Security audit

OpenServ Client

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its OpenServ management purpose, but it handles wallet keys, API tokens, remote resources, and destructive cleanup in ways users should review carefully before installing.

Review this skill before installing. Use a dedicated low-value wallet, keep .env and .openserv.json out of source control and logs, protect webhook URLs as secrets, pin package and skill versions, and avoid running destructive cleanup commands unless you have verified the target resources.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:397
Finding: Unpinned and Remotely Mutable Dependencies
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:346
Finding: Wallet Private Key and Provisioning Credentials Persisted in Plaintext
Content: View full analysis
**Reload `.env` after `provision()`.** `provision()` writes `WALLET_PRIVATE_KEY` to `.env` at runtime, but `process.env` already loaded the empty value at startup. Use `dotenv.config({ override: true })` after `provision()` to pick up the freshly written key. See **openserv-agent-sdk** skill for the full dotenv pattern. ``` ```typescript import { PlatformClient } from '@openserv-labs/client' // Reload .env to pick up WALLET_PRIVATE_KEY written by provision() dotenv.config({ override: true }) try { const client = new PlatformClient() await client.authenticate(process.env.WALLET_PRIVATE_KEY) const erc8004 = await client.erc8004.registerOnChain({ workflowId: result.workflowId, privateKey: process.env.WALLET_PRIVATE_KEY!, name: 'My Agent', description: 'What this agent does' }) ``` The supplied environment template establishes plaintext fields for these credentials: ```dotenv # Auto-populated by provision() - DO NOT fill manually WALLET_PRIVATE_KEY= OPENSERV_API_KEY= O ...[truncated 2785 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: examples/agent.ts:46
Finding: Tokenized Webhook URLs Disclosed Through Application Logs
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (31)

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.
// Get stored IDs and tokens const info = getProvisionedInfo('my-agent', 'My Awesome Workflow')

// Clear state (forces fresh creation) clearProvisionedState()

text

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The example explicitly reloads .env to access WALLET_PRIVATE_KEY, normalizing retrieval of a plaintext private key from a local file. That encourages insecure secret handling for a highly sensitive credential that can grant control over the associated wallet and any on-chain identity or funds tied to it.
Content: Scanner excerpt · SKILL.md (reported line 355)May include surrounding context.
typescript
import { PlatformClient } from '@openserv-labs/client' // Reload .env to pick up WALLET_PRIVATE_KEY written by provision() dotenv.config({ override: true }) try {

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: The function returns live credentials and identifiers intended for .env use, including apiKey, authToken, and triggerToken. Returning secrets from an example setup routine materially increases the chance they are captured by calling code, shell history, debugging tools, test output, CI logs, or accidentally committed environment files, enabling unauthorized API access or trigger invocation.
Content: Scanner excerpt · examples/create-agent.ts (reported line 82)May include surrounding context.
ts
console.log(`Webhook: https://api.openserv.ai/webhooks/trigger/${trigger.token}`) console.log('='.repeat(50)) // Return info for .env return { agentId: agent.id, apiKey,

Credential Access

High

Category: Privilege Escalation
Confidence: 85% confidence
Finding: The documentation instructs reloading .env to pick up a freshly written WALLET_PRIVATE_KEY, normalizing storage of a highly sensitive private key in an environment file. Persisting blockchain private keys in .env increases the chance of accidental commit, local disclosure, process-level exposure, or reuse by unrelated components, and compromise would allow full wallet takeover and unauthorized on-chain actions.
Content: Scanner excerpt · reference.md (reported line 502)May include surrounding context.

