T09 · Insecure Skill Coding Practices
Error
- Location
lib/wallet.ts:11- Finding
Wallet Mnemonic Loading and Private-Key Encapsulation Bypass
- Content
View full analysis
- Remediation
View remediation
Security audit
UniMarket P2P Marketplace
Security checks for vulnerabilities and agentic risk
Overview
This marketplace skill is mostly coherent, but it takes unusually broad access to a shared wallet by reading recovery material and deliberately extracting a raw private key.
Install only if you are comfortable letting this skill read your shared Unicity wallet files and handle raw wallet key material inside its Node.js process. Prefer a version that delegates signing to the Unicity wallet plugin without exposing mnemonic or private-key material, removes the embedded API key, and documents exact network and filesystem access.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
lib/wallet.ts:27- Finding
Hardcoded Oracle API Credential Distributed in Source Code
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (45)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the skill behavior truly includes reading wallet seed material, exposing private keys, or using undeclared oracle/API keys beyond the marketplace description, that is a serious trust-boundary violation. The danger is amplified by the skill's trading context because it is explicitly connected to a shared wallet and remote servers, so hidden key-handling behavior could lead to theft or identity compromise.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the skill behavior truly includes reading wallet seed material, exposing private keys, or using undeclared oracle/API keys beyond the marketplace description, that is a serious trust-boundary violation. The danger is amplified by the skill's trading context because it is explicitly connected to a shared wallet and remote servers, so hidden key-handling behavior could lead to theft or identity compromise.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
If the skill behavior truly includes reading wallet seed material, exposing private keys, or using undeclared oracle/API keys beyond the marketplace description, that is a serious trust-boundary violation. The danger is amplified by the skill's trading context because it is explicitly connected to a shared wallet and remote servers, so hidden key-handling behavior could lead to theft or identity compromise.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the skill behavior truly includes reading wallet seed material, exposing private keys, or using undeclared oracle/API keys beyond the marketplace description, that is a serious trust-boundary violation. The danger is amplified by the skill's trading context because it is explicitly connected to a shared wallet and remote servers, so hidden key-handling behavior could lead to theft or identity compromise.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the skill behavior truly includes reading wallet seed material, exposing private keys, or using undeclared oracle/API keys beyond the marketplace description, that is a serious trust-boundary violation. The danger is amplified by the skill's trading context because it is explicitly connected to a shared wallet and remote servers, so hidden key-handling behavior could lead to theft or identity compromise.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
If the skill behavior truly includes reading wallet seed material, exposing private keys, or using undeclared oracle/API keys beyond the marketplace description, that is a serious trust-boundary violation. The danger is amplified by the skill's trading context because it is explicitly connected to a shared wallet and remote servers, so hidden key-handling behavior could lead to theft or identity compromise.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md npx tsx scripts/register.ts --name "YourAgentName" --nostr <your-nostr-pubkey>
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md npx tsx scripts/intent.ts post --type sell --desc "Offering web scraping service, any site" --category services --price 5
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md npx tsx scripts/intent.ts post --type sell --desc "Offering web scraping service, any site" --category services --price 5
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md npx tsx scripts/intent.ts post --type sell --desc "Offering web scraping service, any site" --category services --price 5
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md npx tsx scripts/intent.ts post --type sell --desc "Offering web scraping service, any site" --category services --price 5
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This code intentionally reaches into Sphere's internal
_identityfield to recover and expose the raw private key, bypassing the public API's protection that strips it. For a marketplace/trading skill, direct exfiltration-capable access to the signing key is unnecessary and highly dangerous because any downstream caller can steal the wallet identity, sign arbitrary transactions, and irreversibly drain assets.- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
}
text ### DELETE /api/intents/:id (authenticated) Close an intent. Agent must own the intent.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares no explicit tool scope even though its documented behavior requires network access and reads configuration and wallet-related paths from the environment/filesystem. In an agent setting, missing permission boundaries increases the risk of unintended capability use, especially because the skill interacts with remote services and a shared wallet context.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Using
npx tsxwithout pinning an exact package version creates a supply-chain risk because the executed package may change over time or resolve to a compromised release. In this skill, those commands are part of setup/registration flows tied to wallet identity, so a malicious dependency could exfiltrate credentials or alter transaction behavior.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Using
npx tsxwithout pinning an exact package version creates a supply-chain risk because the executed package may change over time or resolve to a compromised release. In this skill, those commands are part of setup/registration flows tied to wallet identity, so a malicious dependency could exfiltrate credentials or alter transaction behavior.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Using
npx tsxwithout pinning an exact package version creates a supply-chain risk because the executed package may change over time or resolve to a compromised release. In this skill, those commands are part of marketplace search flows but still execute external code in the user's environment. Because the broader skill is connected to wallet-backed identity and network operations, compromise could pivot into sensitive actions.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Using
npx tsxwithout pinning an exact package version creates a supply-chain risk because the executed package may change over time or resolve to a compromised release. In this skill, those commands are part of marketplace search flows but still execute external code in the user's environment. Because the broader skill is connected to wallet-backed identity and network operations, compromise could pivot into sensitive actions.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Using
npx tsxwithout pinning an exact package version creates a supply-chain risk because the executed package may change over time or resolve to a compromised release. In this skill, those commands are part of marketplace search flows but still execute external code in the user's environment. Because the broader skill is connected to wallet-backed identity and network operations, compromise could pivot into sensitive actions.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Using
npx tsxwithout pinning an exact package version creates a supply-chain risk because the executed package may change over time or resolve to a compromised release. Here the command is used for posting marketplace intents, which can influence outbound network behavior and potentially wallet-linked actions. An attacker controlling the resolved package could run arbitrary code under the agent's privileges.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Using
npx tsxwithout pinning an exact package version creates a supply-chain risk because the executed package may change over time or resolve to a compromised release. Here the command is used for listing/closing intents and still executes external code in an environment connected to identity, tokens, and network APIs. That makes the blast radius larger than a simple local utility.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
Using
npx tsxwithout pinning an exact package version creates a supply-chain risk because the executed package may change over time or resolve to a compromised release. Even for category retrieval, the command executes unpinned remote code in the same environment that references wallet directories and remote marketplace infrastructure.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code silently loads the wallet mnemonic from local storage with no user-facing disclosure, consent flow, or indication that highly sensitive wallet material is being accessed. In the context of an agent skill, hidden access to wallet secrets is risky because users may believe they are only performing marketplace discovery or negotiation, not authorizing secret handling tied to their funds.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill initializes external network/oracle providers using wallet-related configuration and an API key without any visible disclosure that wallet operations may contact third-party services. In a P2P marketplace skill, undisclosed transmission to external infrastructure increases privacy and supply-chain risk, especially when combined with local wallet loading and debug transport settings.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code hardcodes a fallback oracle API key in source, which creates a secret-management issue and may route production requests through an embedded credential not controlled by the user. While not as severe as private key extraction, embedding credentials in code enables unintended service use, credential leakage, abuse by third parties, and makes external dependencies less transparent to operators.
- Content
Static analysis
No suspicious patterns detected.