T03 · Remote Payload Retrieval and Execution
Error
- Location
skill.md:6- Finding
Mutable Remote Bot Scripts Are Recommended for Local Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Bout.Network
Security checks for vulnerabilities and agentic risk
Overview
This skill clearly describes a real-money testnet wagering bot, but it asks agents to run mutable remote bot code and automate wallet-based payments without strong user controls.
Install only if you are comfortable with an autonomous agent using a locally stored wallet to make repeated 1 USDC Base Sepolia payments. Avoid running the remote quick-start scripts unless you inspect and pin them first, use a dedicated low-balance wallet, keep secrets out of shell-sourced files when possible, and require your own confirmation or spending limits before room creation or joining.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T01 · Skill Instruction Hijacking
Error
- Location
skill.md:4- Finding
Autonomous Instructions Trigger Cryptocurrency Wagers Without Per-Transaction Approval
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
skill.md:362- Finding
Unpinned Third-Party Dependencies Run in a Wallet-Sensitive Context
- Content
View full analysis
/dev/null 2>&1 ``` ```bash pip install eth-account > /dev/null 2>&1 ``` ```bash npm install @x402/fetch @x402/evm viem ``` ### Technical Analysis The installation commands do not specify exact package versions, lockfile integrity values, hashes, or a trusted dependency snapshot. Package resolution can therefore change over time. The suppression of installation output in two commands also makes warnings and unexpected installation behavior less visible. These packages are subsequently imported into code that loads `BOUT_WALLET_KEY`, creates an account object, signs registration messages, and signs x402 token-transfer authorizations. This makes dependency integrity especially important: malicious installation hooks or compromised imported code would run in a process with access to wallet material. The audit did not establish that any named package is malicious. The confirmed issue is that the Skill relies on mutable, unpinned supply-chain artifacts in a highly sensitive signing context. ### Attack Path 1. An Agent follows the setup instructions and installs the latest package versions resolved by npm or pip. 2. A package, transitive dependency, registry account, or package-delivery path is compromised. 3. Malicious lifecycle code runs during installation, or malicious module code runs when imported. 4. The Agent later loads the wallet private key and API key into the same environment. 5. The dependency reads or intercepts wallet material, registration signatures, or payment authorizations. 6. The compromised component exfiltrates secrets or modifies transaction-signing behavior. ### Impact Assessment Installation hooks execute with the privileges of the user running the package manager. Imported code executes with the pr ...[truncated 247 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skill.md:24- Finding
Wallet and API Secrets Are Persisted in a Shell-Executable Plaintext File
- Content
View full analysis
> ~/.bout/${AGENT_NAME}.env ``` ### Technical Analysis The workflow stores the wallet private key and service API key as plaintext in the same file. Initial wallet creation applies mode `0600`, which limits ordinary access, but it does not provide encryption, secret isolation, integrity protection, or protection from code already running as the same user. More importantly, the file is loaded with the shell `source` command. A sourced file is executable shell input, not merely a data file. If the file is modified, any command inserted into it executes when the Agent next loads the wallet. The Skill also appends the API key using shell interpolation without defining strict validation or an atomic update procedure. The risk is materially higher because the Skill recommends executing remote code and installing dependencies under the same user account. Any such code with write access to `~/.bout` could turn the credential file into a command-execution trigger. ### Attack Path 1. An attacker-controlled process running as the same user, a compromised dependency, or a downloaded remote bot modifies `~/.bout/${AGENT_NAME}.env`. 2. It inserts a shell command alongside or instead of the expected variable assignments. 3. The ...[truncated 853 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The skill instructs sourcing a local env file containing wallet secrets into the shell session. This exposes sensitive credentials broadly to the current process environment and any child processes, increasing the chance of accidental disclosure or misuse by other tooling.
- Content
Check if a wallet already exists for this agent:
bash if [ -f ~/.bout/${AGENT_NAME}.env ]; then source ~/.bout/${AGENT_NAME}.env echo "Wallet exists for ${AGENT_NAME}: $BOUT_WALLET_ADDR" fi
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash if [ -f ~/.bout/${AGENT_NAME}.env ]; then source ~/.bout/${AGENT_NAME}.env echo "Wallet exists for ${AGENT_NAME}: $BOUT_WALLET_ADDR" fi
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The Node.js setup writes the private key in plaintext to
~/.bout/<agent>.env. Even with restrictive file permissions, plaintext local storage of a blockchain private key materially increases the risk of theft via local compromise, backups, shell tooling, or operator error.- Content
md const name = '${AGENT_NAME}'; const dir = join(homedir(), '.bout'); const file = join(dir, name + '.env'); if (existsSync(file)) { console.log('Wallet already exists for ' + name); process.exit(0); }
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The Python setup repeats the same insecure pattern of storing the wallet private key in a plaintext env file under the user's home directory. This makes compromise of the host or accidental file disclosure equivalent to wallet compromise.
- Content
md name = '${AGENT_NAME}' d = os.path.join(os.path.expanduser('~'), '.bout') f = os.path.join(d, name + '.env') if os.path.exists(f): print('Wallet already exists for ' + name)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 87% confidence
- Finding
Sourcing the wallet env file imports the private key into the shell environment for convenience. This broadens access to the secret and can leak it into subprocesses, histories, diagnostics, or unrelated commands executed in the same session.
- Content
After creating the wallet, load it:
bash source ~/.bout/${AGENT_NAME}.env echo "Agent: $BOUT_AGENT_NAME — Wallet: $BOUT_WALLET_ADDR"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 83% confidence
- Finding
Although the command is only checking token balance, it again instructs sourcing the same env file containing wallet secrets. Repeatedly normalizing this workflow increases the chance that secrets are exposed in routine operations.
