Auto Respawn

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:47 AM UTC
• Version: 1.2.1

Overview

This skill is transparent about managing blockchain wallets, but it needs Review because it can automatically sign fee-bearing on-chain memory updates and handles wallet secrets without strong built-in safeguards.

Install only if you are comfortable giving the skill access to encrypted wallet files and authority to sign Autonomys and Auto-EVM transactions. Do not allow automatic anchoring on mainnet unless you have explicitly approved that workflow, verify the network and contract address, use a low-balance or testnet wallet first, and avoid typing recovery phrases or passphrases where terminal input may be recorded or visible.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:151
• Finding: Automatic On-Chain Anchoring Can Bypass Explicit User Confirmation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:151-159` **Conflicting Security Requirement**: `SKILL.md:437` **Vulnerability Type**: Automatic authorization of a state-changing, fee-bearing wallet operation **Risk Level**: Medium ### Vulnerable Instruction ```markdown ## Integration with Auto-Memory If the **auto-memory** skill is also installed, you should anchor the new head CID on-chain after every memory save. This keeps the on-chain pointer current and ensures full resurrection is always possible from just your EVM address. **Behaviour:** After each `automemory-save-memory.sh` call returns a new CID, immediately run: ```bash npx tsx auto-respawn.ts anchor --from <wallet-name> --cid <new-cid> ``` This should be automatic — do not wait for the user to ask. The two skills together form a complete resurrection loop: auto-memory handles permanent storage, auto-respawn handles on-chain discovery. ``` This conflicts with the later requirement at `SKILL.md:437`: ```markdown - **Always confirm transfers and anchor operations with the user before executing.** Tokens have real value on mainnet. ``` ### Technical Analysis The Skill explicitly instructs an agent to execute `anchor` automatically after receiving a CID from another Skill. Anchoring decrypts an EVM wallet key and submits a state-changing transaction to a smart contract. It consumes gas and replaces the recovery head associated with the wallet address. The instruction to proceed automatically and “do not wait for the user to ask” directly contradicts the later confirmation requirement. Because the automatic instruction is attached to the integration workflow, an agent may treat the output of `auto-memory` as sufficient authorization even when the user has not reviewed the CID, selected the network, verified the contract address, or approved the transaction fee. The executable CLI does not independently enforce confirmation. Once invoked, `handleAnchor` loads the private key a ...[truncated 1846 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction stating that anchoring should occur automatically without user approval. 2. Require explicit, contemporaneous confirmation before every anchor transaction. 3. Present the following information before requesting confirmation: - Wallet name and EVM address. - Selected network. - MemoryChain contract address. - New CID. - Existing head CID, if any. - Estimated gas fee and available balance. 4. Validate the CID syntax and expected multibase/multicodec format before signing. 5. Require additional confirmation when replacing a non-empty existing head. 6. Add a CLI-level confirmation mechanism so safety does not depend solely on agent instructions. For automation, require an explicit option such as `--yes` or a narrowly scoped policy configured by the user. 7. Make the documentation internally consistent by applying the “always confirm” requirement to transfers, bridging, remarks, and anchoring examples. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: lib/wallet.ts:100
• Finding: Interactive Wallet Secrets Are Echoed in the Terminal<![CDATA[ ## Vulnerability Details **File Locations**: `lib/wallet.ts:100-108` and `lib/wallet.ts:141-150` **Vulnerability Type**: Unmasked interactive entry of wallet passphrases and recovery phrases **Risk Level**: Medium ### Vulnerable Code Passphrase prompt at `lib/wallet.ts:100-108`: ```ts // 3. Interactive stdin prompt if (process.stdin.isTTY) { return new Promise<string>((resolve, reject) => { const rl = createInterface({ input: process.stdin, output: process.stderr }) rl.question('Passphrase: ', (answer) => { rl.close() if (!answer) reject(new Error('No passphrase provided')) else resolve(answer) }) }) } ``` Recovery-phrase prompt at `lib/wallet.ts:141-150`: ```ts if (process.stdin.isTTY) { return new Promise<string>((resolve, reject) => { const rl = createInterface({ input: process.stdin, output: process.stderr }) rl.question('Recovery phrase: ', (answer) => { rl.close() const trimmed = answer.trim() if (!trimmed) reject(new Error('No mnemonic provided')) else resolve(trimmed) }) }) } ``` ### Technical Analysis Node.js `readline.question()` does not mask terminal input. Characters entered by the user are normally echoed to the terminal. Both affected values are high-value secrets: - The passphrase decrypts locally stored consensus and EVM wallet keys. - The mnemonic recovery phrase can reconstruct the wallet independently of the encrypted keyfiles. Although the Skill avoids placing these values in command-line arguments for its recommended workflow, the interactive implementation exposes them visually. This is inconsistent with the stated requirement to never log or expose recovery phrases or passphrases. The issue does not require code injection. Exploitation depends on observing or recording the terminal during secret entry. ### Attack Path 1. A user imports a wallet interactively or runs a signing operation without an environment or file-based passphrase. 2. The CL ...[truncated 1255 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `readline.question()` for secret input with a maintained password-prompt implementation that disables terminal echo. 2. Ensure terminal settings are restored in all cases, including: - Successful input. - Validation errors. - Exceptions. - `SIGINT`, `SIGTERM`, and unexpected process termination. 3. Mask both the wallet passphrase and recovery phrase, not only the passphrase. 4. Continue supporting stdin for non-interactive mnemonic import, but document that input files containing recovery phrases must be protected and securely deleted when no longer needed. 5. Prefer dedicated file descriptors or secret-management integrations for automated environments. 6. Add tests using a pseudo-terminal to verify that entered secrets are not echoed. 7. Avoid retaining secrets longer than necessary and clear mutable buffers where practical, recognizing that JavaScript strings cannot be reliably zeroized. ]]>

