T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_validator_key.py:53- Finding
Validator Private Keys Are Disclosed Through Standard Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Xian Node
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its node-management purpose, but it gives unsafe validator-key handling examples that could accidentally expose high-value secrets.
Review this skill before installing. Use it only in an isolated environment, avoid pasting validator private keys into commands or agent chats, do not run the key generator where stdout is logged, pin and review upstream code before building, and back up configuration before wipe/reset commands.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:46- Finding
Validator Private Keys Are Passed Through Command-Line Arguments
- Content
View full analysis
" --seed-node-address "..." --copy-genesis' ``` The same pattern is repeated for a genesis validator: ```bash make configure CONFIGURE_ARGS='--moniker "genesis-validator" --genesis-file-name "genesis-custom.json" --validator-privkey ""' ``` ### Technical Analysis The Skill instructs users to place a validator private key directly in a command-line argument. Depending on the shell, operating system, build tooling, and agent environment, command arguments may be exposed through: - Shell history - Agent transcripts and tool-call records - Build and debug logs - Process inspection interfaces - Audit or telemetry systems - Error messages that reproduce the invoked command - Makefile diagnostic output Passing the secret through the nested `CONFIGURE_ARGS` variable can also cause it to be expanded and logged by multiple process layers. Although access to process arguments is restricted on some systems, it is not a reliable confidentiality boundary. ### Attack Path 1. A validator operator follows the documented `make configure` command. 2. The private key is entered literally in the command line. 3. The command is retained in shell history, an agent transcript, build output, process metadata, or telemetry. 4. Another local user, administrator, log reader, or compromised monitoring component obtains the key. 5. The attacker configures another node with the stolen validator key. 6. The attacker impersonates the validator or creates conflicting signatures. ### Impact Assessment A successful attacker obtains the signing authority of the affected validator. This can permit validator impersonation, un ...[truncated 229 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:21- Finding
Unpinned Mutable Dependencies Are Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill contains clear network-oriented operational commands and RPC usage, but it does not declare any tool scope or permission boundaries. In an agent setting, this increases the chance that an agent may perform network actions without explicit guardrails or user awareness, especially because the skill is designed to connect to remote seed nodes and interact with blockchain services.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The validator-node example instructs users to pass a validator private key directly on the command line without warning about shell history, process inspection, logging, or insecure storage risks. Exposure of a validator key can allow an attacker to impersonate the validator, sign malicious actions, or permanently compromise node identity and funds tied to that key.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The key-generation example prints the newly generated validator private key directly to the terminal and provides no warning about protecting or securely storing it. Terminal output may be captured in scrollback, logs, recordings, or remote session transcripts, making accidental disclosure of a highly sensitive validator secret much more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documented reset commands include wipe operations that erase node data, but the skill does not place an explicit warning immediately around those commands. In an operational blockchain context, a user or agent could run them during troubleshooting and unintentionally destroy local state, causing downtime, forced resync, or loss of unrecoverable local artifacts if backups are missing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script emits the validator private key directly to stdout, which can expose it through terminal scrollback, shell logging, CI/CD logs, remote session recording, or operational copy/paste mistakes. In the context of blockchain validator management, disclosure of this key can allow an attacker to impersonate the validator or compromise node identity and network participation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The SDK example includes a live transaction-sending call without warning that it changes blockchain state and may spend real assets when pointed at a funded wallet or production node. In this node-management skill, readers may reasonably test snippets against localhost/mainnet infrastructure, so the lack of a caution increases the risk of unintended transactions.
- Content
Static analysis
No suspicious patterns detected.