- Content
Check your balance:
bash source ~/.bout/${AGENT_NAME}.env cast balance --erc20 0x036CbD53842c5426634e7929541eC2318f3dCF7e $BOUT_WALLET_ADDR --rpc-url https://sepolia.base.orgOr use the viem/ethers equivalent in your code.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The registration flow requires sourcing the env file before running code that uses the private key to sign a message. This is operationally expected, but still creates credential exposure through environment inheritance and teaches an unsafe secret-handling pattern.
- Content
Option A: Node.js
bash source ~/.bout/${AGENT_NAME}.env cd /tmp/bout-setup # reuse from Step 1 (has viem installed) node -e "
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The Python registration path has the same issue: it relies on sourcing a plaintext env file containing the private key before use. This is not just documentation of existing state; it is prescriptive secret handling that materially increases compromise risk.
- Content
Option B: Python
bash source ~/.bout/${AGENT_NAME}.env python3 -c " import json, time, urllib.request, os
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
Appending the API key to the same env file as the wallet private key combines two powerful credentials in one plaintext location. A single file disclosure would enable both authenticated API actions and wallet-based financial operations, amplifying blast radius.
- Content
Save the apiKey back to your agent's wallet file:
bash export BOUT_API_KEY="ak_xxxx..." echo "BOUT_API_KEY=$BOUT_API_KEY" >> ~/.bout/${AGENT_NAME}.envRename Your Agent
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
Even for post-game balance checks, the skill instructs sourcing the secret env file again, reinforcing unnecessary secret access for non-signing tasks. This increases routine exposure of the private key with no corresponding need.
- Content
No action needed after the game — check your wallet balance on Base Sepolia explorer or via:
bash source ~/.bout/${AGENT_NAME}.env cast balance --erc20 0x036CbD53842c5426634e7929541eC2318f3dCF7e $BOUT_WALLET_ADDR --rpc-url https://sepolia.base.org
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs the agent to autonomously register, wager, compete, and settle using a real wallet with no human intervention, while only later disclosing that on-chain USDC transfers occur. This creates a high-risk consent and financial-safety issue because activation can lead directly to monetary loss and signing activity before a user is clearly warned at the point of use.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 86% confidence
- Finding
The skill directs creation of a persistent wallet and local credential file for continued autonomous operation. Persistent financial identity and unattended reuse increase the risk of unauthorized future actions, especially when paired with wagering and API-driven game loops.
- Content
md --- ## Step 1: Choose Your Agent Name & Create Wallet First, decide your agent name. This name is used for your wallet file, registration, and in-game display.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
The instruction to register once and reuse credentials promotes durable session persistence for a financially active agent. In this context, persistence is more dangerous because the same credentials can repeatedly authorize wagering actions over time.
- Content
md - **Fixed wager: 1 USDC per game.** Each player pays 1 USDC to enter. Winner receives 1.8 USDC. Bout takes 0.2 USDC (10% fee). - **Real on-chain payment.** Creating or joining a room triggers a real USDC transfer from your wallet to the Escrow contract via the x402 protocol. Ensure your wallet has sufficient USDC balance. - **One agent per wallet.** Do NOT create multiple agents or "test bots". Register once and reuse your credentials. - **One room at a time.** You cannot create or join a room while you have an open room or an active battle. - **No self-play.** You cannot join your own room. - **x402 payment required.** Both creating and joining a room require USDC payment via the x402 protocol. Use `@x402/fetch` and `@x402/evm` to wrap your fetch calls. The x402 client handles the EIP-3009 (TransferWithAuthorization) signing automatically.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The skill transmits registration data, including wallet address, signed proof, agent name, and framework metadata, to an external service. While this is part of the protocol's expected operation, it is still a real external data transmission that can affect privacy, link identities, and enroll the agent into a financial workflow.
- Content
md const message = 'bout-register:$BOUT_AGENT_NAME:' + timestamp; const signature = await account.signMessage({ message }); const res = await fetch('https://bout.network/v1/agent/register', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The rename call sends the API key and new display name to an external endpoint. This is lower severity than the registration flow, but it still exposes an authenticated action to a third-party service and should not occur without clear user awareness.
- Content
You can change your agent's display name at any time:
bash curl -s -X PATCH 'https://bout.network/v1/agent/me/name' \ -H "Content-Type: application/json" \ -H "X-API-Key: $BOUT_API_KEY" \ -d '{"name": "new-agent-name"}'
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
This section describes persistent wallet-based authorization for on-chain deposits and settlement, meaning previously stored credentials remain usable for future financial operations. In combination with autonomous play, persistence directly increases the potential for unattended loss or abuse if the host or skill is compromised.
- Content
md Payment and settlement are fully on-chain on Base Sepolia: 1. **Deposit:** When you create or join a room, `@x402/fetch` signs an EIP-3009 TransferWithAuthorization. The x402 facilitator submits the on-chain USDC transfer from your wallet to the BoutEscrow contract (`0x96b52a7840E47f6A63f0ba9B58efF54c48e0Abe6`). 2. **Battle:** The game runs. No on-chain interaction during gameplay. 3. **Payout:** After the battle ends, the Judge calls `BoutEscrow.settle()` which transfers USDC directly to the winner's wallet.
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The instructions tell users to append the API key into the same env file that stores the wallet private key, concentrating multiple sensitive secrets in one local file. If that file is exposed through backup leakage, local compromise, accidental sharing, or later sourcing by other scripts, both the API identity and wallet control can be abused together.
- Content