ClawHub
Back to skill

Security audit

Safeflow Sui Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it can execute blockchain payments and stores payment-enabling identifiers, so it needs careful review before use.

Install only if you intend to let this skill operate a SafeFlow/Sui test payment workflow. Use a dedicated testnet wallet with limited funds, review the exact recipient and amount before every run, avoid passing API keys to untrusted URLs, pin the tsx dependency locally before using npx-based flows, and treat saved wallet/session capability files as sensitive operational data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/test_publish_api_flow.sh:114
Finding

Unpinned Implicit npm Package Retrieval and Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: scripts/test_publish_api_flow.sh, lines 114-115, 140-165, and 181-192
Vulnerability Type: Unsafe dependency resolution and execution
Risk Level: Medium

Vulnerable Code

bash
if ! command -v npx >/dev/null 2>&1; then
    error "npx not found."
    exit 1
fi
bash
if [[ -n "$API_KEY" ]]; then
    CREATE_OUTPUT="$(
        cd "$AGENT_SCRIPTS_DIR"
        PRODUCER_API_BASE_URL="$BASE" PRODUCER_API_KEY="$API_KEY" \
        npx tsx create_intent.ts \
            --agent-address "$AGENT_ADDRESS" \
            --wallet-id "$WALLET_ID" \
            --session-cap-id "$SESSION_CAP_ID" \
            --recipient "$RECIPIENT" \
            --amount-mist "$AMOUNT_MIST" \
            --reason "$REASON" \
            --ttl-sec "$TTL_SEC" \
            --order-id "$ORDER_ID"
    )"
else
    CREATE_OUTPUT="$(
        cd "$AGENT_SCRIPTS_DIR"
        PRODUCER_API_BASE_URL="$BASE" \
        npx tsx create_intent.ts \
            --agent-address "$AGENT_ADDRESS" \
            --wallet-id "$WALLET_ID" \
            --session-cap-id "$SESSION_CAP_ID" \
            --recipient "$RECIPIENT" \
            --amount-mist "$AMOUNT_MIST" \
            --reason "$REASON" \
            --ttl-sec "$TTL_SEC" \
            --order-id "$ORDER_ID"
    )"
fi
bash
if [[ -n "$API_KEY" ]]; then
    (
        cd "$AGENT_SCRIPTS_DIR"
        PRODUCER_API_BASE_URL="$BASE" PRODUCER_API_KEY="$API_KEY" \
        npx tsx e2e_runner.ts --once --poll-ms "$POLL_MS"
    )
else
    (
        cd "$AGENT_SCRIPTS_DIR"
        PRODUCER_API_BASE_URL="$BASE" \
        npx tsx e2e_runner.ts --once --poll-ms "$POLL_MS"
    )
fi

Technical Analysis

The script invokes npx tsx without requiring a locally installed, reviewed version of tsx. By default, npx can retrieve a missing package from the configured npm registry and ...[truncated 1652 chars]

Remediation
View remediation

Remediation Suggestions

  1. Add a package manifest and lockfile that pin an explicitly reviewed tsx version.

  2. Install dependencies in a separate controlled step using a lockfile-enforcing command such as npm ci.

  3. Invoke the local binary directly, for example:

    bash
    "$REPO_ROOT/node_modules/.bin/tsx" create_intent.ts

  4. Alternatively, use npx --no-install tsx so execution fails rather than downloading an absent package.

  5. Enforce dependency integrity and provenance checks in CI.

  6. Run the test harness in a restricted environment with only the minimum required files and environment variables.

  7. Avoid exposing the API key to dependency tooling unnecessarily; provide it only to the reviewed application process after dependency resolution is complete.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/test_publish_api_flow.sh:65
Finding

Unrestricted User-Supplied API Endpoint in a Credential-Associated Workflow

Content
View full analysis

Vulnerability Details

File Location: scripts/test_publish_api_flow.sh, lines 65, 135-144, 181-195
Vulnerability Type: Unvalidated outbound request destination and insecure credential trust boundary
Risk Level: Medium

Vulnerable Code

bash
--publish-api-base-url) PUBLISH_API_BASE_URL="${2:-}"; shift 2 ;;
bash
BASE="${PUBLISH_API_BASE_URL%/}"

info "Checking Publish API health..."
curl -fsS "$BASE/health" | jq .

if [[ -n "$API_KEY" ]]; then
    CREATE_OUTPUT="$(
        cd "$AGENT_SCRIPTS_DIR"
        PRODUCER_API_BASE_URL="$BASE" PRODUCER_API_KEY="$API_KEY" \
        npx tsx create_intent.ts \
bash
info "Running one-shot consumer (e2e_runner.ts --once)..."
if [[ -n "$API_KEY" ]]; then
    (
        cd "$AGENT_SCRIPTS_DIR"
        PRODUCER_API_BASE_URL="$BASE" PRODUCER_API_KEY="$API_KEY" \
        npx tsx e2e_runner.ts --once --poll-ms "$POLL_MS"
    )
else
    (
        cd "$AGENT_SCRIPTS_DIR"
        PRODUCER_API_BASE_URL="$BASE" \
        npx tsx e2e_runner.ts --once --poll-ms "$POLL_MS"
    )
fi

FINAL_JSON="$(curl -fsS "$BASE/v1/intents/$INTENT_ID")"

Technical Analysis

PUBLISH_API_BASE_URL is accepted without validating its scheme, hostname, port, resolved address, or trust relationship. The value is used directly by curl and passed to external runner scripts as PRODUCER_API_BASE_URL. The script permits plain HTTP, loopback addresses, link-local addresses, private network destinations, and attacker-controlled public hosts.

