Security audit

Bitquery GraphQL Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Bitquery GraphQL/UxC usage guide with disclosed authentication and local subscription examples, but users should handle OAuth secrets carefully.

Install is reasonable if you expect to use Bitquery through UxC. Before following the auth examples, avoid pasting real client secrets into shared terminals or agent transcripts, prefer a secure secret input method if UxC supports one, and rotate any secret that may have been logged. Treat subscription file sinks as persistent local records and store or delete them according to your retention needs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:24
Finding: OAuth Client Secret Exposed Through Command-Line Arguments
Content: View full analysis
--client-secret --scope api --token-endpoint https://oauth2.bitquery.io/oauth2/token ``` `references/usage-patterns.md:8-14`: ```bash uxc auth oauth login bitquery-graphql \ --endpoint https://streaming.bitquery.io/graphql \ --flow client_credentials \ --client-id \ --client-secret \ --scope api \ --token-endpoint https://oauth2.bitquery.io/oauth2/token ``` ### Technical Analysis The documentation instructs users and agents to replace the placeholder passed to `--client-secret` with an actual OAuth client secret. Supplying sensitive credentials directly as command-line arguments can expose them through several channels: - Shell history files - Process argument inspection while the command is running - Terminal session recording - Command execution and diagnostic logs - Agent prompts, tool-call records, and conversation transcripts - CI/CD job output or audit telemetry that records invoked commands The examples do not contain a hardcoded real credential. The vulnerability arises when users follow the documented procedure and insert their own secret into the command. Exploitation requires access to one of the local or centralized records containing the command, or sufficient local permissions to observe process arguments. ### Attack Path 1. A user or agent replaces `` with a valid Bitquery application secret. 2. The OAuth login command runs with that secret in its argument vector. 3. The command is retained in shell history, execution logs, an agent transcr ...[truncated 1214 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose describes an operational skill for querying Bitquery GraphQL over UXC to obtain onchain analytics data. The actual code chunk does not implement querying, authentication, network access, or data retrieval. Instead, it is a repository validation script that lints local documentation/configuration to ensure the skill is documented in a particular way. This is a materially different primary purpose, so the description does not accurately represent the behavior of the supplied code chunk.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
## Authentication Bitquery uses bearer access tokens. The most stable agent path is OAuth `client_credentials`, not a copied temporary token. 1. Create a Bitquery application and note: - application `client_id`

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation instructs users to pass an OAuth client secret directly on the command line, which can expose the secret through shell history, process listings, terminal logging, or shared session tooling. While this is a documentation issue rather than executable malicious behavior, it creates a realistic credential leakage risk for anyone following the example as written.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The subscription example persists streamed blockchain data to a local NDJSON file without warning about retention, file permissions, or downstream handling. In some environments, streamed data may include sensitive operational intelligence, wallet activity monitoring targets, or regulated telemetry that should not be stored indefinitely or in a broadly readable location.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.