Security audit

xrp-fleet-data

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent, but it asks an agent to sign XRP payments while its advertised spend limits do not clearly cap the transaction fee that can be signed.

Install only with a dedicated low-balance hot wallet, use NO_PAY first, and do not rely on the stated daily budget as a complete loss limit unless the client is updated to cap and audit the XRPL transaction fee. Review the dependency versions and the WS_URL endpoint before signing payments.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/guarded-buy.cjs
Finding: Untrusted XRPL endpoint can inflate the signed transaction fee beyond all spending limits
Content: View full analysis
Attacker control point

The remote WebSocket service influences autofilled transaction fields, including Fee.

Impact

A hostile endpoint can cause the wallet to authorize an excessive XRP transaction fee. MAX_DROPS and DAILY_BUDGET_DROPS only cover Amount, and recordSpend records only gated.drops, so the advertised per-request and daily limits do not constrain this loss.

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill describes and encourages network access and use of sensitive environment material such as XRPL wallet seeds, but it does not declare an explicit tool scope or permissions boundary. In an agent ecosystem, missing scope metadata can cause the runner to grant broader capabilities by default or leave operators unaware that the skill may initiate paid network actions and consume secrets from the environment.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/guarded-buy.cjs:42