Security audit

AOTrust — PDR Notarization

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly disclosed notarization workflow that sends artifact hashes to an external paid service only for user-requested proof creation.

Install only if you are comfortable with artifact hashes, verification identifiers, and payment metadata being sent to AOTrust and becoming publicly verifiable. Do not notarize sensitive low-entropy content where a public hash could reveal existence, and approve every wallet/payment action manually.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

External Transmission

Medium

Category: Data Exfiltration
Content: metadata: author: aotrust version: "3.8.0" mcp-endpoint: https://api.aotrust.link/mcp http-endpoint: https://api.aotrust.link/notarize verification-endpoint: https://api.aotrust.link/v1/pdr/verify near-handle: aotrust
Confidence: 95% confidence
Finding: The skill is explicitly configured to send data to an external service at api.aotrust.link, including a work hash and potentially optional agent signature metadata. Although the document clearly discloses this behavior and limits transmission to hashes rather than raw artifacts, it still creates a real data egress boundary and irreversible public disclosure of artifact-derived metadata.

External Transmission

Medium

Category: Data Exfiltration
Content: author: aotrust version: "3.8.0" mcp-endpoint: https://api.aotrust.link/mcp http-endpoint: https://api.aotrust.link/notarize verification-endpoint: https://api.aotrust.link/v1/pdr/verify near-handle: aotrust ---
Confidence: 95% confidence
Finding: This endpoint definition enables outbound transmission to a third-party notarization API. Even if only a SHA-256 hash is transmitted, hashes of sensitive or low-entropy artifacts can still leak correlation or existence information, and the resulting record is intended to be immutable/publicly verifiable.

External Transmission

Medium

Category: Data Exfiltration
Content: version: "3.8.0" mcp-endpoint: https://api.aotrust.link/mcp http-endpoint: https://api.aotrust.link/notarize verification-endpoint: https://api.aotrust.link/v1/pdr/verify near-handle: aotrust ---
Confidence: 93% confidence
Finding: The verification endpoint is another external transmission surface because submitted job IDs or PDR values are sent to a remote service for validation. While lower risk than sending original artifact content, it still reveals user interaction metadata and may disclose that a particular proof is being checked.

External Transmission

Medium

Category: Data Exfiltration
Content: OAuth 2.1 with PKCE (S256). Discovery: - Resource: `https://api.aotrust.link/.well-known/oauth-protected-resource/mcp` - Authorization server: `https://api.aotrust.link/.well-known/oauth-authorization-server` - Register client: `POST https://api.aotrust.link/oauth/register` - Authorize: `GET https://api.aotrust.link/oauth/authorize`
Confidence: 91% confidence
Finding: The OAuth resource discovery URL introduces a third-party authentication and metadata exchange with the remote provider. This expands the trust boundary beyond simple API use and can expose client, session, or account linkage information to the external service.

External Transmission

Medium

Category: Data Exfiltration
Content: OAuth 2.1 with PKCE (S256). Discovery: - Resource: `https://api.aotrust.link/.well-known/oauth-protected-resource/mcp` - Authorization server: `https://api.aotrust.link/.well-known/oauth-authorization-server` - Register client: `POST https://api.aotrust.link/oauth/register` - Authorize: `GET https://api.aotrust.link/oauth/authorize` - Token: `POST https://api.aotrust.link/oauth/token`
Confidence: 91% confidence
Finding: The authorization server endpoint represents a real external communication channel for identity and consent flow data. If triggered without strong user awareness, it could leak account linkage and authorization metadata to the service operator.

External Transmission

Medium

Category: Data Exfiltration
Content: - Resource: `https://api.aotrust.link/.well-known/oauth-protected-resource/mcp` - Authorization server: `https://api.aotrust.link/.well-known/oauth-authorization-server` - Register client: `POST https://api.aotrust.link/oauth/register` - Authorize: `GET https://api.aotrust.link/oauth/authorize` - Token: `POST https://api.aotrust.link/oauth/token`
Confidence: 90% confidence
Finding: Dynamic client registration sends information about the calling client/application to a third-party service and creates an external trust relationship. That is not inherently malicious, but it is a genuine external exposure point and broadens the attack surface through token and client management.

