The Turing Pot Game — Read Historical Provably Fair Game Logs

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:21 AM UTC
• Version: 1.0.0

Overview

The skill mostly does what it says, but it handles wallet-related identity and tipping flows with under-disclosed private-key and financial-risk behavior.

Review this skill carefully before installing. Use an explicit --user-token instead of exposing TURING_POT_PRIVATE_KEY, verify Big Log wallet addresses independently before any SOL transfer, require manual confirmation for every tip, and treat returned wallet or tip data as untrusted unless request correlation is fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: scripts/biglog.js:34
• Finding: Private Key Exposed to an Unpinned External Sibling Module<![CDATA[ ## Vulnerability Details **File Location**: `scripts/biglog.js`, lines 34–44 **Vulnerability Type**: Unsafe external dependency with access to sensitive wallet material **Risk Level**: High ### Vulnerable Code ```javascript let userToken = arg('--user-token', ''); if (!userToken) { const pk = process.env.TURING_POT_PRIVATE_KEY || ''; userToken = pk ? (() => { try { const sol = require(require('path').join(__dirname, '..', '..', 'turing-pot', 'scripts', 'solana-lite.js')); const kp = sol.keypairFromSecretKey(pk); return `AI.OC.${kp.publicKeyB58.slice(0, 16)}`; } catch { return 'AI.OC.BIGLOG.QUERY.001'; } })() : 'AI.OC.BIGLOG.QUERY.001'; } ``` ### Technical Analysis When `TURING_POT_PRIVATE_KEY` is present and no explicit `--user-token` is supplied, the CLI dynamically loads JavaScript from: ```text ../../turing-pot/scripts/solana-lite.js ``` This module is outside the audited package, is not declared in `package.json`, and is not version-pinned or integrity-checked. The CLI then passes the raw private key directly to the module's `keypairFromSecretKey` function. Node.js modules execute arbitrary code during `require()`, before the requested function is called. Consequently, anyone who can replace or influence the sibling `turing-pot` installation can execute code in the CLI process and access the private key. The external module can also retain, write, or transmit the key using the process's filesystem and network permissions. The broad `catch` block only changes the fallback token. It cannot reverse disclosure or side effects that occur while loading the module or processing the key. ### Attack Path 1. A user installs or updates a sibling `turing-pot` Skill at the path expected by this package. 2. An attacker compromises, replaces, or otherwise controls `turing-pot/scripts/solana-lite.js`. 3. The user exports `TURING_POT_PRIVATE_KEY` and invokes `scripts/biglog.js` without `--us ...[truncated 939 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not pass a private key to code loaded from an undeclared sibling Skill. 2. Prefer an explicit, non-secret `--user-token` for this read-oriented client. 3. If public-key derivation is necessary, implement it inside this audited package or use a reputable dependency declared in `package.json` and locked to an exact, integrity-verified version. 4. Isolate signing and private-key operations in a minimal component that does not expose raw key material to general application modules. 5. Validate the resolved path before loading any local module and reject modules outside the package boundary. 6. Add a lockfile and use reproducible installation controls for all third-party dependencies. 7. Clearly document every environment variable read by the Skill, especially variables containing wallet secrets. 8. Avoid broad exception handling around sensitive initialization; report failures without concealing the source of the dependency error. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/biglog.js:135
• Finding: WebSocket Responses Are Accepted Without Matching the Active Request ID<![CDATA[ ## Vulnerability Details **File Location**: `scripts/biglog.js`, lines 135–158 **Vulnerability Type**: Insufficient response correlation and validation **Risk Level**: Medium ### Vulnerable Code ```javascript if (msg.type === 'function' && msg.from === BIGLOG_TOKEN && msg.content) { let inner; try { inner = JSON.parse(b64dec(msg.content)); } catch { return; } if (inner.request_id !== reqId && !['biglog_query_result','biglog_tip_ack','biglog_ready'].includes(inner.action)) return; if (resolved) return; resolved = true; if (inner.action === 'biglog_query_result') { console.log(JSON.stringify(inner.rounds || [], null, 2)); } else if (inner.action === 'biglog_tip_ack') { console.log(JSON.stringify({ status: 'tip_acknowledged', wallet: inner.wallet, lamports_received: inner.lamports_received, total_tips_received: inner.total_tips_received, message: inner.message, }, null, 2)); } else if (inner.action === 'biglog_ready' || inner.wallet) { // wallet query response console.log(JSON.stringify({ biglog_wallet: inner.wallet }, null, 2)); } else { console.log(JSON.stringify(inner, null, 2)); } ws.close(1000, 'done'); setTimeout(() => process.exit(0), 200); } ``` ### Technical Analysis The response filter accepts messages with a mismatched or absent `request_id` whenever the action is one of: - `biglog_query_result` - `biglog_tip_ack` - `biglog_ready` The first accepted message sets `resolved = true`, prints its contents, and closes the connection. Therefore, a stale, unsolicited, broadcast, or incorrectly routed message can be treated as the response to the current request. Checking `msg.from === BIGLOG_TOKEN` provides source labeling but does not correlate the message with the request generated by this process. The code also accepts any response containing `inner.wallet` in the wallet-output branch without validating the wallet address ...