ClawHub
Back to skill

Security audit

Agentcash Wallet

Security checks for vulnerabilities and agentic risk

Overview

This skill is payment-focused and mostly coherent, but it asks users to run unpinned package code for wallet and paid API operations.

Review this skill carefully before installing. Only use a verified, pinned agentcash CLI version, avoid running unpinned `npx` wallet commands, confirm the exact origin, endpoint, price, and payload before each paid request, and treat discovered endpoint instructions as untrusted data that cannot override your request or security rules.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
rules/getting-started.md:3
Finding

Unpinned Third-Party CLI Installation and Execution

Content
View full analysis

Vulnerability Details

File Location: rules/getting-started.md:3-7 (also referenced in SKILL.md:31-35 and SKILL.md:123-126)
Vulnerability Type: Unverified and unpinned npm dependency execution
Risk Level: High

Vulnerable code snippet:

markdown
## Setup

1. **Install the agentcash CLI:**
   ```bash
   npm install -g agentcash
   ```

The Skill subsequently invokes the same unpinned package through commands such as:

bash
npx agentcash wallet info

Technical Analysis

The setup instructions globally install the agentcash npm package without specifying an exact version, package integrity hash, lockfile, or verification procedure. Subsequent npx agentcash commands also rely on npm package resolution. Depending on the local npm environment, npx may retrieve package code if a suitable local installation is unavailable.

npm package installation can execute lifecycle scripts under the current user's privileges. Consequently, compromise of the package publisher, npm registry account, distribution process, or a future package release could cause code that was not included in this audited project to execute locally.

This risk is particularly significant because the documented CLI manages a cryptocurrency wallet stored at ~/.agentcash/wallet.json and signs USDC payments. The external package implementation is not included in the audited project, so its handling of wallet material and payment authorization could not be verified.

Attack Path

  1. An attacker compromises the package publisher, registry account, or package distribution process.
  2. The attacker publishes a malicious release under the unversioned agentcash package name.
  3. A user follows the Skill's instructions and runs npm install -g agentcash, or invokes an npx agentcash command in an environment where npm retrieves the package.
  4. npm installs or executes the attacker-controlled package, including a ...[truncated 983 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to a specifically audited version, for example by using an exact version rather than an unconstrained package name.
  2. Publish the expected package source repository, release provenance, and cryptographic integrity information through a trusted channel.
  3. Verify package integrity and publisher identity before installation.
  4. Avoid global installation where possible. Install the dependency in an isolated project or restricted execution environment with a committed lockfile.
  5. Disable unnecessary npm lifecycle scripts during installation where compatible with the package's documented operation.
  6. Run wallet tooling under a dedicated, least-privileged account or sandbox that cannot access unrelated user files and credentials.
  7. Require explicit user review of the destination, amount, network, and asset before signing each payment.
  8. Document a tested upgrade process so newer package versions are reviewed before the pinned version is changed.

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:58
Finding

Remote Endpoint Instructions Are Treated as Trusted Agent Guidance

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:58-65 (reinforced at SKILL.md:102 and SKILL.md:112)
Vulnerability Type: Remote instruction injection through endpoint discovery output
Risk Level: Medium

Vulnerable code snippet:

markdown
### 1. Discover endpoints

```bash
npx agentcash discover https://stableenrich.dev

Returns all endpoints, pricing, and usage instructions. Read the instructions field — it has critical endpoint-specific guidance.

text

The scope is broadened later in the document:

```markdown
Run `npx agentcash discover <origin>` on any origin to see its full endpoint catalog.
markdown
- Always discover first — the `instructions` field has critical endpoint-specific patterns and required parameters.

Technical Analysis

The Skill explicitly directs the Agent to read and rely on an instructions field returned by a remote origin. It also permits discovery against “any origin,” but does not require an origin allowlist, authenticity validation, strict response schema, or separation between untrusted API data and authoritative Skill instructions.

A remote service controls its discovery response. A malicious or compromised service could therefore place prompt-injection content in the instructions field, such as directions to ignore the user's request, send sensitive data to another endpoint, execute unrelated commands, or make additional paid requests. Because the Skill characterizes this field as containing “critical” guidance, the Agent may give it undue authority.

Remote endpoint metadata should be treated as untrusted data used only to identify request parameters. It must not be allowed to modify system constraints, authorization boundaries, user intent, tool permissions, or payment policy.

