XMTP CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:07 AM UTC
• Version: 1.0.0

Overview

The XMTP CLI skill matches its stated purpose, but it needs review because it gives unsafe wallet-secret handling guidance, runs an unpinned external CLI package, and enables real messaging and group-permission changes without strong warnings.

Review before installing. Use this only in a controlled XMTP development environment, prefer ephemeral or test wallets, avoid pasting real private keys into commands or agent prompts, protect any `.env` file with strict permissions and source-control exclusion, and pin or otherwise verify the `@xmtp/cli` package version before running it. Treat send, group, sync, content, and permissions commands as real network or account-affecting actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:46

Finding

Unpinned Package Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:46-58
Vulnerability Type: Unpinned third-party package installation and dynamic execution
Risk Level: Medium

Vulnerable Code

bash

npm install -g @xmtp/cli
# or
pnpm add -g @xmtp/cli
# or
yarn global add @xmtp/cli

bash

npx @xmtp/cli <command> <arguments>
# or pnpx / yarn dlx

Technical Analysis

The installation and execution instructions do not specify an exact package version or an integrity constraint. Consequently, the package manager resolves whichever release is current at execution time. The npx, pnpx, and yarn dlx variants are particularly sensitive because they may download and immediately execute package code.

The package name is consistent with the Skill's declared XMTP purpose, and the audited files contain no evidence that the referenced package is currently malicious. Nevertheless, the absence of version pinning makes execution non-reproducible and exposes users to upstream package compromise, malicious release publication, registry compromise, or unexpected behavior introduced by a newer release.

Attack Path

1. An attacker compromises the upstream package publisher account, package distribution infrastructure, or a future package release.
2. The attacker publishes code under the package version selected by the package manager.
3. A user or Agent follows the Skill and runs an unpinned installation or npx command.
4. The package manager downloads the uncontrolled release.
5. The package executes with the operating-system privileges and environment access of the invoking process.

Impact Assessment

A compromised dependency could execute arbitrary local code with the invoking user's privileges. Potential scope includes access to files available to that user, environment variables, XMTP configuration, wallet credentials, database keys, and messaging data. If installation is performed ...[truncated 113 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an exact, reviewed version, such as @xmtp/cli@X.Y.Z.
• Record and verify package integrity metadata before use.
• Document the expected package registry and reject unexpected registry overrides.
• Avoid dynamic npx, pnpx, or yarn dlx retrieval in automated or privileged workflows.
• Install the reviewed package through a lockfile-controlled project dependency where possible.
• Establish a dependency update process that reviews release notes, package provenance, and integrity before changing the pinned version.
• Run the CLI under a least-privileged account with access limited to the files and secrets required for the task.

T09 · Insecure Skill Coding Practices

Error

• Location: setup/rules/init.md:17

Finding

Ethereum Private Key Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: setup/rules/init.md:17-31
Additional Location: setup/SKILL.md:27-33
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: High

Vulnerable Code

bash

**Options:**

- `--ephemeral` – Generate a new random wallet key (default; conflicts with `--private-key`)
- `--private-key <key>` – Use existing private key in hex with `0x` prefix (conflicts with `--ephemeral`)
- `--gateway <url>` – XMTP Gateway URL (sets `XMTP_GATEWAY_HOST`)
- `--env <environment>` – `dev`, `production`, or `local` (sets `XMTP_ENV`; defaults to `dev` unless `--gateway` is set)

