Auto Respawn

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:47 AM UTC
• Version: 1.2.1

Overview

This skill is transparent about managing blockchain wallets, but it needs Review because it can automatically sign fee-bearing on-chain memory updates and handles wallet secrets without strong built-in safeguards.

Install only if you are comfortable giving the skill access to encrypted wallet files and authority to sign Autonomys and Auto-EVM transactions. Do not allow automatic anchoring on mainnet unless you have explicitly approved that workflow, verify the network and contract address, use a low-balance or testnet wallet first, and avoid typing recovery phrases or passphrases where terminal input may be recorded or visible.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:151

Finding

Automatic On-Chain Anchoring Can Bypass Explicit User Confirmation

Content

View full analysis

--cid ``` This should be automatic — do not wait for the user to ask. The two skills together form a complete resurrection loop: auto-memory handles permanent storage, auto-respawn handles on-chain discovery. ``` This conflicts with the later requirement at `SKILL.md:437`: ```markdown - **Always confirm transfers and anchor operations with the user before executing.** Tokens have real value on mainnet. ``` ### Technical Analysis The Skill explicitly instructs an agent to execute `anchor` automatically after receiving a CID from another Skill. Anchoring decrypts an EVM wallet key and submits a state-changing transaction to a smart contract. It consumes gas and replaces the recovery head associated with the wallet address. The instruction to proceed automatically and “do not wait for the user to ask” directly contradicts the later confirmation requirement. Because the automatic instruction is attached to the integration workflow, an agent may treat the output of `auto-memory` as sufficient authorization even when the user has not reviewed the CID, selected the network, verified the contract address, or approved the transaction fee. The executable CLI does not independently enforce confirmation. Once invoked, `handleAnchor` loads the private key a ...[truncated 1846 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: lib/wallet.ts:100

Finding

Interactive Wallet Secrets Are Echoed in the Terminal

Content

View full analysis

((resolve, reject) => { const rl = createInterface({ input: process.stdin, output: process.stderr }) rl.question('Passphrase: ', (answer) => { rl.close() if (!answer) reject(new Error('No passphrase provided')) else resolve(answer) }) }) } ``` Recovery-phrase prompt at `lib/wallet.ts:141-150`: ```ts if (process.stdin.isTTY) { return new Promise((resolve, reject) => { const rl = createInterface({ input: process.stdin, output: process.stderr }) rl.question('Recovery phrase: ', (answer) => { rl.close() const trimmed = answer.trim() if (!trimmed) reject(new Error('No mnemonic provided')) else resolve(trimmed) }) }) } ``` ### Technical Analysis Node.js `readline.question()` does not mask terminal input. Characters entered by the user are normally echoed to the terminal. Both affected values are high-value secrets: - The passphrase decrypts locally stored consensus and EVM wallet keys. - The mnemonic recovery phrase can reconstruct the wallet independently of the encrypted keyfiles. Although the Skill avoids placing these values in command-line arguments for its recommended workflow, the interactive implementation exposes them visually. This is inconsistent with the stated requirement to never log or expose recovery phrases or passphrases. The issue does not require code injection. Exploitation depends on observing or recording the terminal during secret entry. ### Attack Path 1. A user imports a wallet interactively or runs a signing operation without an environment or file-based passphrase. 2. The CL ...[truncated 1255 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: package.json:10

Finding

Unpinned Dependency Installation Permits Unreviewed Supply-Chain Changes

Content

View full analysis

/dev/null && ! npx tsx --version &>/dev/null 2>&1; then echo "Installing tsx (TypeScript executor)..." "$PKG_MANAGER" install -g tsx else echo "✓ tsx available" fi ``` No package-manager lockfile was present in the audited project. ### Technical Analysis Caret version ranges permit later compatible releases to be selected at installation time. Without a reviewed lockfile, the resolved dependency graph and integrity hashes may differ between installations. The setup script uses a normal package-manager `install` operation rather than a frozen or clean installation. It also invokes `npx tsx`, which may retrieve a package from the configured registry if no suitable local package is available, and may globally install `tsx`. Node package installation can execute package lifecycle scripts with the privileges of the user running setup. This is particularly sensitive because the Skill later handles encrypted wallet files and passphrases in the same user account. No ...[truncated 1609 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (127)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This mismatch is credible because the description emphasizes persistent identity and memory recovery, but the documented feature set also includes cross-domain token bridging and transaction submission. In agent environments, that can change the trust classification from informational/recovery tooling to financially privileged automation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Arbitrary token transfer capability is highly sensitive and not justified by the advertised 'auto-respawn' memory/identity function. If an agent is granted access to this skill and wallet material, an attacker can coerce the agent into transferring or bridging funds to attacker-controlled addresses, causing direct asset loss.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements direct native-token transfer capability, which is materially outside the declared purpose of identity/memory resurrection. In an agent skill, adding wallet-draining or value-transfer primitives under an unrelated feature banner increases the chance of deceptive use, misuse by higher-level prompts, or accidental invocation with real funds.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

A skill advertised for auto-respawn/identity persistence should not silently include financial asset transfer logic, because that creates a dangerous mismatch between user/operator expectations and actual authority. In agent environments, hidden or unrelated payment functions can be exploited by prompt injection, orchestration mistakes, or malicious wrappers to move real assets without informed consent.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The file reads process.env.AUTO_RESPAWN_CONTRACT_ADDRESS to override the on-chain contract address, which is an undeclared environment capability. If an attacker or unsafe deployment environment controls this variable, the skill can be redirected to a malicious contract, causing reads from untrusted state or signed writes to the wrong destination. In a skill whose purpose is to persist and recover identity/memory on-chain, this is more dangerous because contract-address integrity is foundational to trust and recovery.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/remark.ts (reported line 4)May include surrounding context.

ts

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/remark.ts (reported line 20)May include surrounding context.

ts

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/transfer.ts (reported line 4)May include surrounding context.

ts

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/transfer.ts (reported line 22)May include surrounding context.

ts

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/wallet.ts (reported line 7)May include surrounding context.

ts

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/wallet.ts (reported line 13)May include surrounding context.

ts

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/wallet.ts (reported line 46)May include surrounding context.

ts

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/wallet.ts (reported line 166)May include surrounding context.

ts

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/wallet.ts (reported line 260)May include surrounding context.

ts

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/wallet.ts (reported line 270)May include surrounding context.

ts

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/xdm.ts (reported line 11)May include surrounding context.

ts

import { transfer } from '@autonomys/auto-consensus'
import { signAndSendTx, ai3ToShannons, address as formatAddress } from '@autonomys/auto-utils'
import type { ApiPromise } from '@polkadot/api'
import type { KeyringPair } from '@polkadot/keyring/types'
import { type NetworkId, tokenSymbol, isMainnet } from './network.js'
import { normalizeAddress } from './address.js'

Static analysis

No suspicious patterns detected.