Security audit

pol-agents-sdk-demo

Security checks for vulnerabilities and agentic risk

Overview

This wallet automation skill is mostly coherent, but it handles crypto wallet sessions and installs/network-exposes components in ways users should review carefully before use.

Review this skill before installing. Use a dedicated low-privilege environment and a limited wallet, pin and verify any package or cloudflared binary yourself, avoid sharing approval URLs outside the active approval flow, prefer explicit/manual modes when possible, and clean up any session ciphertext written under /tmp.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:9
Finding: Unpinned External Package and Automatically Downloaded Executable
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:116
Finding: Sensitive Wallet Callback Capability Exposed Through Agent Output and a Public Tunnel
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:137
Finding: Wallet Session Ciphertext Stored in a Predictable Shared Temporary Path
Content: View full analysis
``` The blob is also saved to `/tmp/polygon-session-.txt` for reference. To import later: ``` polygon-agent wallet import --ciphertext @/tmp/polygon-session-.txt ``` ``` `QUICKSTART.md:42-55`: ```markdown **If cloudflared is unavailable** (`callbackMode: manual`): The browser will display the encrypted blob instead of posting it back. The CLI will prompt you to paste it: ``` After approving in the browser, the encrypted blob will be shown. Paste it below and press Enter: > ``` The blob is also saved to `/tmp/polygon-session-.txt` automatically. ### Option B: Manual (explicit no-wait) ```bash polygon-agent wallet create --no-wait # Open output URL, approve, copy blob: polygon-agent wallet import --ciphertext @/tmp/session.txt ``` ``` ### Technical Analysis The documented workflow stores wallet-session ciphertext in the shared `/tmp` namespace using a recognizable filename pattern. The documentation does not state that the file is created atomically and exclusively, assigned mode `0600`, protected against symbolic links, associated with the correct owner, or deleted after import. Encryption protects the blob's contents only if authenticated encryption, key separation, and context validation are implemented correctly. It does not by itself prevent another local process from copying the file, replacing it, pre-creating the path, linking it to another file, or replaying an o ...[truncated 2303 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · QUICKSTART.md (reported line 3)May include surrounding context.
md
--- name: polygon-agent-kit-quickstart description: Quick start guide for Polygon Agent Kit. Get project access key, create wallet with session permissions, register agent onchain, perform token operations. Context-efficient workflow for autonomous agents. --- # Polygon Agent Kit - Quick Start

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
md
## Key Behaviors - **Dry-run by default** — all write commands require `--broadcast` to execute - **Smart defaults** — `--wallet main`, `--chain polygon`, auto-wait on `wallet create` - **Fee preference** — auto-selects USDC over native POL when both available - **`deposit`** — picks highest-TVL pool via Trails `getEarnPools`. If session rejects, re-create wallet with `--contract <depositAddress>`

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented callback flow exposes a local HTTP callback via a public Cloudflare Quick Tunnel and auto-downloads/executes cloudflared. Even if intended for convenience, this increases attack surface by introducing remote reachability, trust in a downloaded binary, and possible interception or misuse of sensitive session-return data if the callback flow is not strongly authenticated and integrity-checked.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Auto-downloading and executing cloudflared is a system-changing and network-active behavior that users may not reasonably expect from a wallet/session setup command. This creates supply-chain and execution risk, especially if the download source, integrity validation, and consent model are not made explicit in the documentation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manual fallback stores sensitive session ciphertext in /tmp, which contradicts the encrypted-storage model and may expose data to other local users, backup processes, container co-tenants, or malware that monitors temporary directories. Even encrypted blobs can be replayed or imported if they represent live session material, so placing them outside the protected storage boundary is risky.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Saving the encrypted session blob to /tmp without a clear warning about local exposure and cleanup is unsafe operational guidance. Temporary directories are often accessible to other processes and retained longer than users expect, making accidental disclosure or misuse more likely.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.