Goldrush CLI

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:19 PM UTC
• Version: 3.0.5

Overview

The skill is a coherent GoldRush CLI guide, but it asks users to run an unpinned remote npm package and set up persistent Claude MCP integration without enough scoping or rollback detail.

Review the GoldRush CLI package and use a pinned version before running the `npx` commands. Only run `goldrush auth` if you are comfortable storing the API key in your OS keychain, and only run `goldrush install` after understanding what Claude MCP configuration it changes and how to remove it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party npm Package Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20; additional occurrences in references/overview.md:6, references/overview.md:19, and references/overview.md:93
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:18-20:

bash

# Install and authenticate
npx @covalenthq/goldrush-cli auth

references/overview.md:6:

markdown

| **Install** | `npx @covalenthq/goldrush-cli` |

references/overview.md:18-20:

bash

npx @covalenthq/goldrush-cli

references/overview.md:91-95:

bash

npx @covalenthq/goldrush-cli auth

Technical Analysis

The documentation directs users to invoke npx with a package name but without an exact version or verified integrity value. If the package is not already available locally, npx can retrieve the version currently selected by the npm registry and execute its code with the invoking user's privileges.

Because the executable package is not included in the audited project, its implementation and future releases cannot be verified by this audit. The effective code can change after the skill has been reviewed. This is particularly sensitive because the documented workflow subsequently asks the package to:

• Accept and store a GoldRush API key through goldrush auth.
• Modify Claude MCP configuration through goldrush install.
• Establish network connections for blockchain queries and streaming.
• Read or update application settings through configuration commands.

There is no evidence in the audited files that the current npm package is malicious. The vulnerability is the mutable, unverified dependency execution path and its exposure to package-account compromise, registry compromise, or an unexpectedly unsafe future release.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or another component of the pack ...[truncated 1524 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a reviewed, immutable version in every command:

   bash

   npx @covalenthq/goldrush-cli@<reviewed-exact-version> auth
   

2. Verify the selected release's npm integrity metadata, provenance, publisher identity, and source repository before recommending execution.
3. Prefer a lockfile-controlled installation or a vendored and reviewed executable where practical. Preserve and verify cryptographic integrity information in the distribution process.
4. Audit package installation hooks, runtime network behavior, credential handling, and MCP configuration changes for the pinned release.
5. Document every file and configuration entry modified by goldrush install, and require explicit user approval before MCP registration.
6. Run the CLI with least privilege. Do not recommend elevated shells, and isolate execution when processing sensitive credentials.
7. Add release-update procedures requiring security review before changing the pinned version.
8. Ensure API keys are entered through a secure prompt, stored only in the operating-system keychain, redacted from logs, and never exposed through command-line arguments or diagnostic output.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The manifest metadata references npx @covalenthq/goldrush-cli without a version pin, which can propagate unsafe copy-paste usage into downstream tooling or skill-selection interfaces. While metadata alone is less directly executable than the Quick Start command, it still normalizes unpinned remote execution for an MCP-capable tool.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill directs users to run npx @covalenthq/goldrush-cli without pinning an exact package version, which causes execution of whatever version is current at invocation time. Because this skill also promotes MCP/tool-provider setup, an unexpected upstream package update or package compromise could lead to unreviewed code execution and persistent agent-tool integration changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation guidance is very broad, covering generic blockchain tasks like checking balances, gas prices, token search, and MCP integration. Overly broad routing can cause an agent to invoke this skill in many routine contexts, increasing exposure to its install/auth flows and external tool usage even when simpler, lower-risk approaches would suffice.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The Quick Start section instructs users to execute the CLI via npx without an exact version pin, exposing them to supply-chain risk from newly published or compromised package versions. In this context the risk is amplified because the command is presented as an install/authentication entry point, encouraging immediate execution of remote code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill states that goldrush install registers GoldRush as a tool provider for Claude, but it does not clearly warn that this modifies local MCP/tool configuration. Configuration-changing actions are sensitive because they can persist beyond the current session, expand tool access for the agent, and alter the user's trust boundary without sufficiently explicit informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The documentation instructs users to execute an unpinned package via npx, which fetches the latest published code at runtime. If the package is compromised, a malicious version is published, or the publisher account is taken over, users and agent environments may execute attacker-controlled code with local user privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This is another instance of instructing execution of an unpinned npm package directly from the registry. In the context of an MCP-capable CLI that can register as a tool provider for Claude, supply-chain compromise could turn a simple install step into arbitrary code execution and unsafe tool exposure to the agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The markdown describes continuous monitoring of specific wallets and real-time streaming of swaps, transfers, and deposits, which can affect privacy expectations and may involve tracking identifiable wallet activity. The document presents this as a core use case but does not include any warning or caution about handling monitored wallet data responsibly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Running npx without a version pin causes the environment to trust whatever package version is current at execution time. Because this skill is specifically promoting local CLI setup and MCP integration, a compromised release could gain execution on the host and potentially influence downstream agent tooling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.