External Transmission

Medium

Category: Data Exfiltration
Content: - Resource: `https://api.aotrust.link/.well-known/oauth-protected-resource/mcp` - Authorization server: `https://api.aotrust.link/.well-known/oauth-authorization-server` - Register client: `POST https://api.aotrust.link/oauth/register` - Authorize: `GET https://api.aotrust.link/oauth/authorize` - Token: `POST https://api.aotrust.link/oauth/token` ### Available Tools (5)
Confidence: 90% confidence
Finding: The authorization endpoint is part of an external OAuth flow that can disclose user identity, agent-client identity, and consent decisions to the service. In a skill context, this is a meaningful security boundary because invoking the flow may happen inside a broader automation environment.

External Transmission

Medium

Category: Data Exfiltration
Content: - Authorization server: `https://api.aotrust.link/.well-known/oauth-authorization-server` - Register client: `POST https://api.aotrust.link/oauth/register` - Authorize: `GET https://api.aotrust.link/oauth/authorize` - Token: `POST https://api.aotrust.link/oauth/token` ### Available Tools (5)
Confidence: 90% confidence
Finding: The token endpoint involves exchanging authorization artifacts for access tokens with the external provider. This is a real security-sensitive transmission because compromised or over-scoped tokens could enable further unauthorized API use or metadata access.

External Transmission

Medium

Category: Data Exfiltration
Content: x402 payment requires HTTP calls — MCP tool calls alone cannot complete the flow: 1. **MCP:** Call `notary_quote` with `work_hash` (see "Step 1: Compute the Work Hash" below) → get price ($0.01 USDC) and quote details 2. **HTTP:** POST to `https://api.aotrust.link/notarize` with `{"work_hash": "..."}` → get 402 payment requirements (see Step 2 below for format) 3. **HTTP:** Sign EIP-3009 `transferWithAuthorization` with your Ethereum key, then POST to `https://api.aotrust.link/notarize` again with `x-payment` header → get 200 + PDR (see Step 3 below for format) 4. **MCP:** Call `notary_verify` with the `job_id` from step 3 → confirm `anchored`
Confidence: 97% confidence
Finding: This step directs the agent/user to POST the work_hash to an external paid notarization API, which is a true data egress event and part of an irreversible commercial transaction flow. The context makes it more sensitive because the API call is coupled to payment and public proof generation, so accidental or unauthorized invocation can cause both privacy leakage and financial loss.

External Transmission

Medium

Category: Data Exfiltration
Content: 1. **MCP:** Call `notary_quote` with `work_hash` (see "Step 1: Compute the Work Hash" below) → get price ($0.01 USDC) and quote details 2. **HTTP:** POST to `https://api.aotrust.link/notarize` with `{"work_hash": "..."}` → get 402 payment requirements (see Step 2 below for format) 3. **HTTP:** Sign EIP-3009 `transferWithAuthorization` with your Ethereum key, then POST to `https://api.aotrust.link/notarize` again with `x-payment` header → get 200 + PDR (see Step 3 below for format) 4. **MCP:** Call `notary_verify` with the `job_id` from step 3 → confirm `anchored` > **Note:** `notary_notarize_paid` appears in `tools/list` for discovery but cannot be called via MCP — x402 payment headers are not supported in MCP tool calls. Use HTTP POST `/notarize` for the actual payment step.
Confidence: 98% confidence
Finding: This step combines an external transmission with wallet-based payment authorization, including an x-payment header carrying a signed authorization for on-chain settlement. Even though the document warns against unattended wallets, this is security-critical because misuse could trigger irreversible blockchain payments and disclose proof metadata without meaningful user intent.

Static analysis

No suspicious patterns detected.