When an API key is supplied, it is passed alongside the untrusted base URL to create_intent.ts and e2e_runner.ts. Those TypeScript files are outside the audited artifact, so this audit cannot assert that they transmit the key. However, the documented purpose of PRODUCER_API_KEY is API authentication, making an unrestricted destination a concrete credential-boundary risk.

Direct requests from this shel ...[truncated 1911 chars]

Remediation
View remediation

Remediation Suggestions

  1. Parse the URL with a dedicated URL parser rather than relying on string concatenation.
  2. Require HTTPS except for an explicit, opt-in local development mode.
  3. Reject URLs containing user-information components, unsupported schemes, fragments, or unexpected ports.
  4. Restrict credential-bearing requests to a configured hostname allowlist.
  5. Resolve the hostname and reject loopback, link-local, multicast, unspecified, and private address ranges unless explicitly authorized.
  6. Defend against DNS rebinding by validating resolved addresses at connection time.
  7. Disable redirects with --max-redirs 0, or validate every redirect destination before following it.
  8. Use curl connection and total timeouts to limit access to unresponsive destinations.
  9. Bind each API key to an expected endpoint and refuse to run when the supplied endpoint does not match.
  10. Review create_intent.ts and e2e_runner.ts to verify that credentials are only sent to the validated origin and are removed on cross-origin redirects.
  11. Prefer reading API keys from a protected file descriptor or secret manager instead of command-line arguments, which may be retained in shell history.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill description frames the workflow as setup and owner-assisted provisioning, but the documented behavior includes executing live blockchain payments using stored wallet and session capability identifiers. This mismatch can mislead operators or automated policy systems into approving a skill that is capable of transferring value, which materially raises the risk of unauthorized or insufficiently reviewed payment execution.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill description frames the workflow as setup and owner-assisted provisioning, but the documented behavior includes executing live blockchain payments using stored wallet and session capability identifiers. This mismatch can mislead operators or automated policy systems into approving a skill that is capable of transferring value, which materially raises the risk of unauthorized or insufficiently reviewed payment execution.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises operational workflows that invoke shell scripts and likely MCP-backed capabilities, but it does not declare any explicit tool restrictions such as allowed-tools or permissions. That makes the skill's effective authority ambiguous and increases the chance that an agent can execute filesystem, network, or command operations beyond what a reviewer expects.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The troubleshooting guide instructs users to run npx tsx create_intent.ts without pinning a specific package version. npx may resolve and execute a package version from the registry at runtime, which creates a supply-chain risk if a newer malicious or compromised tsx release is fetched or if local expectations about the tool version differ. In this skill context, the command is part of an operational workflow for blockchain/payment-related actions, which makes unexpected code execution more sensitive than in a low-privilege demo environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/setup.sh (reported line 103)May include surrounding context.

sh
info "Balance low, requesting from faucet..."
        sui client faucet --address "$USER_ADDRESS" || {
            warn "Faucet command failed. Trying HTTP faucet..."
            curl -sf -X POST https://faucet.testnet.sui.io/v1/gas \
                -H 'Content-Type: application/json' \
                -d "{\"FixedAmountRequest\":{\"recipient\":\"$USER_ADDRESS\"}}" > /dev/null || {
                error "Faucet request failed."

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This shell script performs a network-capable database operation when the postgres driver is selected, but there is no explicit warning, confirmation prompt, or descriptive comment disclosing that it will connect to a remote Postgres instance and write data. Although the script logs success afterward, that does not warn the user before transmitting data to the target database.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/test_publish_api_flow.sh (reported line 104)May include surrounding context.

sh
exit 1
fi

if ! command -v curl >/dev/null 2>&1; then
    error "curl not found."
    exit 1
fi

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script creates a real payment intent and then runs a consumer to process it, but it does not present an explicit high-visibility confirmation or safety warning immediately before performing the side effect. In this skill context, that increases the chance of accidental blockchain/payment actions by an operator who may interpret the script as a harmless test.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The script executes npx tsx create_intent.ts without pinning tsx to a specific version or ensuring a local project-pinned binary is used. In environments where tsx is not already installed locally, npx may fetch and execute code at runtime, creating a supply-chain risk and reducing build reproducibility.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

This is another execution of npx tsx create_intent.ts on a separate branch, again allowing unpinned runtime resolution of tsx. Because this script creates payment intents, executing an unexpected package version could affect transaction construction or exfiltrate sensitive identifiers.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The script runs npx tsx e2e_runner.ts --once without pinning or restricting package installation. If tsx is resolved remotely or unexpectedly upgraded, arbitrary code execution in the operator environment is possible through the JavaScript toolchain.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

This branch repeats the same unpinned npx tsx e2e_runner.ts pattern. In a skill that handles wallet/session identifiers and triggers transaction flows, supply-chain compromise of a transient package runner is materially risky.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This shell script writes .agent-address.txt and .safeflow-config.json to disk, storing blockchain addresses and wallet/session capability identifiers. Although the file writes are visible in code, there is no upfront user-facing warning in the usage header or comments that setup will persist this information locally.

Content

No source excerpt is available for this finding.