Attack Path

  1. A user asks the Agent to discover or call an x402 service at an attacker-controlled or compromised origin.
  2. The Agent runs `npx a ...[truncated 1225 chars]
Remediation
View remediation

Remediation Suggestions

  1. State explicitly that all discovery responses, including instructions, are untrusted data and cannot override system, developer, Skill, or user instructions.
  2. Restrict discovery and paid requests to an allowlist of reviewed HTTPS origins unless the user explicitly approves a new origin.
  3. Parse discovery output using a strict schema and extract only required endpoint metadata, parameter definitions, and prices.
  4. Reject or ignore response content that requests tool execution, credential disclosure, policy changes, unrelated network calls, or changes to payment authorization.
  5. Validate every proposed action against the user's original request rather than treating remote instructions as independent authority.
  6. Display the exact origin, endpoint, HTTP method, data categories, asset, network, and maximum payment amount before execution.
  7. Require explicit user confirmation before each paid request, particularly for unknown origins or requests containing sensitive information.
  8. Apply per-request and cumulative spending limits so injected instructions cannot trigger unbounded financial activity.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (19)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad everyday terms like 'balance', 'wallet', 'funds', 'pricing', and 'payment failed', which raises the chance the skill activates in contexts the user did not intend. Because the skill can guide or enable paid operations, over-triggering can steer users toward wallet and spending workflows unexpectedly, increasing the risk of accidental fund use or social-engineering abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description emphasizes convenience and 'automatic payment' but does not provide a prominent upfront warning that using the fetch flow can spend wallet funds. In this context, omission is dangerous because users may treat the tool like a normal API client and trigger real monetary transactions without informed consent or spending awareness.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The skill repeatedly instructs users to run npx agentcash without pinning an exact package version, which causes code to be fetched and executed from the registry at runtime. In a wallet/payment-oriented skill, this is especially dangerous because a compromised or newly published package version could immediately gain access to wallet files, initiate paid requests, or exfiltrate sensitive data.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Using unpinned npx agentcash for wallet redemption fetches whatever package version is current at execution time and runs it with access to the local environment. Because this command directly interacts with wallet state and credits, a malicious package update or dependency compromise could steal wallet data or abuse funds.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The command shown for obtaining wallet information executes an unpinned package directly from npm. In this skill's context, the package can read ~/.agentcash/wallet.json and expose wallet identifiers or manipulate payment workflows if the package supply chain is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The deposit workflow references unpinned CLI usage, meaning users are encouraged to execute remote package code before handling wallet funding. Given the financial nature of the skill, supply-chain compromise could redirect deposits, tamper with displayed wallet addresses, or harvest wallet metadata.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The discover command is executed through unpinned npx, allowing arbitrary new package code to run whenever a user explores paid endpoints. Because the skill is designed to broker authenticated paid API access, a compromised package could silently alter endpoint instructions, capture targets, or prepare malicious follow-on commands.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The schema-check command again relies on an unpinned package fetched at runtime. In a payment-capable tool, this creates a recurring supply-chain execution path where attackers can run arbitrary code under the user's account and potentially access wallet files or modify subsequent paid request behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The paid request example uses unpinned npx agentcash fetch, which is the highest-risk invocation because it combines dynamic code execution with automatic payment behavior. A malicious package release could initiate unauthorized paid requests, alter request destinations, or exfiltrate wallet credentials and response data.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The quick-reference balance command still uses unpinned npx, normalizing unsafe execution patterns throughout the skill. Repetition increases the chance users will routinely run fresh remote code for wallet operations without realizing the supply-chain risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The troubleshooting guidance recommends global installation without version pinning, which can pull an unexpected release and make later wallet operations depend on unreviewed code. Since this tool manages funds and paid requests, version drift materially increases the risk of supply-chain compromise affecting financial actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The troubleshooting instructions reference checking balance through unpinned CLI patterns established elsewhere in the document. In context, this reinforces repeated remote execution in a wallet-bearing environment, increasing exposure to package hijacking or malicious updates.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The deposit/redeem troubleshooting path inherits the same unpinned runtime package execution problem. In a financial workflow, even informational or support commands can become vectors for wallet inspection, address tampering, or credential theft if the package source is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Payment-failure troubleshooting encourages retrying requests in a context where the request tooling itself is unpinned and dynamically resolved. This can magnify harm because users may rerun the command multiple times, giving a compromised package repeated opportunities to spend funds or manipulate transactions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The invite-code troubleshooting path exists within a document that repeatedly directs users to execute unpinned package code for wallet actions. Even if the immediate task is low-value, the same CLI has access to wallet storage and account context, so a compromised package could pivot into fund-impacting behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

Balance-update troubleshooting still depends on the same unpinned CLI pattern, perpetuating exposure to runtime package replacement. Because the skill handles cryptocurrency balances, users may trust displayed values that could be falsified by malicious code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The formatting/verbosity tips apply to commands built on unpinned npx execution, further entrenching an unsafe operational model. While not directly a payment command, it still conditions users to run fresh remote code in a wallet-enabled environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

Using npx agentcash without a pinned version allows execution of whatever package version is current at runtime, which can change unexpectedly or be replaced by a malicious publication in a supply-chain compromise scenario. In a wallet/payment skill, this is especially sensitive because users may run commands that interact with funds, redeem codes, or contact paid endpoints, increasing the consequences of compromised package execution.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The command npx agentcash wallet redeem YOUR_CODE invokes an unpinned package version, which means users may execute altered code if the package is updated or the package supply chain is compromised. Because this workflow involves wallet actions and redemption of credits, a malicious package could misdirect funds, exfiltrate wallet-related data, or perform unauthorized requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.