GoldRush MCP Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:38 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent GoldRush MCP integration, but it asks users to persistently run an unpinned npm package with an API key injected into that process.

Review before installing. Use a pinned, reviewed version of `@covalenthq/goldrush-mcp-server` or a trusted local install instead of `@latest`, limit and rotate the GoldRush API key, and understand that the created `goldrush-mcp-cli` link will keep using the documented command until changed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:18
• Finding: Mutable Remote npm Package Is Executed with API-Key Access## Vulnerability Details **File Location**: `SKILL.md:18-36`, `SKILL.md:89-90`, `references/usage-patterns.md:6-15`, `references/usage-patterns.md:92-94`, `scripts/validate.sh:43-45`, `scripts/validate.sh:55-57`, and `scripts/validate.sh:76-78` **Vulnerability Type**: Remote execution of an unpinned third-party dependency with sensitive environment access **Risk Level**: High ### Vulnerable Code `SKILL.md:18-36`: ```markdown - Network access for first-time `@covalenthq/goldrush-mcp-server` package fetch. - A GoldRush API key is available. ## Core Workflow Endpoint candidate inputs before finalizing: - Raw package form from docs: `npx @covalenthq/goldrush-mcp-server@latest` - Reliable non-interactive form: `npx -y @covalenthq/goldrush-mcp-server@latest` - This skill defaults to: - `npx -y @covalenthq/goldrush-mcp-server@latest` 1. Verify protocol/path from official source and probe: - Official source: `https://goldrush.dev/docs/goldrush-mcp-server` - probe candidate endpoint with: - `uxc --inject-env GOLDRUSH_API_KEY=$GOLDRUSH_API_KEY "npx -y @covalenthq/goldrush-mcp-server@latest" -h` 2. Configure credential for repeatable auth: - `uxc auth credential set goldrush-mcp --auth-type bearer --secret-env GOLDRUSH_API_KEY` - `uxc auth credential set goldrush-mcp --auth-type bearer --secret-op op://Engineering/goldrush/api-key` 3. Use fixed link command by default: - `command -v goldrush-mcp-cli` - If missing, create it: - `uxc link goldrush-mcp-cli "npx -y @covalenthq/goldrush-mcp-server@latest" --credential goldrush-mcp --inject-env GOLDRUSH_API_KEY={{secret}}` ``` `references/usage-patterns.md:6-15`: ```bash uxc auth credential set goldrush-mcp --auth-type bearer --secret-env GOLDRUSH_API_KEY command -v goldrush-mcp-cli uxc link goldrush-mcp-cli "npx -y @covalenthq/goldrush-mcp-server@latest" --credential goldrush-mcp --inject-env GOLDRUSH_API_KEY={{secret}} goldrus ...[truncated 3301 chars]
• Remediation: ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version, such as `@covalenthq/goldrush-mcp-server@X.Y.Z`. 2. Install the dependency through a committed lockfile and enforce package integrity hashes rather than resolving it afresh during each invocation. 3. Remove `npx -y ...@latest` from normal execution. Prefer a separately installed, verified executable or a reproducibly built artifact. 4. Change `scripts/validate.sh` to reject `@latest` and require the approved exact version in both documentation and link commands. 5. Establish a controlled dependency-update process that reviews release changes and lockfile differences before changing the pinned version. 6. Run the MCP server in a sandbox with minimal filesystem access, no unnecessary inherited environment variables, and outbound network access restricted to required GoldRush endpoints where practical. 7. Inject a narrowly scoped API key only for actual API operations. Avoid exposing it during package installation or unauthenticated help/schema discovery if the server supports those operations without credentials. 8. Apply service-side restrictions such as minimum API scopes, usage limits, monitoring, rotation, and rapid revocation procedures.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (12)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The skill instructs users to execute an MCP server via `npx` using the `@latest` tag, which fetches whatever package version is current at runtime rather than a reviewed, immutable release. This creates a supply-chain execution risk: if the package is compromised, updated maliciously, or publishes breaking behavior, the skill will run untrusted code while also injecting the GoldRush API key into the child process environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence
• Finding: Although `-y` makes the install non-interactive, this command still resolves `@latest` at execution time and then runs the downloaded package immediately. In this skill, that risk is amplified because the server is started with injected secret material (`GOLDRUSH_API_KEY`), so a compromised upstream package could exfiltrate credentials or run arbitrary code under the user's privileges.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence
• Finding: The documented default behavior for the skill is an unpinned `npx` invocation, meaning the insecure pattern is not incidental but the primary execution path. Because the skill is designed to access wallet, transaction, NFT, and approval data, any compromise of the downloaded MCP server could tamper with outputs, harvest sensitive operational data, or misuse the injected API credential.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The probe step advises executing the unpinned package even before establishing trust, effectively encouraging users to test-run arbitrary current code from the registry. A probe still executes the package, so a malicious or hijacked release could trigger arbitrary code execution and secret exposure during what appears to be a harmless help check.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence
• Finding: The `uxc link` command persists a launcher that always executes the unpinned `@latest` package, turning a one-time risky action into a durable unsafe default. This increases exposure over time because future invocations may silently start newly published code while continuing to inject secrets into the child environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The guardrail section explicitly states equivalence to an unpinned `npx ... @latest` invocation, reinforcing unsafe operational behavior as normative guidance. Because this skill centers on blockchain data access and authenticated MCP usage, the context makes the issue more dangerous: compromise can affect both confidentiality of credentials and integrity of financial/wallet-related results.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The instructions tell users to configure and inject `GOLDRUSH_API_KEY` into a subprocess but do not warn that environment-injected secrets may be exposed through process inspection, shell history mistakes, verbose logs, crash reports, or compromise of the invoked tool. In this skill, that omission is more dangerous because the secret is passed to code obtained dynamically through `npx`, compounding the chance that the receiving process is untrusted or changed upstream.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs users to execute an unpinned package via `npx ...@latest`, which causes code to be fetched and run at execution time from the package registry without version locking. If the upstream package is compromised, a malicious release is published, or a dependency supply-chain attack occurs, the invoked code would run in a context where `GOLDRUSH_API_KEY` is injected into the subprocess environment, enabling secret theft or arbitrary command execution.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The documented fallback command again uses `npx` with `@latest`, so the same supply-chain risk exists in an alternate execution path. Because this variant explicitly shows secret injection into the same process invocation, any compromised package version could immediately access the API key and misuse it or execute further malicious actions under the user's account.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The validation script explicitly requires documentation to use `npx -y @covalenthq/goldrush-mcp-server@latest`, which is an unpinned moving target. This creates a supply-chain risk: future upstream releases could change behavior or become compromised, and users following the validated docs would execute whatever version is current at runtime.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: This check enforces fallback guidance that is also based on `npx -y @covalenthq/goldrush-mcp-server@latest`, again causing execution of an unpinned package version. Because the script validates and thereby institutionalizes this pattern, it propagates the same supply-chain exposure into the skill's documented recovery path.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: This code validates that documentation must include `GOLDRUSH_API_KEY` injection and a fixed link command using `--inject-env`, which concerns sensitive credentials. While the script fails with internal error messages, it does not include any comment, docstring, or explicit user-facing warning that the validation is checking for credential handling requirements.

Static analysis

No suspicious patterns detected.