**Examples:**

```bash
xmtp init --ephemeral
xmtp init --private-key 0x1234...
xmtp init --gateway https://my-gateway.example.com
xmtp init --env production
xmtp init --private-key 0x1234... --gateway https://... --env production

text

### Technical Analysis

The Skill instructs users to provide an Ethereum private key directly in a command-line argument. Although the examples use placeholders, users are expected to replace those placeholders with real key material.

Command-line secrets may be exposed through shell history, process inspection interfaces, terminal recording, command auditing, CI/CD logs, Agent transcripts, telemetry, crash diagnostics, or wrapper scripts. Quoting the key does not address these exposure channels because the key remains part of the process argument vector and command history.

### Attack Path

1. A user follows the documented example and substitutes a real Ethereum private key.
2. The shell records the command in history, or local monitoring and process-inspection facilities capture the process arguments.
3. A local user, administrator, compromised process, log reader, or telemetry recipient obtains the recorded command.
4. The attacker extracts the private key from the `--private-key` argument.
...[truncated 632 chars]

Remediation

View remediation

Remediation Suggestions

• Do not accept or recommend wallet private keys through command-line arguments.
• Provide a protected standard-input prompt that disables terminal echo.
• Alternatively, accept a path to a secret file protected with restrictive permissions rather than accepting the key value itself.
• Prefer integration with an operating-system keychain, hardware wallet, signing service, or dedicated secret manager.
• If an environment-variable fallback is unavoidable, clearly document its exposure risks and ensure it is not logged.
• Redact private keys from application logs, errors, telemetry, and diagnostic output.
• Add an explicit warning that users must never paste real keys into command lines, scripts, Agent prompts, or CI/CD job definitions.
• Recommend immediate key rotation and migration of associated assets if a real key has previously been entered through this interface.

T09 · Insecure Skill Coding Practices

Warning

• Location: setup/rules/env-variables.md:9

Finding

Plaintext Secret File Guidance Omits Required Access Controls

Content

View full analysis

Vulnerability Details

File Location: setup/rules/env-variables.md:9-29
Additional Location: setup/rules/init.md:34-40
Vulnerability Type: Insecure storage of wallet and database encryption keys
Risk Level: Medium

Vulnerable Code

bash

Set these in your `.env` file (or export in shell). `xmtp init` generates a `.env` with required values.

**Required:**

- `XMTP_ENV` – `dev`, `production`, or `local`
- `XMTP_WALLET_KEY` – Private key for Ethereum wallet (hex with `0x`)
- `XMTP_DB_ENCRYPTION_KEY` – Database encryption key

**Optional:**

- `XMTP_DB_DIRECTORY` – Database directory (default: current working directory)
- `XMTP_GATEWAY_HOST` – XMTP Gateway URL (overrides env-based default)

**Example `.env`:**

```bash
XMTP_ENV=dev
XMTP_WALLET_KEY=0x...
XMTP_DB_ENCRYPTION_KEY=...
XMTP_DB_DIRECTORY=my/database/dir
XMTP_GATEWAY_HOST=https://...

text

### Technical Analysis

The Skill directs users to store an Ethereum wallet private key and a database encryption key in a plaintext `.env` file. It does not require restrictive file permissions, a restrictive creation mask, atomic secret-file creation, exclusion from version control, or protection from backup and synchronization tools.

No real hardcoded secret is present in the audited project. The weakness is in the recommended secret-handling procedure: a generated or manually created `.env` file may inherit permissive defaults or be accidentally copied into a repository, build context, backup, diagnostic archive, or shared workspace.

### Attack Path

1. `xmtp init` generates a `.env` file, or the user creates one according to the documentation.
2. The file contains `XMTP_WALLET_KEY` and `XMTP_DB_ENCRYPTION_KEY` in plaintext.
3. The file is created with overly broad permissions, committed to version control, included in a backup or container build context, or read by unrelated tooling.
4. An unauthorized local user or ext
...[truncated 696 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer an operating-system keychain, hardware-backed credential store, or dedicated secret manager instead of plaintext .env storage.
• If a secret file is required, create it atomically with a restrictive umask and enforce owner-only permissions such as mode 0600.
• Verify ownership and permissions before loading an existing secret file.
• Ensure .env is listed in .gitignore and provide automated checks that reject commits containing wallet or database keys.
• Exclude secret files from container build contexts, support bundles, cloud synchronization, and unencrypted backups.
• Never print secret values during initialization, debugging, error handling, or command completion.
• Store the database encryption key separately from the encrypted database wherever practical.
• Document a rotation and incident-response procedure for both wallet and database encryption keys.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

2. Read that sub-skill’s `SKILL.md` and its `rules/` for step-by-step guidance.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

