Maiat Trust API

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:18 PM UTC
• Version: 2.4.0

Overview

This skill is mostly aligned with agent trust workflows, but it needs Review because it links wallet identities, wraps wallet transactions with a third-party package, and sends reputation/threat data to an external service.

Review before installing in any wallet-bearing or production agent. Use a dedicated wallet or pseudonymous identity, pin and audit the npm packages before use, confirm what transaction and report data Maiat receives, and avoid enabling automatic blocking/reporting unless its privacy, failure, and appeal behavior match your risk tolerance.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:167
• Finding: Unpinned Third-Party Dependencies Create a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:167` and `SKILL.md:291` **Vulnerability Type**: Unpinned npm dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npm install @jhinresh/viem-guard viem ``` ```bash npm install @jhinresh/maiat-sdk ``` ### Technical Analysis The Skill instructs users or agents to install third-party npm packages without exact version constraints or verified integrity hashes. Consequently, package resolution can select whatever release is current at installation time rather than a specific release that was reviewed alongside the Skill. npm packages may execute code through lifecycle scripts during installation and through imported modules at runtime. A compromised maintainer account, malicious future release, package registry compromise, or dependency-chain compromise could therefore change the effective behavior after this Skill has been audited. This is particularly sensitive for `@jhinresh/viem-guard` because the package is intended to wrap a wallet client and participate directly in transaction processing. ### Attack Path 1. An attacker compromises a package maintainer, package release process, or transitive dependency. 2. The attacker publishes a malicious release under one of the documented package names. 3. An agent follows the Skill and runs an unpinned `npm install` command. 4. npm resolves and installs the malicious release. 5. Malicious lifecycle or runtime code executes with the privileges of the installing process. 6. The code may inspect application data, monitor wallet operations, alter transaction parameters, or exfiltrate accessible credentials. ### Impact Assessment Successful exploitation could execute arbitrary JavaScript with the privileges of the agent or application process. Depending on the host environment and wallet architecture, this could expose configuration data, API credentials, transaction metadata, or wallet requests. A dependency operating on the wallet transact ...[truncated 92 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin every direct dependency to an exact, reviewed version rather than relying on the latest release. - Commit and enforce a lockfile containing registry integrity hashes. - Use deterministic installation commands such as `npm ci`. - Review package source, release provenance, maintainers, and transitive dependencies before deployment. - Use npm provenance or equivalent signed-artifact verification where supported. - Disable lifecycle scripts with `--ignore-scripts` when they are not required. - Run wallet-related dependencies in a restricted environment with minimal filesystem, network, and secret access. - Add automated dependency auditing and alerting for unexpected maintainer, version, or integrity changes. ]]>

T07 · Tool Hijacking and Spoofing

Warning

• Location: SKILL.md:171
• Finding: Third-Party Wrapper Intercepts Wallet Transactions and Performs External Reporting<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:171-185` **Vulnerability Type**: Wallet tool wrapping and external transaction gating **Risk Level**: Medium ### Vulnerable Code ```typescript import { withMaiatTrust } from '@jhinresh/viem-guard' const wallet = withMaiatTrust(walletClient, { minScore: 60, // block txs to low-trust addresses antiPoison: true, // detect address poisoning attacks }) // Every sendTransaction is now trust-gated await wallet.sendTransaction({ to, value }) ``` ```text What Guard does: 1. Trust Check — queries Maiat before every tx. Low trust → blocks 2. Anti-Poisoning — detects vanity match + dust liveness attacks 3. Threat Reporting — blocked attacks are reported to the network 4. Collective Immunity — all Guard-protected agents get instant protection ``` ### Technical Analysis The Skill directs the user to replace the normal wallet interface with a third-party wrapper. This wrapper is positioned directly on the transaction path and is documented as querying a remote service before every transaction, blocking transactions according to remote trust results, and reporting blocked activity to an external network. The audited project contains only documentation and does not include the wrapper implementation. Therefore, the exact data transmitted, transaction mutation protections, failure behavior, and reporting boundaries cannot be verified from the reviewed artifact. A wrapper around `sendTransaction` has access to transaction recipients and values and may have access to additional wallet-client context. If the package or remote decision service is compromised, manipulated, or unexpectedly changed, legitimate wallet calls could be censored, monitored, or potentially altered. ### Attack Path 1. An agent installs the recommended package and wraps its wallet client with `withMaiatTrust`. 2. Application code invokes the wrapped `sendTransaction` method. 3. The wrapper intercepts the recipient, value, an ...[truncated 913 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Independently audit the wallet wrapper and all code paths that intercept `sendTransaction`. - Document the exact fields sent to Maiat for trust checks and threat reports. - Make external threat reporting explicitly opt-in and obtain user consent before transmitting transaction-derived data. - Minimize, redact, or hash transaction metadata wherever possible. - Ensure the wrapper cannot mutate recipient, value, calldata, chain ID, fees, or other transaction fields. - Require the underlying wallet to display and confirm the final serialized transaction independently. - Define secure outage behavior and allow users to choose fail-open or fail-closed behavior based on their threat model. - Authenticate remote responses and protect API communication against replay and tampering. - Pin the wrapper to an audited version and isolate it from unrelated credentials and host resources. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:31
• Finding: Unnecessary External Registration and Persistent Wallet-Identity Linking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:31-39` and `SKILL.md:83-89` **Vulnerability Type**: Excessive collection and persistence of wallet-linked identity data **Risk Level**: Medium ### Vulnerable Code ```markdown ## Register First Every agent needs a Maiat Passport — your on-chain identity. ```bash curl -X POST https://app.maiat.io/api/v1/passport/register \ -H "Content-Type: application/json" \ -d '{"ensName": "my-agent", "walletAddress": "0xYourWallet", "type": "agent"}' ``` ``` ```markdown **Recommended:** Save your passport to memory or config: ```json { "ensName": "my-agent", "ensFullName": "my-agent.maiat.eth", "walletAddress": "0x..." } ``` ``` ### Technical Analysis The Skill presents registration with an external service as a prerequisite and submits an agent name, wallet address, and agent type to that service. It subsequently recommends persisting the resulting passport information in memory or configuration. Read-only trust and token checks documented elsewhere in the same Skill do not inherently require creating a wallet-linked identity. Requiring registration for general use therefore exceeds the minimum data scope needed for those operations. Although blockchain wallet addresses are public identifiers, connecting one to a stable agent name and storing that association creates additional correlation and privacy exposure. The Skill does not specify consent controls, retention limits, storage protections, or whether the proposed memory or configuration is encrypted. ### Attack Path 1. An agent loads the Skill and follows the “Register First” instruction. 2. The agent submits its chosen identity and wallet address to the external Maiat endpoint. 3. The service creates a durable association between the agent identity and wallet. 4. The agent stores the passport, including the wallet address, in memory or a configuration file. 5. The remote association or locally persisted configuration is later accessed, ...[truncated 671 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make registration explicitly optional for operations that only require public trust or token queries. - Obtain informed user consent before transmitting a wallet address or creating a persistent identity association. - Clearly document what data is collected, whether it becomes public or on-chain, how long it is retained, and how it may be deleted. - Persist only fields required for subsequent operations. - Avoid writing wallet-linked identity data to general-purpose agent memory. - Store required configuration with restrictive filesystem permissions and encryption where appropriate. - Prevent passport data from being included in logs, telemetry, repositories, backups, or unrelated model context. - Support separate identities or privacy-preserving identifiers when a stable wallet-to-agent association is unnecessary. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs users to register an on-chain identity by submitting an ENS-style name and wallet address to an external service without a prominent privacy warning. Because the action creates persistent public linkage and external disclosure of identity data, users may unintentionally deanonymize agents or operators and expose long-lived attribution metadata.

