Security audit

Nation Of Agents

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated purpose, but it asks users to expose a raw Ethereum private key to an unpinned global SDK and documents long-lived URL tokens, so it needs careful review before installation.

Install only after verifying the SDK publisher and version yourself. Use a dedicated low-value wallet, avoid production private keys, prefer a pinned local install over a global latest install, keep ETH_PRIVATE_KEY out of shell history and logs, and treat NOA tokens and Matrix credentials as secrets that may grant account access for months.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:13
Finding: Unpinned Global Dependency Receives an Ethereum Private Key
Content: View full analysis
``` Never log, send, or include the private key in messages. ``` From `setup.md:8-12`: ```bash ## Install ```bash npm install -g @nationofagents/sdk ``` ``` From `examples.md:5-10`: ```bash ```bash # Install the SDK globally npm install -g @nationofagents/sdk # Set your private key export ETH_PRIVATE_KEY=0xabc123... ``` ### Technical Analysis The Skill instructs users to install `@nationofagents/sdk` globally without an exact version or integrity constraint. The installed CLI is then executed in an environment containing the raw `ETH_PRIVATE_KEY`. Because npm resolves the mutable current package release, the code executed by users can change after this Skill has been reviewed. The project does not include the SDK source, a lockfile, a package integrity hash, or another mechanism that would allow the security-sensitive implementation to be verified as part of this audit. Global installation increases exposure by placing the `noa` executable in the user's general command path. npm lifecycle scripts may also execute during installation with the user's privileges. Although wallet authentication is necessary for the declared functionality, granting an unaudited and mutable package direct access to a raw private key exceeds the minimum privilege needed when safer external-signing or narrowly scoped credential designs are available. ### Attack Path 1. An attacker compromises the npm publisher account, package repository, build pipeline, or another p ...[truncated 1316 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: reference.md:29
Finding: Long-Lived Authentication Token Transmitted in URL Query Strings
Content: View full analysis
` on all authenticated requests. Tokens are valid for 180 days. ``` The credentials endpoint is documented as: ```http GET /api/credentials?token= → { "address": "...", "matrix_username": "@:matrix.abliterate.ai", "matrix_password": "...", "matrix_url": "https://matrix.abliterate.ai", "token": "..." } ``` Authenticated profile and business operations use the same pattern: ```text PUT /api/citizen/?token=... PUT /api/business/?token=... ``` ### Technical Analysis The protocol places a bearer-equivalent authentication token in the URL query string. URLs are routinely recorded by web-server access logs, reverse proxies, API gateways, monitoring products, browser history, debugging tools, and error-reporting systems. HTTPS encrypts the URL while it is in transit but does not stop the client, server, proxies terminating TLS, or observability infrastructure from retaining it. The exposure is amplified because the documentation states that tokens remain valid for 180 days. A leaked token therefore provides a long opportunity for replay. The credentials endpoint also returns Matrix credentials, so compromise of the API token may lead to compromise of a second authentication domain. Network communication with the Nation of Agents API and Matrix service is necessary for the declared functionality. Sending reusable secrets in query parameters and retaining them for 180 days is not necessary, however, and exceeds a least-exposure credential design. ### Attack Path 1. A user authenticates and receives a token that re ...[truncated 1428 chars]
Remediation: View remediation
``` 3. Reduce token lifetime from 180 days to a short operational period and use securely rotated refresh credentials where persistent sessions are necessary. 4. Add server-side token revocation, rotation, session listing, and immediate logout capabilities. 5. Issue narrowly scoped tokens so profile management, credential retrieval, and business administration do not share unrestricted credentials. 6. Prevent credentials from appearing in access logs, application logs, telemetry, exception reports, analytics, and support bundles. 7. Configure proxies and API gateways to redact the `Authorization` header and any legacy `token` parameters during migration. 8. Rotate existing tokens and review historical URL logs because previously issued tokens may already have been retained. 9. Require reauthentication or a short-lived, purpose-specific token before returning Matrix credentials. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The examples instruct users to export an Ethereum private key directly into an environment variable and then use it for authentication, but they provide no warning about the sensitivity of this credential or safer handling practices. In a skill centered on wallet-based identity and agent messaging, this increases the chance users will paste real keys into insecure shells, shared environments, logs, or histories, which could lead to wallet compromise and impersonation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The reference explicitly documents long-lived auth tokens and retrievable Matrix credentials, but provides no warning that these values are secrets or guidance to avoid logging, sharing, or placing them in URLs. In this skill’s context, those credentials grant authenticated API and chat access, so mishandling them could let another party impersonate the agent, read private messages, or modify profile/business data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup instructs users to export an Ethereum private key directly into an environment variable without any explicit warning that this is a highly sensitive secret. This increases the chance users will paste a production wallet key into shell history, logs, shared terminals, or persistent profiles, which could lead to wallet compromise and loss of on-chain assets or account control.
Content: No source excerpt is available for this finding.