sequence-cli

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:40 AM UTC
• Version: 1.0.0

Overview

This skill has a clear wallet-management purpose, but it guides agents through high-impact blockchain transfers while handling private keys and access keys in under-protected ways.

Review carefully before installing. Use only isolated wallets with limited funds, pin and verify the CLI version, avoid putting private keys or access keys in command lines or chat logs, and require explicit human confirmation of chain, token, amount, and recipient before any transfer.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:32
• Finding: Unpinned npm Package Executes Security-Critical Wallet Operations## Vulnerability Details **File Location**: `SKILL.md`, lines 32-48; repeated throughout lines 58-284 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High **Vulnerable Code**: ```bash # 1. Create a wallet npx @0xsequence/builder-cli create-wallet --json # 2. Login with the private key from step 1 npx @0xsequence/builder-cli login -k <private-key> --json # 3. Create a project and get an access key npx @0xsequence/builder-cli projects create "My Project" --json # 4. Get wallet addresses (EOA + Sequence smart wallet) npx @0xsequence/builder-cli wallet-info -k <private-key> -a <access-key> --json # 5. Fund the Sequence wallet via the Trails link from step 4 # 6. Send an ERC20 transfer npx @0xsequence/builder-cli transfer \ -k <private-key> -a <access-key> \ -t <token-address> -r <recipient> \ -m <amount> -c <chain-id> --json ``` ### Technical Analysis The Skill executes `@0xsequence/builder-cli` through `npx` without specifying an exact package version. No lockfile, package integrity hash, vendored implementation, or other provenance control is present in the audited project. Consequently, the code executed during a future Skill invocation may differ from the code that existed when the Skill was reviewed. This is especially sensitive because the package receives wallet private keys and access keys and performs authentication and blockchain transactions. The documentation does not establish that the current upstream package is malicious. The vulnerability is the absence of controls preventing a compromised, replaced, or unexpectedly changed package release from being executed automatically. ### Attack Path 1. An attacker compromises the package publisher, npm account, package distribution process, or a future package release. 2. The attacker publishes a modified version under the same package name. 3. A use ...[truncated 1012 chars]
• Remediation: ## Remediation Suggestions 1. Pin the CLI to a reviewed, exact version rather than resolving the latest available release: ```bash npx --yes @0xsequence/builder-cli@<exact-reviewed-version> create-wallet --json ``` 2. Prefer installation through a committed `package.json` and lockfile containing npm integrity metadata. 3. Execute the locally locked binary, such as through `npm exec --offline` where operationally practical. 4. Verify package provenance, publisher identity, release signatures, and integrity before updating. 5. Review dependency changes before accepting a new package version. 6. Run the CLI with least privilege and isolate it from unrelated credentials and sensitive files. 7. Add explicit guidance that agents must not approve package updates automatically during security-critical wallet operations.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:170
• Finding: Wallet Private Keys and Access Keys Are Passed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 170-184; equivalent patterns also appear at lines 35, 41, 47, 96, and 117 **Vulnerability Type**: Exposure of sensitive credentials through process arguments **Risk Level**: High **Vulnerable Code**: ```bash npx @0xsequence/builder-cli transfer \ -k <private-key> \ -a <access-key> \ -t <token-address> \ -r <recipient-address> \ -m <amount> \ -c <chain-id> \ --json ``` ```text - `-k, --private-key <key>` — Wallet private key (optional if stored) - `-a, --access-key <key>` — Project access key (required) ``` ### Technical Analysis The primary examples instruct users to provide wallet private keys and project access keys directly as command-line arguments. Command-line arguments are not an appropriate secret transport mechanism because they may be exposed through shell history, process inspection interfaces, endpoint monitoring, audit facilities, diagnostic captures, or automation logs. The Skill separately documents encrypted local key storage, but it does not make that mechanism mandatory and repeatedly presents `-k <private-key>` as a normal workflow. It also does not document process-argument exposure or provide a protected input mechanism for access keys. A wallet private key is particularly sensitive because possession can authorize signatures and transactions for the corresponding account. The practical authority of a project access key depends on the permissions granted by the external service. ### Attack Path 1. A user or agent follows the documented login, wallet-information, or transfer example. 2. The wallet private key and access key are inserted into the command line. 3. The command is recorded in shell history, agent execution logs, telemetry, or process metadata. 4. Another local user, administrator, monitoring operator, log consumer, or process with sufficien ...[truncated 950 chars]
• Remediation: ## Remediation Suggestions 1. Remove private-key-bearing command examples and make protected key storage the default workflow. 2. Support secret input through standard input, an interactive hidden prompt, an operating-system keychain, or a dedicated secret manager rather than command-line arguments. 3. If encrypted local storage is used, enforce restrictive permissions on `~/.sequence-builder/config.json` and its parent directory. 4. Do not place passphrases directly in shell commands. Load them from an approved secret manager or protected runtime channel. 5. Prevent command tracing and redact private keys, access keys, JWTs, and passphrases from agent logs, telemetry, errors, and JSON output. 6. Document that users who previously supplied secrets through command-line arguments should remove affected shell history and logs and rotate potentially exposed keys. 7. Use separate, least-privileged project access keys and establish expiration and rotation procedures. 8. Add a pre-transfer confirmation that displays the chain, token, amount, and recipient without exposing signing credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Session Persistence

Medium

• Category: Rogue Agent

Content

# Sequence Builder CLI

CLI for Sequence Builder — designed for AI agents and automation. Create wallets, authenticate, manage projects, query blockchain data, and send ERC20 transfers from the command line.

All commands support `--json` for machine-readable output. Always use `--json` when parsing results programmatically.

• Confidence: 81% confidence
• Finding: The skill is designed for authentication and automation and encourages stateful use across commands, which implies persistence of auth material and wallet context. In an agent setting, persistent sessions can be reused unintentionally across tasks or users, leading to unauthorized actions or cross-context leakage if isolation is weak.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs users to pass raw private keys on the command line and to store them locally, but it does not prominently warn that these secrets grant full control of blockchain assets. Command-line arguments can be exposed through shell history, process listings, logs, or agent traces, making secret leakage especially dangerous in an AI automation context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The transfer workflow enables live ERC20 asset movement but does not clearly warn that transfers may be irreversible, may send funds to the wrong address, and may consume token balance for gas. In an agent skill, omission of this warning increases the chance of accidental asset loss through automation or mis-parameterization.

Session Persistence

Medium

• Category: Rogue Agent

Content

npx @0xsequence/builder-cli create-wallet --json
# Save the output — privateKey and address
npx @0xsequence/builder-cli login --json
npx @0xsequence/builder-cli projects create "My App" --json
# Note the accessKey from the output
npx @0xsequence/builder-cli wallet-info -a <access-key> --json
# Fund the sequenceWalletAddress via the fundingUrl

• Confidence: 84% confidence
• Finding: The workflow tells the operator to save the private key and access key, reinforcing long-lived retention of highly sensitive credentials without equivalent guidance on compartmentalization, rotation, or secure disposal. In an AI-assisted environment, saved outputs may end up in transcripts, logs, or shared memory, enabling later misuse.

Static analysis

No suspicious patterns detected.