skillet

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:30 PM UTC
• Version: 1.0.0

Overview

The skill is openly a crypto-trading skill, but it gives the agent persistent signing power over a plaintext wallet and includes optional credential-backed ClawChain registration without strong user-control guardrails.

Install only if you are comfortable giving the agent a dedicated, low-balance BSC wallet for irreversible on-chain trades. Do not reuse a valuable wallet, enforce restrictive wallet-file permissions immediately, require explicit approval before every approval or swap, pin and review dependencies, and avoid the optional ClawChain registration unless you intentionally want to link the wallet and expose that credential file to the chr CLI.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: skills.md:54

Finding

Plaintext Wallet Private Key Created Without Explicit Restrictive Permissions

Content

View full analysis

Vulnerability Details

File Location: skills.md, lines 54–65
Vulnerability Type: Plaintext secret storage with permissions dependent on the process umask
Risk Level: High

Vulnerable Code Snippet:

javascript

const fs = require('fs');
const path = require('path');
const { ethers } = require('ethers');
const wallet = ethers.Wallet.createRandom();
const dir = process.env.HOME + '/.config/bsc_agent';
fs.mkdirSync(dir, { recursive: true });
const file = dir + '/wallet.json';
fs.writeFileSync(file, JSON.stringify({
  privateKey: wallet.privateKey,
  address: wallet.address,
  publicKey: wallet.publicKey
}, null, 2));

Technical Analysis

The wallet-generation instructions store a BSC private key in plaintext using fs.writeFileSync without explicitly setting the file mode. The resulting permissions therefore depend on the runtime environment's umask. Although line 341 later recommends running chmod 600, that recommendation is separate from the creation command and is not automatically enforced.

On a system with an insufficiently restrictive umask, the wallet file may remain readable by other local users or processes. The file directly contains the signing key for the wallet, so confidentiality of the file is the principal access-control boundary protecting all assets held by the wallet.

The Skill legitimately requires access to a signing key to perform its declared trading functionality. However, creating the key in plaintext without enforcing restrictive permissions does not apply the minimum protection necessary for that functionality.

Attack Path

1. The user or agent runs the documented wallet-generation command under a permissive umask.
2. ~/.config/bsc_agent/wallet.json is created without an explicit 0600 mode.
3. The separate chmod 600 security recommendation is omitted or delayed.
4. Another local user, compromised process, or co-tenant reads wallet.json.

...[truncated 806 chars]

Remediation

View remediation

Remediation Suggestions

• Create ~/.config/bsc_agent with mode 0700.
• Create the wallet file atomically with mode 0600, rather than relying on the ambient umask or a later manual command.
• Refuse to load an existing wallet file if it is owned by another user, is a symbolic link, or has group/other permissions.
• Avoid overwriting an existing wallet unless the user explicitly authorizes key replacement.
• Prefer an encrypted keystore, hardware-backed signer, operating-system key store, or isolated signing service instead of storing a raw private key.
• Never print, log, return, or transmit the private key.

Example hardened creation pattern:

javascript

const fs = require('fs');
const path = require('path');
const { ethers } = require('ethers');

const wallet = ethers.Wallet.createRandom();
const dir = path.join(process.env.HOME, '.config', 'bsc_agent');
const file = path.join(dir, 'wallet.json');

fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
fs.writeFileSync(
  file,
  JSON.stringify({
    privateKey: wallet.privateKey,
    address: wallet.address,
    publicKey: wallet.publicKey
  }, null, 2),
  { mode: 0o600, flag: 'wx' }
);

The implementation should additionally verify ownership and effective permissions after creation.

T08 · Insecure Dependencies

Warning

• Location: skills.md:41

Finding

Unpinned Third-Party Dependency Installation in a Wallet-Handling Environment

Content

View full analysis

Vulnerability Details

File Location: skills.md, lines 41–46
Vulnerability Type: Non-reproducible dependency installation and supply-chain exposure
Risk Level: Medium

Vulnerable Code Snippet:

bash

npm install ethers
# or: pnpm add ethers

Technical Analysis

The installation commands do not specify an exact Ethers version or require a reviewed lockfile. As a result, the package version and transitive dependency graph can change between executions. Package-manager lifecycle behavior may also execute within an environment that stores and uses a plaintext wallet private key.