---
name: xmtp-cli-send
description: Send messages to an address or group from the XMTP CLI. Use when sending a message or waiting for a response.
license: MIT
metadata:
  author: xmtp

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · send/SKILL.md (reported line 3)May include surrounding context.

md

---
name: xmtp-cli-send
description: Send messages to an address or group from the XMTP CLI. Use when sending a message or waiting for a response.
license: MIT
metadata:
  author: xmtp

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · send/SKILL.md (reported line 12)May include surrounding context.

md

---
name: xmtp-cli-send
description: Send messages to an address or group from the XMTP CLI. Use when sending a message or waiting for a response.
license: MIT
metadata:
  author: xmtp

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup/rules/env-variables.md (reported line 4)May include surrounding context.

md

---
title: CLI environment variables
impact: CRITICAL
tags: env, configuration, .env
---

## CLI environment variables

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The examples show passing a private key directly as a command-line argument, which can expose it through shell history, process listings, audit logs, and terminal recording tools. In a CLI-focused skill, this is especially dangerous because users are likely to copy-paste the example exactly, leading to immediate compromise of the wallet if the host is monitored or shared.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises capabilities that include sending messages, creating/managing groups, syncing, and changing permissions, but it does not prominently warn that these are state-changing operations. In an agent setting, insufficient disclosure increases the risk of a user or orchestrator invoking the skill without realizing it can perform external actions affecting privacy, messaging, and access control.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill recommends running npx @xmtp/cli without pinning a specific package version, which causes users to fetch and execute whatever the latest published package is at runtime. That creates a supply-chain risk: a compromised publisher account, malicious release, or breaking update could lead to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The transaction examples show users how to send transaction content, including a concrete amount, but provide no warning that this action may represent or trigger a value transfer workflow. In a CLI skill used for testing and interaction, omission of a clear caution increases the chance that users will invoke transaction-related commands without understanding financial consequences or treating them with the extra care normally required for money-moving operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The rule trigger is broad enough to match generic words like 'info', 'address', 'inbox', or 'resolve' without much contextual constraint. In an agent setting, this can cause over-triggering on unrelated user requests and route the conversation into a capability that inspects messaging/account metadata, increasing the chance of unintended disclosure or misuse of diagnostic commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The instructions enable sending messages to wallet addresses or groups, including a default message value, but provide no warning about privacy, misdelivery, or the consequences of messaging the wrong target or group. In an agent skill context, this omission increases the chance of accidental outbound communication, unintended disclosure, or spam-like behavior when users or automations invoke the command without sufficient confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly instructs users to place highly sensitive secrets, including a wallet private key and database encryption key, into a .env file without any warning about file protection, exclusion from version control, or secret-handling practices. In a CLI/testing skill context, users may copy these examples directly, increasing the risk of accidental commit, shell history leakage, or exposure in shared working directories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to generate a .env file containing a wallet private key and database encryption key but does not warn that these are high-value secrets that must not be committed, shared, or stored with weak filesystem permissions. In an agent-skill context, users may follow the instructions verbatim, increasing the chance of credential leakage through source control, logs, backups, or multi-user systems.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description says to use the skill for testing, debugging, interacting with conversations, groups, and messages, and for needs like init, send, list, debug, sync, permissions, or content commands. This covers a very wide range of user intents but does not provide explicit exclusions or negative examples to clarify when this top-level skill should not be invoked versus a different skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This is a markdown file, so user-facing warnings are expected when described behavior could affect privacy or reveal user data. The examples and operation list present identity- and inbox-related lookups as straightforward commands, but do not mention that the output may contain sensitive metadata or should be handled carefully.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file documents concrete usage only for conversations, members, and messages, but line L35 states that find is also an operation. This creates intent/documentation divergence because the documentation claims support for an operation without describing how it behaves or how to invoke it.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · permissions/rules/list-info.md (reported line 9)May include surrounding context.

List permissions and group info

List members and permissions:

bash

xmtp permissions list --group-id <id>

Static analysis

No suspicious patterns detected.