Pg Setup

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:15 AM UTC
• Version: 0.2.1

Overview

The skill is coherent setup documentation for ProxyGate, but it under-discloses meaningful risks around global CLI installation, API keys, wallet keypairs, and fund-moving commands.

Review this skill carefully before installing. Prefer an isolated or pinned CLI install if possible, verify the package source, avoid pasting real API keys or private wallet keys into chat or shell history, use the interactive login flow or protected secret storage where available, and dry-run or manually verify any deposit, withdrawal, listing deletion, tunnel, or skill-install command before executing it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:37

Finding

Unpinned Global Installation of a Security-Sensitive Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37-41
Vulnerability Type: Unpinned third-party dependency and unsafe global installation
Risk Level: High

Vulnerable Code

bash

### 2. Install the CLI

```bash
npm install -g @proxygate/cli
# or
pnpm add -g @proxygate/cli

Technical Analysis

The skill instructs users to install the latest available version of @proxygate/cli globally. It does not pin a reviewed version, verify a checksum or signature, identify a trusted registry, use a lockfile, or provide controls for npm lifecycle scripts.

A global package installation can execute package lifecycle scripts under the permissions of the user performing the installation. The resulting CLI is subsequently trusted to process API keys and Solana wallet keypairs, initiate financial operations, expose local services, and install additional skills. Consequently, a compromised maintainer account, package registry, or future package release could introduce code that was not present when this skill was audited.

Attack Path

1. An attacker compromises the package publisher, registry distribution path, or a future release of @proxygate/cli.
2. The attacker publishes a malicious version containing a lifecycle script or malicious CLI implementation.
3. A user follows the documented unpinned global installation command.
4. The package manager resolves and installs the attacker-controlled release.
5. Malicious code executes with the installing user's permissions during installation or when the CLI is invoked.
6. The code can access files and credentials available to that user, potentially including ProxyGate API keys, configuration data, and wallet keypair files.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the current user's account. The accessible scope would include files, credentials, environment data, and network resources available to ...[truncated 365 chars]

Remediation

View remediation

Remediation Suggestions

• Pin @proxygate/cli to a specifically reviewed version rather than implicitly installing the latest release.
• Publish and verify cryptographic checksums or package signatures through an independently trusted channel.
• State the expected package registry and verify package ownership and provenance before installation.
• Prefer a lockfile-backed, project-local, or isolated installation over a global installation.
• Disable package lifecycle scripts during installation where operationally feasible, and invoke only reviewed entry points afterward.
• Run the CLI in a least-privilege environment that cannot access unrelated wallet files, credentials, or sensitive user data.
• Document a controlled upgrade process requiring review of release notes, package contents, provenance, and integrity information.
• Document exactly what proxygate skills install downloads or modifies, and require explicit user confirmation before installing pinned and reviewed skill versions.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:45

Finding

API Keys Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 45 and line 74; references/commands.md, lines 9 and 17
Vulnerability Type: Sensitive credential supplied as a command-line argument
Risk Level: Medium

Vulnerable Code

SKILL.md, line 45:

bash

proxygate login --key pg_live_abc123...

SKILL.md, line 74:

bash

proxygate login --key pg_live_...   # add/change API key

references/commands.md, line 9:

text

--api-key <key> — Override API key

references/commands.md, line 17:

bash

proxygate login --key pg_live_...                # authenticate with API key

Technical Analysis

The documentation recommends supplying API credentials directly in command-line arguments. A real key entered this way can be retained in shell history and terminal transcripts. Depending on the operating system and process-monitoring configuration, it may also be visible temporarily through process listings, audit records, telemetry, debugging tools, or command logging.

The example values are placeholders rather than embedded live credentials. The vulnerability arises when users replace those placeholders with real API keys as instructed.

Attack Path

1. A user replaces the placeholder with a valid ProxyGate API key and runs the documented login command.
2. The shell records the complete command in its history, or another local logging or monitoring mechanism captures the process arguments.
3. A local user, process, support bundle, backup, telemetry operator, or attacker with access to the resulting records retrieves the key.
4. The attacker uses the exposed key to authenticate to ProxyGate.
5. The attacker performs operations permitted by that key until it is revoked or otherwise expires.

Impact Assessment

Exploitation could grant unauthorized access equivalent to the permissions assigned to the compromised API key. Potential consequences include una ...[truncated 334 chars]

Remediation

View remediation

Remediation Suggestions

• Make an interactive, non-echoing secret prompt the recommended authentication mechanism.
• Support reading the key from standard input or a protected file descriptor so it does not appear in process arguments.
• Store persistent credentials in an operating-system credential manager or a permission-restricted configuration file.
• If environment-variable support is provided, warn that environment variables may also be observable through diagnostics, child processes, or deployment logs.
• Add an explicit warning never to place real API keys in shell history, scripts, screenshots, issue reports, or copied terminal transcripts.
• Redact credentials from application logs, errors, telemetry, and diagnostic bundles.
• Apply restrictive file permissions to any credential storage and validate those permissions before use.
• Provide key revocation and rotation instructions for users who may already have followed the command-line examples.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The wallet authentication section discusses loading or generating keypairs and accepting multiple private key formats without warning that this material controls funds and must be protected like a password. Because the skill is specifically for setup and on-chain operations, omission of these warnings materially raises the risk of secret leakage, wallet compromise, and financial loss.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger instructions are overly broad because they force invocation on generic terms like "login," "get started," and "setup," which can cause the skill to activate in contexts unrelated to ProxyGate. This creates a prompt-routing risk where users may be steered into unnecessary installation or authentication flows, increasing the chance of credential handling in the wrong context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill provides direct examples for authenticating with an API key and wallet keypair but does not warn that these are sensitive secrets that must not be pasted into chats, logs, or shared terminals. In an agent-assisted environment, users may copy real credentials into unsafe places, leading to account compromise or unauthorized API usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The command reference documents withdrawal and related recovery operations that move funds, but it does so without prominently warning that these actions may be irreversible or have financial consequences. In the context of a setup skill, users may follow commands mechanically, increasing the chance of accidental fund movement or mistaken recovery actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.