ClawHub
Back to skill

Security audit

Breeze x402

Security checks for vulnerabilities and agentic risk

Overview

This skill is for real Solana payments and transactions, but it asks the agent to handle a wallet private key and sign server-supplied transactions without enough safeguards.

Review before installing. Use only a dedicated low-balance Solana wallet, avoid storing the private key in plaintext .env or wallet-backup.json, pin dependencies, and require explicit review of destination, amount, token, strategy, fees, and decoded transaction instructions before any signing or broadcast.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:389
Finding

Blind Signing and Broadcasting of Untrusted Server-Supplied Transactions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:198
Finding

Unpinned Security-Sensitive Wallet and Payment Dependencies

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:39
Finding

Plaintext Private-Key Duplication and Unsafe Environment Loading

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The skill explicitly generates a private key and writes it into a plaintext .env file, creating a credential-at-rest exposure. Plaintext secret storage is easily leaked through backups, shell history, editor plugins, accidental commits, or multi-user system access, and compromise of this key enables full wallet theft.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

// Save secret key to file — never print it to the console fs.writeFileSync('wallet-backup.json', JSON.stringify(Array.from(keypair.secretKey))); fs.writeFileSync('.env', WALLET_PRIVATE_KEY=${secretKeyBase58}\n); console.log('Saved .env with WALLET_PRIVATE_KEY and wallet-backup.json — keep both secret and out of git!');

text

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The adjacent guidance normalizes saving WALLET_PRIVATE_KEY and a full wallet backup locally, which materially increases the chance of credential exposure. Because this key controls on-chain funds and authorizes paid API requests, theft has direct financial consequences.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

// Save secret key to file — never print it to the console fs.writeFileSync('wallet-backup.json', JSON.stringify(Array.from(keypair.secretKey))); fs.writeFileSync('.env', WALLET_PRIVATE_KEY=${secretKeyBase58}\n); console.log('Saved .env with WALLET_PRIVATE_KEY and wallet-backup.json — keep both secret and out of git!');

text

```bash

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

Using export $(cat .env | xargs) to load secrets is unsafe because it encourages handling the private key through shell parsing and process environment manipulation, which can leak via shell history, process inspection, debug logs, or malformed .env contents. For a wallet private key, this is a meaningful credential-handling weakness.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

text

```bash
# Set WALLET_PRIVATE_KEY from the .env created in Step 0
export $(cat .env | xargs) && node deposit.js

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

This instruction operationalizes loading the wallet private key from a plaintext .env into the environment before executing a transaction-signing script. In context, the credential immediately enables signing and broadcasting financial transactions, so any leakage can lead to unauthorized asset transfer.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

bash
# Set WALLET_PRIVATE_KEY from the .env created in Step 0
export $(cat .env | xargs) && node deposit.js

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README states that the skill signs and broadcasts Solana transactions, but it does not prominently warn that these actions move funds and can be irreversible once submitted on-chain. In a skill designed for deposits, withdrawals, and paid API calls, omission of an explicit user-consent and transaction-review warning increases the risk of unintended asset loss through misuse, prompt injection, or operator misunderstanding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README requires a WALLET_PRIVATE_KEY environment variable but does not warn that it is a highly sensitive secret granting spending authority over on-chain assets. In the context of an autonomous or semi-autonomous agent skill that performs payments and broadcasts transactions, encouraging private-key injection without strong secret-handling guidance materially raises the chance of wallet compromise and fund theft.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

bash
# x402 server health
curl https://x402.breeze.baby/healthz

# Breeze strategy info (no auth needed)
curl https://api.breeze.baby/strategy-info/43620ba3-354c-456b-aa3c-5bf7fa46a6d4

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md
curl https://x402.breeze.baby/healthz

# Breeze strategy info (no auth needed)
curl https://api.breeze.baby/strategy-info/43620ba3-354c-456b-aa3c-5bf7fa46a6d4

# Wallet USDC balance (replace YOUR_WALLET_ADDRESS)
curl https://api.mainnet-beta.solana.com \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs the agent to sign and broadcast Solana transactions as part of deposit/withdraw workflows, but it does not require an explicit final user confirmation immediately before execution. In an agent setting, this creates a real risk of unintended fund movement if a user request is ambiguous, manipulated, or misinterpreted, especially because the same wallet is also authorized for x402 micropayments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.