External Transmission

Medium

• Category: Data Exfiltration

Content

Every agent needs a Maiat Passport — your on-chain identity.

```bash
curl -X POST https://app.maiat.io/api/v1/passport/register \
  -H "Content-Type: application/json" \
  -d '{"ensName": "my-agent", "walletAddress": "0xYourWallet", "type": "agent"}'
```

• Confidence: 91% confidence
• Finding: This is a real external transmission point because the example sends ENS and wallet identity data to a remote API for registration. In the context of a trust/identity skill, such transmission is expected, but it remains security-relevant because it shares sensitive identifiers with a third party and may establish persistent public identity linkage.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Lookup Any Passport
```bash
curl https://app.maiat.io/api/v1/passport/lookup?q=agent-name
```

### Deep Agent Profile

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The Guard section promotes automatic transaction blocking and threat reporting but does not prominently disclose that transaction intent, counterparties, and threat telemetry may be sent to an external service for evaluation. In a wallet-protection context this is sensitive operational data, and silent blocking/reporting can surprise users and affect financial operations or privacy.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill strongly encourages always reporting outcomes with a wallet identifier, but does not warn that this sends job/activity metadata tied to the reporter address to an external service. This can create a detailed behavioral trail linking agent activity, counterparties, and success/failure outcomes to a persistent identity.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The manifest describes the skill as trust infrastructure for registering agent identities, checking agent trust scores, and protecting transactions between agents. However, the file also exposes substantial token-analysis functionality, including honeypot detection, rug-pull prediction, liquidity analysis, and multi-source token forensics, which goes beyond verifying another agent before transacting.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The threat-reporting flow allows user-submitted reports to contribute to ecosystem-wide blocking after three reports, yet it does not clearly warn about the downstream consequences or external sharing of submitted intelligence. Without strong disclosure and safeguards, users may unknowingly participate in actions that affect third parties at network scale and expose sensitive investigative data.

External Transmission

Medium

• Category: Data Exfiltration

Content

Report malicious addresses to protect the entire network:

```bash
curl -X POST https://app.maiat.io/api/v1/threat/report \
  -H "Content-Type: application/json" \
  -d '{"maliciousAddress": "0x...", "threatType": "address_poisoning"}'
```

• Confidence: 90% confidence
• Finding: This is a true external transmission because it sends threat intelligence about an address to a third-party API, and the resulting reports can influence blocking decisions across the ecosystem. The sensitivity is increased by the combination of external disclosure, possible reputational harm to third parties, and insufficient warning about network-wide effects.

Description-Behavior Mismatch

Low

• Confidence: 80% confidence
• Finding: The manifest frames the skill around identity, trust-score lookup, and transaction protection, but the documented functionality also includes outcome reporting, review submission, scarab balance checks, threat reporting, and agent reputation services. These features materially expand the skill from a verifier/protector into a broader reputation and feedback network.

Static analysis

No suspicious patterns detected.