8004 Harness For Monad

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:12 PM UTC
• Version: 1.0.0

Overview

The skill mostly matches its stated blockchain identity purpose, but it has review-worthy security issues around wallet-key exposure and unsafe metadata fetching.

Review before installing or running. Use a minimal environment: expose AGENT_PRIVATE_KEY only to commands that must sign transactions, avoid running verify with the key present, and only verify trusted identities until tokenURI fetching is restricted to safe IPFS gateways. Expect Pinata uploads to publish metadata externally and expect the one-shot command to write an identity file locally. Prefer a locked dependency install before using this with real funds or production credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/verify.mjs:5

Finding

Server-Side Request Forgery Through Untrusted On-Chain Token URI

Content

View full analysis

Number(entry?.agentId) === Number(agentIdRaw) && entry?.agentRegistry === expectedRegistry ); } } ``` ### Technical Analysis The `tokenUri` value is obtained from the ERC-8004 registry for an identity selected through the user-supplied `--agentId`. An NFT owner can control that token URI. The `ipfsToHttp()` function only transforms values beginning with `ipfs://`. Every other URI is returned unchanged and subsequently passed to `fetch()`. No validation restricts the protocol, hostname, destination port, resolved IP address, or redirect destination. Consequently, an attacker-controlled identity can cause the verification process to issue HTTP requests to destinations accessible from the execution environment, including: - Loopback services such as `127.0.0.1` or `[::1]` - Private network services - Link-local addresses - Cloud instance metadata endpoints - Administrative APIs exposed only inside the host or container network The request also lacks a timeout and response-size limit. A malicious endpoint could keep th ...[truncated 1756 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/verify.mjs:18

Finding

Read-Only Verification Unnecessarily Loads the Agent Private Key

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/package.json:6

Finding

Security-Sensitive Dependencies Are Not Reproducibly Pinned

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill performs sensitive actions involving network access, environment secrets, blockchain transactions, and local file writes, but it declares no explicit tool scope or permissions boundaries. In an agent ecosystem, that omission can cause overbroad execution or poor user visibility into what resources the skill may use, increasing the chance of unintended secret exposure or unreviewed on-chain actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The one-shot flow automates upload of registration data to Pinata and writes identity state to local files without a prominent disclosure at the call site. That can lead users or higher-level agents to publish metadata to a third party and persist identity details locally without realizing the privacy, retention, and supply-chain implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code reads AGENT_PRIVATE_KEY directly from process.env and uses it to create a wallet account. This is a safety-relevant credential access operation, but the file provides no confirmation prompt, log/message, or explanatory comment/docstring warning that a private key will be consumed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script uploads agent metadata to Pinata/IPFS as part of normal execution without any explicit user-facing warning that data will be sent to a third-party service and made content-addressable. Even if the payload seems non-secret, external transmission and durable publication can expose operational details and create irreversible data disclosure risks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script performs an extra side effect beyond ERC-8004 registration by creating a local identity memory file under a workspace path used by other agent workflows. This can silently influence downstream agent behavior or persist sensitive operational context in a place the user may not expect, expanding the script’s authority beyond its stated blockchain-registration purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

Writing into a local workspace is a privileged filesystem action that is not clearly necessary for minting or managing an ERC-8004 identity NFT. In an agent-skill context, unexplained local writes are risky because they can seed state for later tasks, create persistence, or overwrite trusted files in shared automation environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script defaults to writing an identity file to a fixed path (/root/.openclaw/workspace/AGENT_IDENTITY.md) without warning or confirmation. Fixed-path writes are dangerous because they can unexpectedly overwrite existing state, create unauthorized persistence, and are especially sensitive here because the path appears designed to affect agent memory or workflow behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This script submits an on-chain register transaction immediately after parsing arguments, with no explicit user confirmation, dry-run preview, or warning about gas costs and permanent state changes. In an agent skill context, that increases the risk of unintended blockchain actions if the skill is triggered automatically or with attacker-influenced inputs, leading to unwanted identity registrations and fee expenditure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a skill for registering and managing ERC-8004 Identity NFTs on Monad, which suggests blockchain identity operations. This script instead reads an arbitrary local file and uploads it to Pinata/IPFS using external credentials, a storage-publishing capability that is not mentioned in the stated purpose and is not itself ERC-8004-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script reads a local file and uploads it to Pinata via a public network call, which transmits user-provided data off the system. Although the filename argument implies upload intent, the code contains no explicit confirmation prompt, warning message, or explanatory comment disclosing that the file will be publicly uploaded.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency uses a caret version range, which allows automatic installation of newer minor/patch releases that were not explicitly reviewed by the skill author. In a security-sensitive blockchain skill that mints and manages on-chain identity NFTs, a compromised or breaking upstream package could alter transaction construction, key handling, or data publishing behavior and introduce supply-chain risk.

Content

Scanner excerpt · scripts/package.json (reported line 7)May include surrounding context.

json

"private": true,
  "type": "module",
  "dependencies": {
    "pinata": "^2.5.1",
    "viem": "^2.38.5"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency uses a caret version range, so future installs may resolve to different code than was originally tested. Because this skill interacts with blockchain infrastructure via viem, an unexpected upstream change or malicious package release could affect transaction signing, RPC interactions, or chain-specific logic, making the supply-chain exposure more serious than in a non-sensitive utility.

Content

Scanner excerpt · scripts/package.json (reported line 8)May include surrounding context.

json

"type": "module",
  "dependencies": {
    "pinata": "^2.5.1",
    "viem": "^2.38.5"
  }
}

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/verify.mjs:40