ClawHub
Back to skill

Security audit

ERC-8128

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent documentation for wallet-signed HTTP requests, but it recommends unpinned npm/npx CLI execution in a workflow that handles Ethereum private keys.

Review before installing. Pin @slicekit/erc8128-cli to a specific reviewed version, prefer a project-local install with a lockfile over global install or unpinned npx, and run it with least privilege. Use encrypted keystores, hardware wallets, or a signing service when possible; avoid raw private keys and ETH_PRIVATE_KEY for production; only sign requests to trusted HTTPS endpoints; and choose output paths carefully because responses may contain sensitive data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
references/cli.md:10
Finding

Unpinned Third-Party CLI Installation and Execution

Content
View full analysis

Vulnerability Details

File Location: references/cli.md, lines 10–12
Vulnerability Type: Unpinned npm dependency execution
Risk Level: Medium

bash
# Global install
npm install -g @slicekit/erc8128-cli

# Or use directly with npx
npx @slicekit/erc8128-cli curl <url>

Technical Analysis

The documented commands resolve @slicekit/erc8128-cli without specifying an exact, reviewed version or integrity constraint. Consequently, the code installed or executed can change after the Skill itself has been reviewed.

The npx command is particularly sensitive because it may download and immediately execute the latest package version. Global npm installation can also run package lifecycle scripts and place executable files in user-level or system-level locations, depending on npm configuration. Such package code runs with the privileges of the user invoking the command.

This is especially relevant because the CLI is intended to process Ethereum wallet credentials through key files, encrypted keystores, command-line arguments, or the ETH_PRIVATE_KEY environment variable. Although the reviewed documentation does not instruct the CLI to transmit raw private keys, a compromised future package version or transitive dependency could access those credentials.

Attack Path

  1. An attacker compromises the npm publisher account, package release process, registry resolution path, or a transitive dependency.
  2. The attacker publishes a malicious version under the legitimate package name.
  3. An Agent follows the documented unpinned npm install -g or npx command.
  4. npm resolves the compromised release and executes its lifecycle or runtime code with the invoking user's privileges.
  5. The malicious code reads accessible wallet key files, environment variables such as ETH_PRIVATE_KEY, request bodies, configuration files, or other user-readable data.
  6. The malicious code can exfiltrate collected data, ...[truncated 1036 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to an exact, reviewed version, for example:
    bash
    npm install --save-exact @slicekit/erc8128-cli@<reviewed-version>
npx --yes @slicekit/erc8128-cli@<reviewed-version> curl <url>
  2. Prefer a project-local installation governed by a committed lockfile instead of a global installation.
  3. Verify npm package provenance, registry origin, published checksums, signatures, and integrity metadata before use.
  4. Review the pinned package, its lifecycle scripts, and its full transitive dependency tree. Re-review dependency changes before upgrading.
  5. Use npm ci with a trusted lockfile in automated environments to prevent unexpected dependency resolution.
  6. Disable lifecycle scripts where compatible with the package, or perform installation in an isolated build environment before execution.
  7. Run the CLI in a sandbox or container under a dedicated least-privilege account. Expose only the specific request data and signing interface required for the operation.
  8. Prefer encrypted keystores, hardware wallets, or an external signing service over raw key files, command-line keys, and environment-variable keys.
  9. Restrict key-file permissions and network egress so that the CLI can contact only explicitly approved ERC-8128 endpoints.
  10. Document a trusted package version and upgrade-validation process directly in the Skill instructions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (17)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
const client = createSignerClient(signer)

// Sign and send
const response = await client.fetch('https://api.example.com/orders', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ amount: '100' }),

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
const client = createSignerClient(signer)

// Sign and send
const response = await client.fetch('https://api.example.com/orders', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ amount: '100' }),

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
const client = createSignerClient(signer)

// Sign and send
const response = await client.fetch('https://api.example.com/orders', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ amount: '100' }),

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
const client = createSignerClient(signer)

// Sign and send
const response = await client.fetch('https://api.example.com/orders', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ amount: '100' }),

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md
const client = createSignerClient(signer)

// Sign and send
const response = await client.fetch('https://api.example.com/orders', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ amount: '100' }),

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/cli.md (reported line 69)May include surrounding context.

md
const client = createSignerClient(signer)

// Sign and send
const response = await client.fetch('https://api.example.com/orders', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ amount: '100' }),

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/cli.md (reported line 79)May include surrounding context.

md
const client = createSignerClient(signer)

// Sign and send
const response = await client.fetch('https://api.example.com/orders', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ amount: '100' }),

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/cli.md (reported line 89)May include surrounding context.

md
const client = createSignerClient(signer)

// Sign and send
const response = await client.fetch('https://api.example.com/orders', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ amount: '100' }),

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/cli.md (reported line 99)May include surrounding context.

md
const client = createSignerClient(signer)

// Sign and send
const response = await client.fetch('https://api.example.com/orders', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ amount: '100' }),

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/cli.md (reported line 112)May include surrounding context.

md
const client = createSignerClient(signer)

// Sign and send
const response = await client.fetch('https://api.example.com/orders', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ amount: '100' }),

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/cli.md (reported line 122)May include surrounding context.

md
const client = createSignerClient(signer)

// Sign and send
const response = await client.fetch('https://api.example.com/orders', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ amount: '100' }),

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/cli.md (reported line 129)May include surrounding context.

md
const client = createSignerClient(signer)

// Sign and send
const response = await client.fetch('https://api.example.com/orders', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ amount: '100' }),

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md
📖 See [Verifying Requests](https://erc8128.slice.so/guides/verifying-requests) and [VerifyPolicy](https://erc8128.slice.so/api/types#verifypolicy) for full options.

## CLI: erc8128 curl

For CLI usage, see [references/cli.md](references/cli.md).

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/cli.md (reported line 69)May include surrounding context.

Basic GET

bash
erc8128 curl --keystore ./key.json https://api.example.com/data

POST with JSON

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/cli.md (reported line 118)May include surrounding context.

Piped input

bash
echo '{"data":"value"}' | erc8128 curl -X POST \
  -H "Content-Type: application/json" \
  -d @- \
  --keyfile ~/.keys/bot.key \

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The CLI supports sending authenticated requests and writing server responses to arbitrary files, but the nearby option descriptions do not explicitly warn about sensitive data exposure, accidental transmission to untrusted endpoints, or overwriting local files. In a wallet-auth context, users may send signed requests or save sensitive API responses without appreciating the privacy and integrity risks.

Content

No source excerpt is available for this finding.