T08 · Insecure Dependencies

Note

• Location: package.json:10
• Finding: Unpinned Dependency Installation Permits Unreviewed Supply-Chain Changes<![CDATA[ ## Vulnerability Details **File Locations**: `package.json:10-24`, `setup.sh:38-40`, and `setup.sh:64-68` **Vulnerability Type**: Non-reproducible installation of third-party packages **Risk Level**: Low ### Vulnerable Configuration and Code Dependency ranges in `package.json:10-24`: ```json "dependencies": { "@autonomys/auto-consensus": "^1.6.9", "@autonomys/auto-utils": "^1.6.9", "@autonomys/auto-xdm": "^1.6.9", "ethers": "^6.16.0" }, "devDependencies": { "@eslint/js": "^10.0.1", "@typescript-eslint/eslint-plugin": "^8.56.1", "@typescript-eslint/parser": "^8.56.1", "eslint": "^10.0.2", "tsx": "^4.19.0", "typescript": "^5.8.0", "typescript-eslint": "^8.56.1", "vitest": "^4.0.18" } ``` Dependency installation in `setup.sh:38-40`: ```bash # Install dependencies echo "Installing dependencies..." (cd "$SCRIPT_DIR" && "$PKG_MANAGER" install) echo "" ``` Tool resolution and global installation in `setup.sh:64-68`: ```bash # Check for tsx if ! command -v tsx &>/dev/null && ! npx tsx --version &>/dev/null 2>&1; then echo "Installing tsx (TypeScript executor)..." "$PKG_MANAGER" install -g tsx else echo "✓ tsx available" fi ``` No package-manager lockfile was present in the audited project. ### Technical Analysis Caret version ranges permit later compatible releases to be selected at installation time. Without a reviewed lockfile, the resolved dependency graph and integrity hashes may differ between installations. The setup script uses a normal package-manager `install` operation rather than a frozen or clean installation. It also invokes `npx tsx`, which may retrieve a package from the configured registry if no suitable local package is available, and may globally install `tsx`. Node package installation can execute package lifecycle scripts with the privileges of the user running setup. This is particularly sensitive because the Skill later handles encrypted wallet files and passphrases in the same user account. No ...[truncated 1609 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Generate and commit a reviewed package-manager lockfile containing resolved versions and integrity hashes. 2. Use a reproducible installation command such as `npm ci` instead of `npm install` in the setup script. 3. Pin security-critical runtime dependencies to exact versions where operationally practical. 4. Invoke the project-local executable, such as `./node_modules/.bin/tsx`, rather than allowing `npx` to retrieve an unreviewed package dynamically. 5. Avoid global package installation. Declare all required tooling in the project and execute it locally. 6. Review lockfile changes as part of every release and use automated dependency scanning. 7. Consider disabling lifecycle scripts during initial dependency acquisition with `--ignore-scripts`, then explicitly permit only reviewed build steps where compatible. 8. Document the expected package manager and version so different managers do not produce divergent dependency graphs. 9. Verify package provenance, registry configuration, and integrity before releases involving wallet-signing functionality. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (127)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Arbitrary token transfer capability is highly sensitive and not justified by the advertised 'auto-respawn' memory/identity function. If an agent is granted access to this skill and wallet material, an attacker can coerce the agent into transferring or bridging funds to attacker-controlled addresses, causing direct asset loss.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements direct native-token transfer capability, which is materially outside the declared purpose of identity/memory resurrection. In an agent skill, adding wallet-draining or value-transfer primitives under an unrelated feature banner increases the chance of deceptive use, misuse by higher-level prompts, or accidental invocation with real funds.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: A skill advertised for auto-respawn/identity persistence should not silently include financial asset transfer logic, because that creates a dangerous mismatch between user/operator expectations and actual authority. In agent environments, hidden or unrelated payment functions can be exploited by prompt injection, orchestration mistakes, or malicious wrappers to move real assets without informed consent.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The file reads process.env.AUTO_RESPAWN_CONTRACT_ADDRESS to override the on-chain contract address, which is an undeclared environment capability. If an attacker or unsafe deployment environment controls this variable, the skill can be redirected to a malicious contract, causing reads from untrusted state or signed writes to the wrong destination. In a skill whose purpose is to persist and recover identity/memory on-chain, this is more dangerous because contract-address integrity is foundational to trust and recovery.

Credential Access

High

• Category: Privilege Escalation

Content

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.