinned version is changed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill instructs users to run npx -y chitin-mcp-server without pinning an exact package version or integrity hash, which causes execution of whatever package version is current at install time. If the npm package is later compromised, hijacked, or a malicious version is published, users could execute attacker-controlled code directly on their systems during setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest explicitly promotes permanent on-chain and Arweave-backed certificate issuance, but does not warn users that published certificate data and metadata may be effectively irreversible and publicly durable. In a credentials skill, omission of permanence/privacy warnings can lead operators to issue sensitive or mistaken attestations that cannot realistically be deleted, creating lasting privacy, reputational, and compliance harm.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 54)May include surrounding context.

Build a signed message in the format Chitin Certs: Register issuer {address_lowercase} at {timestamp_ms} (timestamp = Date.now() in milliseconds, must be within ±5 minutes).

bash
curl -X POST https://certs.chitin.id/api/v1/issuers \
  -H "Content-Type: application/json" \
  -d '{
    "address": "0xYOUR_WALLET",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 186)May include surrounding context.

Batch Issue (Up to 100 Certs)

bash
curl -X POST https://certs.chitin.id/api/v1/certs/batch \
  -H "Authorization: Bearer ck_abc123..." \
  -H "Content-Type: application/json" \
  -d '{

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The skill instructs users to run npx -y chitin-mcp-server without pinning a specific package version or integrity hash. This creates a supply-chain risk: the package author account, dependency chain, or future published version could be compromised and the command would fetch and execute attacker-controlled code on the user's machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill declares webhook support for cert.minted events but provides no warning that certificate issuance events can be transmitted to external endpoints. This can surprise users, leak operational or recipient metadata to third parties, and create inadvertent outbound data flows if webhook destinations are misconfigured or insufficiently vetted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.