The package name shown is not evidence of a malicious dependency, and no current compromise is established by the audited file. The security issue is that an unpinned, mutable dependency resolution process is used for security-sensitive wallet generation and transaction signing. A future registry compromise, maintainer compromise, or malicious transitive release could therefore affect the effective code executed by the Skill without any change to skills.md.

Attack Path

1. An attacker compromises a selected package release, maintainer account, registry response, or transitive dependency.
2. The user follows the Skill and runs npm install ethers or pnpm add ethers without an audited lockfile.
3. The package manager resolves the compromised release or dependency.
4. Malicious code executes through package lifecycle behavior or is loaded when the wallet script imports Ethers.
5. The malicious component reads ~/.config/bsc_agent/wallet.json, captures newly generated keys, or modifies transaction construction.
6. The attacker obtains the signing key or causes transactions to use attacker-controlled recipients, routers, paths, or approvals.
7. Wallet assets are stolen or exposed to unauthorized smart-contract spending.

Impact Assessment

A successfully compromised dependency would execute with the privileges ...[truncated 435 chars]

Remediation

View remediation

Remediation Suggestions

• Specify an exact, reviewed Ethers version rather than an unconstrained package name.
• Commit and review a package-manager lockfile.
• Use a reproducible installation command such as npm ci instead of dynamically updating dependency resolution.
• Verify package provenance, integrity metadata, publisher identity, and dependency changes before upgrades.
• Run dependency auditing and review advisories before using the package for signing operations.
• Disable lifecycle scripts where compatible with the selected dependency set, for example with --ignore-scripts.
• Separate dependency installation from the environment that contains funded wallet keys.
• Test upgrades in an isolated environment and require explicit review before changing the locked dependency graph.

T09 · Insecure Skill Coding Practices

Warning

• Location: skills.md:133

Finding

Persistent ClawChain Credential File Exposed to an External CLI Process

Content

View full analysis

Vulnerability Details

File Location: skills.md, lines 133–145
Vulnerability Type: Broad credential-file access for an optional identity-registration operation
Risk Level: Medium

Vulnerable Code Snippet:

bash

# Register public key on Chromia
chr tx register_evm_public_key \
  "pancakeswap" \
  "$PUBLIC_KEY" \
  "BSC" \
  56 \
  "$ADDRESS" \
  --ft-auth \
  --secret ~/.config/clawchain/credentials.json \
  -brid $CLAWCHAIN_BRID \
  --api-url $CLAWCHAIN_NODE \
  --await

Technical Analysis

The command gives the chr process access to a persistent credential file at ~/.config/clawchain/credentials.json. Authentication is relevant to the optional ClawChain public-key registration feature, and the documentation does not explicitly instruct the CLI to transmit the raw credential file. Consequently, the snippet is not proof of credential exfiltration.

Nevertheless, PancakeSwap discovery and trading do not require ClawChain credentials. The access is only needed for the separate identity-linking feature. The instructions do not require explicit user confirmation immediately before credential use, verify the provenance or integrity of the chr executable, validate credential-file ownership and permissions, or prefer a narrowly scoped, short-lived authentication session.

This expands the trusted computing base from the wallet-signing process to the external CLI and its runtime dependencies. It also associates the BSC public key and address with the user's ClawChain identity, which has privacy and account-integrity implications.

