Ai Bounty Claim

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:11 PM UTC
• Version: 0.1.1

Overview

This skill is coherent for claiming an AI bounty, but it relies on unpinned wallet-related dependencies and shows raw private-key handling for a blockchain transaction path.

Review before installing. Only use this with wallet dependencies pinned to reviewed commits or otherwise verified, and avoid exposing raw manager private keys to helper code; prefer a signer interface that never reveals key material. Confirm decoded transaction details, receiver, chain, contract, fee, and reward amount before any send.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:36

Finding

Unpinned External Agent Skills Create a Mutable Supply-Chain Boundary

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/examples/portkey-ca.md:91

Finding

Raw Manager Private Key Is Passed to External Helper Code Despite a Permissionless Reward Method

Content

View full analysis

Portkey CA contract ManagerForwardCall -> reward contract ClaimByPortkeyToCa(Hash ca_hash)` as the standard AA/CA wallet operation. - `ClaimByPortkeyToCa(Hash ca_hash)` is permissionless at the reward method layer, but this skill still models AA/CA claiming through the standard CA wallet forwarding path. - Prefer the high-level helper `managerForwardCallWithKey(...)` in the dependency implementation. ``` Relevant location: `SKILL.md:64-69`. ### Technical Analysis The Skill explicitly states that `ClaimByPortkeyToCa(Hash ca_hash)` is permissionless at the reward-contract layer. Nevertheless, it mandates the CA manager forwarding route and illustrates reading a raw manager private key from `process.env.PRIVATE_KEY` before passing it directly into helper code supplied by an external dependency. A manager key may authorize operations beyond the single bounty claim. Passing that key to a general-purpose helper expands the trusted computing base from the signer implementation to all code executed by the helper and its dependency graph. The opera ...[truncated 2118 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

- If behavior seems inconsistent or an external AI reports unexpected output, ask them to report the `version` field from this `SKILL.md` first.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This file is a Chinese-language skill README and does not indicate that language selection is optional or user-driven. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md

- Never continue with `Claim()` if the address is exchange-managed, custodial, or lacks a user-controlled private key.
- Always tell the user not to fill exchange or custodial addresses.
- Never offer to create, custody, or store a wallet for the user.
- Do not ask the user to paste an address when a local EOA or local AA/CA context should be used.
- For generic claim requests, explain `AA/CA vs EOA` first and ask the user to choose one before entering a claim branch.
- Treat `AA` as the preferred user-facing term, but accept `CA` as the same route alias.
- Always recommend `AA/CA` because the current campaign reward is `2 AIBOUNTY` for `AA/CA` and `1 AIBOUNTY` for `EOA`.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger examples "help me claim" and its Chinese equivalent are very broad and resemble normal conversational requests, which can cause this skill to activate in situations where a user has not clearly asked for this specific bounty-claim workflow. In an agent-routing system, overly generic triggers increase the chance of misrouting, unintended wallet-related guidance, and accidental progression into sensitive account or transaction flows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example hard-codes a Chinese-only final reply template and does not indicate that the agent should preserve or negotiate the user's preferred language. In a transactional claim flow, forcing output into a language the user may not understand can degrade informed consent, causing users to confirm blockchain actions without fully understanding signer, receiver, fee, or failure details.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The flow is configured to trigger on very broad, ordinary phrases such as 'help me claim' and 'claim for me', which can cause the skill to activate in contexts where the user has not clearly consented to this specific blockchain claim workflow. In a wallet/account onboarding and transaction-guidance context, over-broad invocation increases the risk of unintended routing into sensitive account handling steps and makes prompt-injection or context-confusion attacks easier.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.