GoldRush MCP Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:38 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent GoldRush MCP integration, but it asks users to persistently run an unpinned npm package with an API key injected into that process.

Review before installing. Use a pinned, reviewed version of `@covalenthq/goldrush-mcp-server` or a trusted local install instead of `@latest`, limit and rotate the GoldRush API key, and understand that the created `goldrush-mcp-cli` link will keep using the documented command until changed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:18

Finding

Mutable Remote npm Package Is Executed with API-Key Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:18-36, SKILL.md:89-90, references/usage-patterns.md:6-15, references/usage-patterns.md:92-94, scripts/validate.sh:43-45, scripts/validate.sh:55-57, and scripts/validate.sh:76-78
Vulnerability Type: Remote execution of an unpinned third-party dependency with sensitive environment access
Risk Level: High

Vulnerable Code

SKILL.md:18-36:

markdown

- Network access for first-time `@covalenthq/goldrush-mcp-server` package fetch.
- A GoldRush API key is available.

## Core Workflow

Endpoint candidate inputs before finalizing:
- Raw package form from docs: `npx @covalenthq/goldrush-mcp-server@latest`
- Reliable non-interactive form: `npx -y @covalenthq/goldrush-mcp-server@latest`
- This skill defaults to:
  - `npx -y @covalenthq/goldrush-mcp-server@latest`

1. Verify protocol/path from official source and probe:
   - Official source: `https://goldrush.dev/docs/goldrush-mcp-server`
   - probe candidate endpoint with:
     - `uxc --inject-env GOLDRUSH_API_KEY=$GOLDRUSH_API_KEY "npx -y @covalenthq/goldrush-mcp-server@latest" -h`
2. Configure credential for repeatable auth:
   - `uxc auth credential set goldrush-mcp --auth-type bearer --secret-env GOLDRUSH_API_KEY`
   - `uxc auth credential set goldrush-mcp --auth-type bearer --secret-op op://Engineering/goldrush/api-key`
3. Use fixed link command by default:
   - `command -v goldrush-mcp-cli`
   - If missing, create it:
     - `uxc link goldrush-mcp-cli "npx -y @covalenthq/goldrush-mcp-server@latest" --credential goldrush-mcp --inject-env GOLDRUSH_API_KEY={{secret}}`

references/usage-patterns.md:6-15:

bash

uxc auth credential set goldrush-mcp --auth-type bearer --secret-env GOLDRUSH_API_KEY
command -v goldrush-mcp-cli
uxc link goldrush-mcp-cli "npx -y @covalenthq/goldrush-mcp-server@latest" --credential goldrush-mcp --inject-env GOLDRUSH_API_KEY={{secret}}
goldrus
...[truncated 3301 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed package version, such as @covalenthq/goldrush-mcp-server@X.Y.Z.
2. Install the dependency through a committed lockfile and enforce package integrity hashes rather than resolving it afresh during each invocation.
3. Remove npx -y ...@latest from normal execution. Prefer a separately installed, verified executable or a reproducibly built artifact.
4. Change scripts/validate.sh to reject @latest and require the approved exact version in both documentation and link commands.
5. Establish a controlled dependency-update process that reviews release changes and lockfile differences before changing the pinned version.
6. Run the MCP server in a sandbox with minimal filesystem access, no unnecessary inherited environment variables, and outbound network access restricted to required GoldRush endpoints where practical.
7. Inject a narrowly scoped API key only for actual API operations. Avoid exposing it during package installation or unauthenticated help/schema discovery if the server supports those operations without credentials.
8. Apply service-side restrictions such as minimum API scopes, usage limits, monitoring, rotation, and rapid revocation procedures.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (12)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill instructs users to execute an MCP server via npx using the @latest tag, which fetches whatever package version is current at runtime rather than a reviewed, immutable release. This creates a supply-chain execution risk: if the package is compromised, updated maliciously, or publishes breaking behavior, the skill will run untrusted code while also injecting the GoldRush API key into the child process environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence

Finding

Although -y makes the install non-interactive, this command still resolves @latest at execution time and then runs the downloaded package immediately. In this skill, that risk is amplified because the server is started with injected secret material (GOLDRUSH_API_KEY), so a compromised upstream package could exfiltrate credentials or run arbitrary code under the user's privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence

Finding

The documented default behavior for the skill is an unpinned npx invocation, meaning the insecure pattern is not incidental but the primary execution path. Because the skill is designed to access wallet, transaction, NFT, and approval data, any compromise of the downloaded MCP server could tamper with outputs, harvest sensitive operational data, or misuse the injected API credential.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The probe step advises executing the unpinned package even before establishing trust, effectively encouraging users to test-run arbitrary current code from the registry. A probe still executes the package, so a malicious or hijacked release could trigger arbitrary code execution and secret exposure during what appears to be a harmless help check.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence

Finding

The uxc link command persists a launcher that always executes the unpinned @latest package, turning a one-time risky action into a durable unsafe default. This increases exposure over time because future invocations may silently start newly published code while continuing to inject secrets into the child environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The guardrail section explicitly states equivalence to an unpinned npx ... @latest invocation, reinforcing unsafe operational behavior as normative guidance. Because this skill centers on blockchain data access and authenticated MCP usage, the context makes the issue more dangerous: compromise can affect both confidentiality of credentials and integrity of financial/wallet-related results.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The instructions tell users to configure and inject GOLDRUSH_API_KEY into a subprocess but do not warn that environment-injected secrets may be exposed through process inspection, shell history mistakes, verbose logs, crash reports, or compromise of the invoked tool. In this skill, that omission is more dangerous because the secret is passed to code obtained dynamically through npx, compounding the chance that the receiving process is untrusted or changed upstream.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs users to execute an unpinned package via npx ...@latest, which causes code to be fetched and run at execution time from the package registry without version locking. If the upstream package is compromised, a malicious release is published, or a dependency supply-chain attack occurs, the invoked code would run in a context where GOLDRUSH_API_KEY is injected into the subprocess environment, enabling secret theft or arbitrary command execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The documented fallback command again uses npx with @latest, so the same supply-chain risk exists in an alternate execution path. Because this variant explicitly shows secret injection into the same process invocation, any compromised package version could immediately access the API key and misuse it or execute further malicious actions under the user's account.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The validation script explicitly requires documentation to use npx -y @covalenthq/goldrush-mcp-server@latest, which is an unpinned moving target. This creates a supply-chain risk: future upstream releases could change behavior or become compromised, and users following the validated docs would execute whatever version is current at runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This check enforces fallback guidance that is also based on npx -y @covalenthq/goldrush-mcp-server@latest, again causing execution of an unpinned package version. Because the script validates and thereby institutionalizes this pattern, it propagates the same supply-chain exposure into the skill's documented recovery path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This code validates that documentation must include GOLDRUSH_API_KEY injection and a fixed link command using --inject-env, which concerns sensitive credentials. While the script fails with internal error messages, it does not include any comment, docstring, or explicit user-facing warning that the validation is checking for credential handling requirements.

Content

No source excerpt is available for this finding.