Attack Path

1. The user or agent installs or invokes a compromised, spoofed, or otherwise untrusted chr executable.
2. The agent follows the optional registration instructions.
3. The --secret argument directs the CLI to open ~/.config/clawchain/credentials.json.
4. The compromised CLI reads and copies the persistent credentials or uses them to ...[truncated 1191 chars]

Remediation

View remediation

Remediation Suggestions

• Keep ClawChain registration explicitly optional and separate from wallet creation and trading.
• Require informed user confirmation immediately before invoking a command that reads persistent credentials.
• Display the executable path, destination endpoint, BRID, public key, address, chain, and network ID before authorization.
• Use a verified and version-pinned chr CLI obtained from an authenticated source.
• Verify the credential file is owned by the current user, is not a symbolic link, and has mode 0600 or stricter before use.
• Prefer a short-lived, narrowly scoped FT4 session, interactive authorization, or hardware-backed signer over a reusable credential file.
• Limit credentials to the register_evm_public_key operation where the platform supports capability scoping.
• Do not expose credential contents through command output, logs, shell tracing, or error reports.
• Validate that the configured API URL and BRID match an independently verified expected configuration before authentication.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

Referencing and using ~/.config/clawchain/credentials.json gives the skill access to a host-resident credential unrelated to PancakeSwap trading. This is dangerous because an agent with credential access can perform authenticated actions outside the user’s intended scope and may leak or misuse the secret if subverted.

Content

Scanner excerpt · skills.md (reported line 140)May include surrounding context.

md

56 \
  "$ADDRESS" \
  --ft-auth \
  --secret ~/.config/clawchain/credentials.json \
  -brid $CLAWCHAIN_BRID \
  --api-url $CLAWCHAIN_NODE \
  --await

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The skill’s core design relies on persistent storage of a reusable wallet containing a private key, enabling ongoing autonomous transaction signing across sessions. Persistent signing authority materially raises the blast radius of prompt injection, local compromise, or accidental misuse because the agent retains standing capability to spend funds later.

Content

Scanner excerpt · skills.md (reported line 10)May include surrounding context.

md

# BSC PancakeSwap Trading Skill

This skill lets the AI agent create a BSC wallet (private key + address saved in one file), **discover which tokens and swaps are available** on PancakeSwap, swap tokens, and receive top-ups from the user. The agent is not limited to specific tokens — it can resolve token addresses and check which pairs have liquidity.

## Configuration (BSC Mainnet)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill directs the agent to create and persist a raw private key in a plaintext JSON file before prominently warning about irreversible fund loss and secret-compromise consequences. Storing signing keys this way creates a high-value local target; any file disclosure or host compromise can immediately lead to theft of all wallet funds.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill adds Chromia/ClawChain public-key registration and account-linking behavior that is unrelated to core PancakeSwap trading. This broadens the agent’s authority and external interactions, creating unnecessary attack surface and making it easier to coerce the agent into performing cross-system actions the user may not expect.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs use of an external authenticated secret file (~/.config/clawchain/credentials.json) for a nonessential registration flow. Accessing unrelated credentials from the host significantly increases risk of credential misuse, lateral movement, or unauthorized actions on another platform if the agent is compromised or manipulated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trade flow authorizes the agent to approve tokens, sign, and broadcast irreversible on-chain swaps without an explicit confirmation checkpoint immediately before execution. In an autonomous-agent setting, this is dangerous because prompt manipulation, misunderstanding of token addresses, or bad routing can cause permanent loss of funds.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skills.md (reported line 334)May include surrounding context.

md

## 7. Security Notes

- **wallet.json** contains the private key. Restrict access: `chmod 600 ~/.config/bsc_agent/wallet.json`.
- Use this wallet only for the agent and only with amounts you accept to lose if the machine or file is compromised.
- Prefer a dedicated BSC wallet; do not reuse a wallet that holds large funds elsewhere.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · skills.md (reported line 10)May include surrounding context.

md

# BSC PancakeSwap Trading Skill

This skill lets the AI agent create a BSC wallet (private key + address saved in one file), **discover which tokens and swaps are available** on PancakeSwap, swap tokens, and receive top-ups from the user. The agent is not limited to specific tokens — it can resolve token addresses and check which pairs have liquidity.

## Configuration (BSC Mainnet)