Security audit

XMTP CLI

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward XMTP CLI guide, with expected but sensitive messaging and wallet-key handling that users should treat carefully.

Install only if you intend to use XMTP CLI commands. Prefer dev or ephemeral keys for testing, keep .env files out of git and shared logs, avoid passing real private keys on the command line where possible, and double-check recipients before sending messages, creating groups, or changing permissions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The document is scoped to listing permissions and group info, but the operations list also includes `update-permissions`, which implies a state-changing capability not explained or constrained by the rest of the page. In a CLI skill, undocumented mutation paths can mislead downstream agents or users into invoking privileged actions they did not intend, especially when the surrounding content appears read-only.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger list includes very generic terms such as 'address', 'inbox', 'resolve', and 'info', which can cause this debug skill to activate for broad user requests outside the intended XMTP diagnostic context. Overbroad activation can route unrelated inputs into a powerful CLI-backed skill, increasing the chance of unintended command use, data exposure, or confusing tool selection.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This skill instructs the agent to send messages to wallet addresses or groups but does not warn that user-provided message content and recipient identifiers will be transmitted to an external messaging network. In an agent setting, this can cause users to unintentionally disclose sensitive data or contact targets without understanding the privacy and network effects.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill provides ready-to-run examples for sending messages to wallet addresses and groups, but does not warn that message contents are transmitted to external recipients and may disclose sensitive user data. In an agent setting, users may provide secrets, internal identifiers, or personal information as message text, so the omission increases the risk of unintended data exfiltration through normal-looking CLI usage.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation explicitly identifies a private wallet key and database encryption key as environment variables and shows them in a `.env` example, but provides no warning to keep these secrets out of source control, logs, screenshots, or shared transcripts. In a skill meant for CLI scripting and debugging, users are more likely to copy configuration verbatim or expose environment contents during troubleshooting, increasing the chance of credential disclosure and downstream wallet compromise or encrypted data exposure.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill instructs users to create a `.env` file containing sensitive wallet and encryption keys but provides no warning about secure local storage, accidental source-control exposure, or filesystem access risks. Because these secrets can enable account access and message/database decryption, normalizing plaintext storage without safeguards increases the chance of credential compromise.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The `--private-key` option accepts raw wallet credentials directly on the command line without warning that shell history, process listings, logs, or terminal capture may expose the secret. Supplying private keys this way can lead to wallet takeover if the key is leaked through common local observability mechanisms.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.