Relay Link Bridge

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:27 AM UTC
• Version: 1.1.0

Overview

This skill is a real bridge automation tool, but it can sign and broadcast wallet transactions with a local private key while giving users too little transaction detail to verify what they are approving.

Review this carefully before installing. Use only a dedicated low-balance wallet, assume any confirmed bridge action can move real funds irreversibly, and do not use it until transaction details, RPC chain checks, spender/approval limits, and private-key handling are made much stricter.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/quick-bridge.sh:135

Finding

Unvalidated Remote Transaction Payload Is Signed with the User's Private Key

Content

View full analysis

&1) ``` The RPC endpoint is also fixed to Avalanche regardless of the selected origin chain: ```bash RPC_URL_AVAX="https://api.avax.network/ext/bc/C/rpc" ``` ### Technical Analysis The script treats the Relay quote API response as trusted transaction authorization data. The remote response directly controls: - The transaction recipient through `.data.to` - The native currency amount through `.data.value` - The contract call and its arguments through `.data.data` These values are passed directly to `cast send`, which signs the transaction using the private key loaded from `EVM_PRIVATE_KEY`. The script does not validate the destinati ...[truncated 3013 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This finding points to materially risky behavior in the wider skill design: use of EVM_PRIVATE_KEY from local config and direct transaction signing/broadcasting are highly sensitive capabilities, yet the skill description and permission model do not clearly communicate or constrain that risk. In a bridge/swap context, hidden signing logic or chain-specific RPC assumptions can lead to unauthorized transfers, signing on the wrong network, or silent fund loss.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This finding points to materially risky behavior in the wider skill design: use of EVM_PRIVATE_KEY from local config and direct transaction signing/broadcasting are highly sensitive capabilities, yet the skill description and permission model do not clearly communicate or constrain that risk. In a bridge/swap context, hidden signing logic or chain-specific RPC assumptions can lead to unauthorized transfers, signing on the wrong network, or silent fund loss.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

This finding points to materially risky behavior in the wider skill design: use of EVM_PRIVATE_KEY from local config and direct transaction signing/broadcasting are highly sensitive capabilities, yet the skill description and permission model do not clearly communicate or constrain that risk. In a bridge/swap context, hidden signing logic or chain-specific RPC assumptions can lead to unauthorized transfers, signing on the wrong network, or silent fund loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly advertises automated transaction signing and sending using a locally stored private key, but it does not clearly warn users that invoking the skill can move real funds or that private-key material in ~/.openclaw/config.env is highly sensitive. In an agent-skill context, this increases the chance of unsafe deployment, accidental fund transfers, or poor key-handling practices because users may treat setup as routine automation rather than high-risk financial execution.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises and invokes shell scripts with network-capable dependencies but does not declare any explicit tool scope such as permissions or allowed-tools. That makes the skill's execution surface under-specified, increasing the chance that an agent may grant broader shell/network access than users expect for a transaction-capable skill that references private keys.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrase "tokens" is overly broad and can accidentally invoke the skill during ordinary conversation. In a skill that can lead users toward wallet-linked operations and transaction flows, ambiguous invocation increases the chance of unintended script execution, confusing prompts, or accidental progression toward sensitive actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/get-chains.sh (reported line 3)May include surrounding context.

sh

#!/bin/bash
# List supported chains from Relay Link API
curl -s "https://api.relay.link/chains" | jq '.chains[] | { name, id, displayName }'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/get-status.sh (reported line 29)May include surrounding context.

sh

#!/bin/bash
# List supported chains from Relay Link API
curl -s "https://api.relay.link/chains" | jq '.chains[] | { name, id, displayName }'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/get-status.sh (reported line 42)May include surrounding context.

sh

#!/bin/bash
# List supported chains from Relay Link API
curl -s "https://api.relay.link/chains" | jq '.chains[] | { name, id, displayName }'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/get-tokens.sh (reported line 5)May include surrounding context.

sh

#!/bin/bash
# List supported chains from Relay Link API
curl -s "https://api.relay.link/chains" | jq '.chains[] | { name, id, displayName }'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/quick-bridge.sh (reported line 137)May include surrounding context.

sh

#!/bin/bash
# List supported chains from Relay Link API
curl -s "https://api.relay.link/chains" | jq '.chains[] | { name, id, displayName }'

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script reads a private key and wallet addresses from a global user config file, giving the skill access to sensitive credentials beyond simple bridge quote generation. In this skill context, that access is especially dangerous because the same script later uses the key to sign and broadcast transactions, so installing or invoking the skill implicitly grants spending authority over the user's wallet.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script accesses a locally stored private key without an upfront warning that it will read wallet credentials from disk. In a bridge/swap skill, this is dangerous because the capability is coupled to transaction execution, meaning users may run the script expecting quote retrieval while unknowingly exposing or authorizing use of a highly sensitive signing secret.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/quick-bridge.sh (reported line 16)May include surrounding context.

sh

# Fallback to internal variables if not loaded (for better error messages)
USER_ADDR=${EVM_ADDRESS}
DEFAULT_RECIPIENT=${SOLANA_ADDRESS}
RPC_URL_AVAX="https://api.avax.network/ext/bc/C/rpc"

if [ -z "$USER_ADDR" ]; then echo "❌ Error: EVM_ADDRESS not found in $ENV_FILE"; exit 1; fi
if [ -z "$1" ] || [ -z "$2" ] || [ -z "$3" ]; then echo "Usage: $0 <amount> <origin_chain> <dest_chain>"; exit 1; fi

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/quick-bridge.sh (reported line 137)May include surrounding context.

sh

CONVERTED_AMOUNT=$(echo "$AMOUNT * 10^18" | bc | cut -d'.' -f1)

QUOTE=$(curl -s -X POST "https://api.relay.link/quote/v2" \
     -H "Content-Type: application/json" \
     -d "{
       \"user\": \"$USER_ADDR\",

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script reads a wallet address from a local config file and uses it for a broader account-history lookup when given a transaction hash. That exceeds a narrow 'status by ID/hash' function and introduces unnecessary access to user-specific data, which can expose wallet metadata and transaction associations to the remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sends the configured wallet address to Relay's API to enumerate request history, but the script comments and usage text do not clearly disclose that personal wallet metadata will be transmitted. This creates a privacy issue because users may expect a simple status check, not an account-history query tied to their address.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Exporting the private key into the process environment does not materially secure it; environment variables can be exposed to subprocesses, debugging tools, crash logs, or other local inspection mechanisms. The misleading comment may cause users or maintainers to underestimate the sensitivity of this handling, while the script is actively preparing to sign a value-bearing blockchain transaction.

Content

No source excerpt is available for this finding.