ClawHub
Back to skill

Security audit

Graveyard Protocol CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned but asks agents to install and run a wallet-capable CLI in ways that can auto-confirm blockchain actions across saved wallets.

Review before installing. Only use this with wallets you explicitly choose, prefer dry-run first, avoid --all and --yes unless you have already reviewed the exact wallet, accounts, reclaimed SOL, protocol fee, and claim details, and consider installing a pinned CLI version in a constrained environment rather than a mutable global npm package.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:49
Finding

Unpinned Third-Party CLI Installed Globally with Access to Wallet Keys and Transaction Signing

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description says to use the skill when 'the user wants to' perform several actions, including broad phrases like checking earnings or claiming rewards. This does not provide a clear, bounded trigger phrase set or exclusion conditions, so it could overlap with ordinary wallet- or rewards-related requests and cause unintended invocation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The skill explicitly promotes --yes to skip confirmation for a value-moving blockchain operation that closes token accounts and submits signed transactions. In an agent context, this reduces human oversight and can enable unintended execution across the wrong wallet or at the wrong time, especially because the backend scan results drive what gets closed.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

Scan all or a specified wallet for empty SPL token accounts and close them, returning locked rent to the respective wallet(s). -y or --yes option provide auto confirmation to the Close empty accounts? interactive prompt.

bash
gp close-empty --wallet <address> --yes --json    # target a specific walletskip confirmation prompt

gp close-empty --all -y --json                 # all saved wallets, auto-confirm

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The auto-confirm pattern encourages unattended execution of a transaction-generating command. Although closing empty token accounts is a legitimate workflow, removing confirmation safeguards in an agent environment increases the risk of unauthorized or mistaken on-chain actions.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

bash
gp close-empty --wallet <address> --yes --json    # target a specific walletskip confirmation prompt

gp close-empty --all -y --json                 # all saved wallets, auto-confirm

gp close-empty --wallet <address> --dry-run --yes --json  # preview — no transactions sent

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

gp stats --all --json # summary JSON for all saved wallets

gp stats --wallet

--yes --json # auto-write CSV without prompting

gp stats --wallet

--csv-out ~/report.csv --json # write CSV to path

text

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

This section normalizes fully unattended wallet operations, including adding a wallet from a local keypair file and then performing auto-confirmed account closures. In an agent or CI environment, that combination can lead to secret-adjacent handling and irreversible blockchain actions without meaningful user verification.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md
# Add a wallet non-interactively
gp add-wallet --keypair-file ~/.config/solana/id.json --name "Bot" --json

# Close empty accounts — auto-confirm, JSON output
gp close-empty --wallet <address> --yes --json

# Close for all wallets

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Auto-confirming claim-soul is less dangerous than close-empty because the skill states no local signing is required and the action claims allocated rewards. However, it still authorizes an external state-changing operation without confirmation, which is a poor fit for autonomous agents.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

gp stats --wallet

--json gp stats --all --json

Claim SOUL (auto-confirms in JSON mode)

gp claim-soul --wallet

--json gp claim-soul --all --json

text

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
94% confidence
Finding

The documentation states that JSON mode can effectively bypass interactive prompts and let transactions proceed automatically. In a skill intended for agent use, this materially increases the chance of silent execution of blockchain-affecting actions, especially when combined with --all or persisted wallets.

Content

Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.

md
- **`--json` requires `--wallet` or `--all`.** In JSON mode the interactive
  wallet picker is suppressed. Always pass an explicit wallet address or
  `--all` flag.
- **`--json` auto-confirms.** In JSON mode the "close accounts?" and "claim
  SOUL?" prompts can be skipped by using `--yes` as default response— transactions proceed automatically.
- **No signing for SOUL claims.** `gp claim-soul` does not require
  your keypair for signing. Your wallet public-key is sufficient. The SOUL tokens are transferred from Project's Community Wallet making it the transaction Signer and The backend handles signing entirely.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The Add/Remove Wallets section documents gp remove-wallet --wallet <address> but does not explicitly warn that this deletes the locally stored encrypted wallet entry from ~/.gp-cli/wallets.json. Because this is a data-affecting operation, the skill description should clearly disclose the local deletion impact before use.

Content

No source excerpt is available for this finding.