Requires ETH on Base. The wallet starts unfunded. Always wrap in try/catch so failures don't crash the agent. Reload .env after provision() with dotenv.config({ override: true }) to pick up the freshly written WALLET_PRIVATE_KEY.

typescript
// Reload .env after provision() to pick up WALLET_PRIVATE_KEY dotenv.config({ override: true }) try {

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents code that uses environment variables and network access, but it declares no tool scope or allowed-tools metadata. In an agent ecosystem, that omission weakens least-privilege controls and can cause consumers to grant broader runtime capabilities than necessary without explicit visibility.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
md
`provision()` creates two types of credentials. They are **not interchangeable**: | Credential | Env Variable | Used By | Purpose | | ------------- | ----------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | | Agent API key | `OPENSERV_API_KEY` | SDK internals | Authenticates the agent when receiving tasks from the platform. Set automatically via `agent.instance`. **Do not** use with `PlatformClient`. | | Wallet key | `WALLET_PRIVATE_KEY` | `PlatformClient` | Authenticates your account for management calls (list tasks, debug workflows, manage agents). |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.
md
| ------------- | ----------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | | Agent API key | `OPENSERV_API_KEY` | SDK internals | Authenticates the agent when receiving tasks from the platform. Set automatically via `agent.instance`. **Do not** use with `PlatformClient`. | | Wallet key | `WALLET_PRIVATE_KEY` | `PlatformClient` | Authenticates your account for management calls (list tasks, debug workflows, manage agents). | | User API key | `OPENSERV_USER_API_KEY` | `PlatformClient` | Alternative to wallet auth. Get from the platform dashboard. | If you get a **401 Unauthorized** when using `PlatformClient`, you are likely using the agent API key by mistake. Use wallet authentication or the user API key instead.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation states that provision() writes WALLET_PRIVATE_KEY to .env at runtime and then instructs reloading it, but it does not give a strong warning about plaintext secret storage risks. Persisting wallet private keys to .env can lead to accidental source-control commits, local disclosure, or leakage through logs, backups, or support bundles.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The skill recommends running npx skills check without pinning a version, which can fetch and execute whatever package version is current at runtime. That creates a supply-chain risk because behavior may change unexpectedly or a compromised upstream release could execute code on the user's machine.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The unpinned npx skills update command executes remote package code with no version constraint, increasing exposure to malicious or breaking upstream releases. Because it explicitly updates installed skills, it may also modify local agent behavior in ways the user has not reviewed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The npx skills add openserv-labs/skills example invokes an external package/repository reference without version pinning, exposing users to mutable upstream content and possible supply-chain compromise. In a skill-installation context, this is especially risky because the fetched content may influence future agent actions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 309)May include surrounding context.
md
} }) console.log(`Webhook: https://api.openserv.ai/webhooks/trigger/${result.triggerToken}`) // Start the agent - credentials already bound await run(agent)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.
md
} }) console.log(`Webhook: https://api.openserv.ai/webhooks/trigger/${result.triggerToken}`) // Start the agent - credentials already bound await run(agent)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/agent.ts (reported line 46)May include surrounding context.
ts
} }) console.log(`Webhook: https://api.openserv.ai/webhooks/trigger/${result.triggerToken}`) // Start the agent - credentials already bound await run(agent)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/create-agent.ts (reported line 79)May include surrounding context.
ts
} }) console.log(`Webhook: https://api.openserv.ai/webhooks/trigger/${result.triggerToken}`) // Start the agent - credentials already bound await run(agent)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · reference.md (reported line 279)May include surrounding context.
md
} }) console.log(`Webhook: https://api.openserv.ai/webhooks/trigger/${result.triggerToken}`) // Start the agent - credentials already bound await run(agent)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · reference.md (reported line 295)May include surrounding context.
md
} }) console.log(`Webhook: https://api.openserv.ai/webhooks/trigger/${result.triggerToken}`) // Start the agent - credentials already bound await run(agent)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · reference.md (reported line 298)May include surrounding context.
md
} }) console.log(`Webhook: https://api.openserv.ai/webhooks/trigger/${result.triggerToken}`) // Start the agent - credentials already bound await run(agent)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · reference.md (reported line 464)May include surrounding context.
md
} }) console.log(`Webhook: https://api.openserv.ai/webhooks/trigger/${result.triggerToken}`) // Start the agent - credentials already bound await run(agent)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script performs irreversible deletion of all workflows and agents when '--all' is supplied, without any interactive confirmation, dry-run, or secondary safeguard. In a platform-management skill context, this is more dangerous because the authenticated client acts on real remote resources, so a mistyped command, copied example, or automation misuse can cause immediate data/resource loss.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: reference.md:15

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:76