ClawHub
Back to skill

Security audit

Bluepages

Security checks for vulnerabilities and agentic risk

Overview

This skill is for wallet identity lookups, but it asks users to run an unpinned remote MCP server that may receive an Ethereum private key and payment authority.

Review before installing. Prefer BLUEPAGES_API_KEY over PRIVATE_KEY, avoid using any wallet with meaningful funds or approvals, and only run a pinned or audited MCP version in a constrained environment. Treat credit purchases and x402 payments as financial actions that need explicit user control.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:15
Finding

Unpinned Remote MCP Dependency Can Access Ethereum Private Keys and Payment Authority

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:15, SKILL.md:26, SKILL.md:31-39, and SKILL.md:61-62
Vulnerability Type: Unpinned third-party dependency executed from a mutable remote source
Risk Level: High

Vulnerable code snippets:

yaml
install:
  - kind: node
    package: "github:bluepagesdoteth/bluepages-mcp"
markdown
Requires the Bluepages MCP server: `npx -y github:bluepagesdoteth/bluepages-mcp`
or direct API calls (see below). The MCP server is the recommended way to use Bluepages.
markdown
Requires one of these env vars:

- **`BLUEPAGES_API_KEY`** (recommended) — 20% cheaper, 2x rate limits.
- **`PRIVATE_KEY`** — Ethereum private key for x402 pay-per-request (USDC on Base).

> **Security note**: Never use a main wallet key. Use a dedicated, funded-only-as-needed agent wallet if providing `PRIVATE_KEY`.

**With a private key**, you can either pay per request via x402 or purchase a `BLUEPAGES_API_KEY` using the `get_api_key` and `purchase_credits` MCP tools.
markdown
| `get_api_key`              | free         | Get/create API key via wallet signature         |
| `purchase_credits`         | $5–$600 USDC | Buy credits via x402 (PRIVATE_KEY only)          |

Technical Analysis

The Skill instructs users to execute an MCP server directly from a GitHub repository using npx -y. The dependency is not pinned to an immutable commit, verified release, or integrity digest. Consequently, the code executed during a future installation can differ from the code that existed when the Skill was reviewed.

The same MCP process may receive the PRIVATE_KEY environment variable. An Ethereum private key is not merely an authentication token: it grants cryptographic signing authority over the associated wallet. The documented MCP functionality also includes x402 payments and credit purchases of up to $600 USDC. A compromised upstream repository, maintainer acc ...[truncated 2239 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the MCP dependency to an audited immutable commit hash or a specific signed release rather than a mutable GitHub repository reference.
  2. Publish and verify a cryptographic integrity digest for the package and lock all transitive dependencies with an appropriate lockfile.
  3. Prefer BLUEPAGES_API_KEY over exposing an Ethereum private key to the MCP process.
  4. If blockchain signing is required, replace direct PRIVATE_KEY access with an isolated signer or wallet service that enforces:
    • Base-network-only transactions.
    • Explicit destination and contract allowlists.
    • Asset restrictions.
    • Per-transaction and cumulative spending limits.
    • Transaction simulation and validation.
    • Explicit user approval for credit purchases and other value transfers.
  5. Run the MCP server in a sandbox with minimal filesystem, environment, network, and operating-system permissions. Pass only the credential required for the current operation.
  6. Use a dedicated wallet with minimal funds and no valuable approvals, periodically rotate its credentials, and revoke unnecessary token allowances.
  7. Audit the pinned MCP source and its dependency tree before deployment, and establish monitoring for upstream ownership, release, and dependency changes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation guidance says to use the skill for "who owns a wallet," "looking up 0x addresses," and "any wallet identity and address attribution queries," which is quite expansive and lacks clear boundaries. There are no exclusion conditions or negative examples to clarify when this skill should not be invoked, increasing the risk of unintended activation for common lookup requests.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The skill installs and runs an MCP server directly from a GitHub reference via npx without pinning to an immutable version or commit. That creates a supply-chain risk: upstream changes, account compromise, or a malicious force-push could cause agents to fetch and execute different code than was reviewed, potentially exposing configured secrets such as BLUEPAGES_API_KEY or PRIVATE_KEY.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The setup instructions again direct users to execute code from an unpinned GitHub source using npx -y github:..., which means the fetched MCP server can change after review. In this skill, that risk is amplified because the server is expected to handle authentication material including an API key or an Ethereum PRIVATE_KEY, so a compromised upstream could exfiltrate credentials or abuse wallet funds.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

bash
# With API key
curl "https://bluepages.fyi/check?address=0x..." -H "X-API-KEY: your-key"
curl "https://bluepages.fyi/data?address=0x..." -H "X-API-KEY: your-key"

# Batch check

Static analysis

No suspicious patterns detected.