Security audit

Auto Bug Finder

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Solidity scanner/fixer, but it gives itself mandatory workflow authority and can automatically rewrite smart-contract source files without clear user control.

Install only after reviewing the script and running it in a clean disposable branch or sandbox. Do not run it on untrusted projects or production worktrees with secrets in the environment, and treat generated contract edits as unreviewed changes that require manual diff review before use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:56
Finding: Mandatory Policy Text Hijacks Agent Workflow and Completion Decisions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: auto-bug-finder.js:598
Finding: Failed Verification Leaves Modified Contract in Place and Deletes Its Backup
Content: View full analysis
p.applied)) { // Create backup fs.writeFileSync(CONTRACT_PATH + '.bak', fs.readFileSync(CONTRACT_PATH, 'utf-8')); fs.writeFileSync(CONTRACT_PATH, contractSource); console.log(`\n 💾 Contract updated with ${patches.filter(p => p.applied).length} patches`); } ``` A failed verification only stops the loop; it does not restore the source: ```javascript } else if (verification?.tests?.newFailures > 0) { console.log('\n⚠️ New test failures introduced. Stopping.'); keepGoing = false; } ``` The backup is subsequently deleted unconditionally: ```javascript // Clean up backups const backupPath = CONTRACT_PATH + '.bak'; if (fs.existsSync(backupPath)) { fs.unlinkSync(backupPath); } ``` ### Technical Analysis The scanner writes generated changes directly into `AgentEscrow.sol` before the complete verification outcome is known. If verification identifies new test failures, execution stops but no rollback occurs. At the end of the run, the backup is deleted regardless of whether verification succeeded. In addition, each sprint writes to the same `.bak` path. A later sprint can overwrite the previous backup with an already-modified contract, so the original source may be lost even before final cleanup. This violates transactional update principles: a change should be staged, verified, and committed only after all security gates pass. A failed verification must preserve or restore the last known-good state. ### Attack Path 1. A heuristic or Slither finding causes `generateFixes` to produce an automatic patch. 2. The scanner saves a backup a ...[truncated 1155 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: auto-bug-finder.js:70
Finding: Unpinned Tool Installation and npx Execution Expose the Scanner to Supply-Chain Code Execution
Content: View full analysis
&1'); ``` ```javascript const coverageResult = await runCommand('npx hardhat coverage 2>&1', { timeout: 180000 }); ``` Verification repeats the same execution pattern: ```javascript const compileResult = await runCommand('npx hardhat compile --force'); ``` ```javascript const testResult = await runCommand('npx hardhat test 2>&1'); ``` ### Technical Analysis Neither the documented Slither installation nor the executable invocation establishes a reviewed and reproducible tool version. Installing `slither-analyzer` without a version constraint retrieves whichever release the package index currently resolves. Likewise, `npx hardhat` may resolve a project-local executable and, depending on the environment and npm configuration, may offer to retrieve a package when the executable is absent. Hardhat compilation and testing also execute JavaScript controlled by the scanned project, including Hardhat configuration, plugins, test files, and dependency lifecycle behavior. Running the scanner on an untrusted project therefore constitutes code execution rather than passive static inspection. Although no malicious dependency is embedded in the audited package, the res ...[truncated 1462 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
Edit the config at the top of `auto-bug-finder.js`:

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The comment says a design-changing finding should not be auto-fixed because it may break tests, but the later fix logic still auto-applies the self-escrow check if that finding reaches applyFix. In a code-rewriting agent, this contradiction can silently introduce unauthorized behavior changes, break expected contract semantics, or create denial-of-service conditions for valid workflows.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module header describes an analyze/find issues/generate fixes/test loop, which suggests producing fixes as outputs. In reality, the code goes beyond generation and actively modifies contracts/AgentEscrow.sol, creates backups, restores prior versions, and writes multiple report artifacts to disk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script overwrites contracts/AgentEscrow.sol automatically after generating patches, with no user confirmation or safe staging workflow. In the context of an agent skill that edits security-sensitive smart contracts, this is dangerous because a flawed heuristic or false positive can directly alter source code, introduce vulnerabilities, or corrupt the repository state before human review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script deletes backup and analysis files automatically during cleanup, without confirmation or retention policy. In this context that is risky because it can remove the only easy rollback artifact (.bak) and erase evidence needed to audit what the agent changed, making unsafe modifications harder to detect and recover from.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description says it scans and fixes code, but it does not prominently warn that it will generate patches and write multiple artifacts into the target project directory. That can surprise users, alter repository state, and create unintended commits or overwrites, especially when run in production or CI contexts. The context makes this more concerning because the skill is positioned as a mandatory security gate and iterative fixer, increasing the likelihood that users run it automatically and trust it to make filesystem changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script creates patch markdown files and later writes sprint results and a final report, which are file-writing operations affecting the workspace. While these writes are part of the tool's behavior, the code does not clearly disclose up front that multiple output files will be created or overwritten during execution.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: auto-bug-finder.js:39