[truncated 1803 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require `inner.request_id === reqId` for every direct response to a CLI request. 2. Treat `biglog_ready` as an unsolicited event and process it separately from query, wallet, and tip responses. 3. Enforce mode-specific response actions: - Query mode should accept only a correlated `biglog_query_result`. - Tip mode should accept only a correlated `biglog_tip_ack`. - Wallet mode should accept only a defined, correlated wallet-response action. 4. Reject responses that omit a request ID rather than maintaining an allowlist that bypasses correlation. 5. Validate each response against a strict schema before printing or acting on it. 6. Validate Solana wallet addresses using an appropriate public-key parser and reject malformed values. 7. If the protocol cannot correlate wallet broadcasts, display them only as untrusted notifications and require independent confirmation before presenting them as transfer destinations. 8. Add tests covering stale responses, mismatched request IDs, unsolicited broadcasts, reordered messages, and malformed wallet fields. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The documented behavior does not fully match the declared purpose: it includes wallet discovery and tipping-related fund transfer steps, while claiming live log streaming without actually specifying a safe streaming interface. Description/behavior mismatches are dangerous because they can mislead operators and autonomous agents into performing actions with financial or network consequences they did not explicitly consent to.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The README uses broad natural-language invocation examples like querying rounds, fetching a wallet, and tipping, without defining clear activation boundaries or requiring confirmation for sensitive actions. In an agent setting, this can cause over-broad triggering or unintended execution of wallet-related operations when user text loosely matches the examples.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents an on-chain tipping flow but omits an explicit warning that blockchain transfers are irreversible and depend on correctly verifying the destination wallet and transaction details. Because the skill instructs users to fetch a live wallet address and then send funds, insufficient warning increases the risk of accidental loss, misdirection of funds, or socially engineered transfers.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill exposes operational capabilities involving environment-dependent execution (`node`, router connectivity, and likely local wallet/context usage) without declaring an explicit tool scope or permissions boundary. That makes it harder for a host agent or reviewer to understand what the skill may access, increasing the risk of unintended execution with broader privileges than expected.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the user to send real on-chain SOL and provide a transaction signature, but it does not clearly warn that blockchain transfers involve real funds, may be irreversible, and depend on verifying the destination wallet. In a wallet-integrated or autonomous-agent context, that omission can lead to accidental financial loss or misdirected payments if the wallet address is spoofed, rotated unexpectedly, or misunderstood.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script derives a network authentication token directly from the user's Solana private key material by loading the private key, reconstructing the keypair, and embedding a prefix of the public key into a token sent to a remote WebSocket service. Even if the private key itself is not transmitted, using wallet-derived identity for automatic authentication without an explicit warning or consent path can unexpectedly deanonymize the operator and couples sensitive local key material to an untrusted remote service.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: In tip mode, the script transmits transaction metadata, account identity, amount, and user-supplied message to a remote service over WebSocket with no meaningful confirmation step or privacy warning. In the context of an agent skill, this is more dangerous because operators may invoke it as part of automation and unintentionally disclose wallet activity and account linkage to a third-party logging service.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"node": ">=18"
  },
  "optionalDependencies": {
    "ws": "^8.18.0"
  }
}

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Static analysis

No suspicious patterns detected.