Raven NGN Transfers

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:04 PM UTC
• Version: 1.1.0

Overview

The skill appears built for Raven payouts, but it can send the Raven API key and transfer details to any endpoint configured through an environment variable.

Review this before installing in any environment that can move real money. Use a restricted Raven API key if available, do not set RAVEN_API_BASE unless you fully control and trust the endpoint, keep the key in a locked-down secret source, and require human review for every confirmed transfer.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/raven-transfer.mjs:9

Finding

Unrestricted API Base Override Can Exfiltrate Credentials and Financial Data

Content

View full analysis

controller.abort(), timeoutMs); try { const response = await fetchImpl(`${API_BASE}${path}`, { method, headers: { Authorization: `Bearer ${getApiKey()}`, "Content-Type": "application/json", }, ...(body ? { body: JSON.stringify(body) } : {}), signal: controller.signal, }); const data = await response.json().catch(() => ({})); ``` The live-contract tests repeat this trust model in `tests/contract-live.test.mjs:6-25`: ```js const apiBase = process.env.RAVEN_API_BASE || "https://integrations.getravenbank.com/v1"; const runLive = process.env.RAVEN_CONTRACT_TESTS === "1"; const apiKey = (() => { try { return resolveApiKey(process.env); } catch { return null; } })(); async function ravenLive(method, path, body) { const response = await fetch(`${apiBase}${path}`, { method, headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json", }, ...(body ? { body: JSON.stringify(body) } : {}), }); const data = await response.json().catch(() => ({})); return { response, d ...[truncated 3148 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

- `scripts/raven-transfer.mjs` (transfer CLI implementation)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

- `scripts/raven-transfer.mjs` (transfer CLI implementation)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

md

- Node.js 18+
- One auth source in your environment:
  - `RAVEN_API_KEY_FILE` (preferred, points to a `chmod 600` or `chmod 400` file)
  - `RAVEN_API_KEY`

Optional environment variables:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

- Node.js 18+
- One auth source in your environment:
  - `RAVEN_API_KEY_FILE` (preferred, points to a `chmod 600` or `chmod 400` file)
  - `RAVEN_API_KEY`

Optional environment variables:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 49)May include surrounding context.

md

- Node.js 18+
- One auth source in your environment:
  - `RAVEN_API_KEY_FILE` (preferred, points to a `chmod 600` or `chmod 400` file)
  - `RAVEN_API_KEY`

Optional environment variables:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/raven-transfer.mjs (reported line 125)May include surrounding context.

js

- Node.js 18+
- One auth source in your environment:
  - `RAVEN_API_KEY_FILE` (preferred, points to a `chmod 600` or `chmod 400` file)
  - `RAVEN_API_KEY`

Optional environment variables:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

md

- Node.js 18+
- One auth source in your environment:
  - `RAVEN_API_KEY_FILE` (preferred, points to a `chmod 600` or `chmod 400` file)
  - `RAVEN_API_KEY`

Optional environment variables:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

- Node.js 18+
- One auth source in your environment:
  - `RAVEN_API_KEY_FILE` (preferred, points to a `chmod 600` or `chmod 400` file)
  - `RAVEN_API_KEY`

Optional environment variables:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 49)May include surrounding context.

md

- Node.js 18+
- One auth source in your environment:
  - `RAVEN_API_KEY_FILE` (preferred, points to a `chmod 600` or `chmod 400` file)
  - `RAVEN_API_KEY`

Optional environment variables:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes a local Node.js script and explicitly relies on shell execution and environment-based secrets, but the manifest does not declare any tool restrictions such as permissions or allowed-tools. In an agent runtime, that omission broadens the effective capability surface and can let the skill run with more authority than reviewers or policy expect, increasing the risk of unauthorized command execution or secret access.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

5. Execute transfer exactly once with `--confirm="CONFIRM TXN_..."`.
6. Report normalized result fields (`available_balance`, `fee`, `total_debit`, `status`, `raw_status`).

Do not skip confirmation token checks. Do not auto-retry transfer submission.
Failed transfer note: yes, a failed Raven transfer is typically auto-reversed/refunded after a few minutes; wait, then re-check `transfer-status` and wallet balance before any retry.

## Required environment

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 45)May include surrounding context.

bash

mkdir -p "$HOME/.config/raven"
security find-generic-password -a "$USER" -s "raven-api-key" -w > "$HOME/.config/raven/raven_api_key"
chmod 600 "$HOME/.config/raven/raven_api_key"
export RAVEN_API_KEY_FILE="$HOME/.config/raven/raven_api_key"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 31)May include surrounding context.

bash

mkdir -p "$HOME/.config/raven"
security find-generic-password -a "$USER" -s "raven-api-key" -w > "$HOME/.config/raven/raven_api_key"
chmod 600 "$HOME/.config/raven/raven_api_key"
export RAVEN_API_KEY_FILE="$HOME/.config/raven/raven_api_key"