Security audit

AWP Skill

Security checks for vulnerabilities and agentic risk

Overview

This AWP skill is mostly coherent for wallet and protocol work, but it gives the agent high-impact crypto setup, signing, and external skill-install authority that needs review before use.

Review before installing. Use this only for a dedicated AWP work wallet, do not store personal assets in it, verify the awp-wallet repository or pin a trusted release before running install.sh, confirm every transaction or signature request, and be careful with worknet skill installs because trusted-namespace repositories can still change.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:286
Finding: Unpinned Remote Wallet Installer Is Downloaded and Executed
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:218
Finding: Mandatory Promotional Instructions Hijack Agent Responses on Skill Load
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/relay-stake.py:128
Finding: Relay-Supplied EIP-712 Permit Data Is Not Fully Validated Before Signing
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:1112
Finding: API-Selected Worknet Skills from a Trusted Namespace Are Installed Without Review or Revision Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (129)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · CHANGELOG.md (reported line 1443)May include surrounding context.
md
### Fix — Install from local repo, not remote pipe - SKILL.md Step 2: `git clone` → `bash install.sh` (clone locally first, then execute — avoids `curl | bash` remote pipe) - daemon: all install/update messages use `git clone` + local `install.sh` instead of `curl | bash` - Removed `WALLET_INSTALL_SCRIPT` (raw.githubusercontent.com URL) from daemon ## v0.22.4

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · CHANGELOG.md (reported line 1456)May include surrounding context.
md
### Fix — Install from local repo, not remote pipe - SKILL.md Step 2: `git clone` → `bash install.sh` (clone locally first, then execute — avoids `curl | bash` remote pipe) - daemon: all install/update messages use `git clone` + local `install.sh` instead of `curl | bash` - Removed `WALLET_INSTALL_SCRIPT` (raw.githubusercontent.com URL) from daemon ## v0.22.4

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · CHANGELOG.md (reported line 1471)May include surrounding context.
md
### Fix — Install from local repo, not remote pipe - SKILL.md Step 2: `git clone` → `bash install.sh` (clone locally first, then execute — avoids `curl | bash` remote pipe) - daemon: all install/update messages use `git clone` + local `install.sh` instead of `curl | bash` - Removed `WALLET_INSTALL_SCRIPT` (raw.githubusercontent.com URL) from daemon ## v0.22.4

External Script Fetching

High

Category: Supply Chain
Confidence: 93% confidence
Finding: This changelog records a version where the agent directly ran 'curl | bash' to install wallet software and also initialized the wallet automatically. In a crypto-wallet skill, remote script execution plus autonomous setup is highly dangerous because it permits execution of unreviewed code and creates or modifies wallet state without explicit user approval.
Content: Scanner excerpt · CHANGELOG.md (reported line 1463)May include surrounding context.
md
## v0.22.2 ### UX Fix — Agent handles install & init - SKILL.md Step 2: agent directly runs `curl | bash` to install awp-wallet (not the user) - SKILL.md Step 5: agent runs `awp-wallet init` if wallet not found (not the user) - Onboarding Step 1: agent runs `awp-wallet init` directly - Note: daemon script (`awp-daemon.py`) remains check-only — it does not auto-install or auto-init

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: The changelog notes an installation instruction of 'curl -sSL install.sh | bash' for awp-wallet. Even as historical documentation, this reflects a dangerous pattern in a wallet-related ecosystem because it executes remote code immediately, with obvious supply-chain and compromise risks if mirrored in current docs or agent behavior.
Content: Scanner excerpt · CHANGELOG.md (reported line 1486)May include surrounding context.
md
- `--chain base` is a global option, NOT per-subcommand — removed from `approve`, `balance` calls - `awp-wallet unlock --scope` EXISTS (read|transfer|full) — re-added with `--scope transfer` default - `awp-wallet status --token` EXISTS — added `wallet_status()` to awp_lib.py - awp-wallet install: `skill install` → `curl -sSL install.sh | bash` (not on npm registry) - awp-daemon: wallet version check was reading non-existent SKILL.md from awp-wallet repo → now reads package.json - Reference docs: replaced all broken `awp-wallet send --data $(cast calldata ...)` templates with bundled Python script commands - CHANGELOG v0.20.7 correction: `--scope full` DOES exist — it was incorrectly removed in that version

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose understates or omits significant behaviors such as daemonized persistence, local state/log management, push notification setup, remote version checks, and third-party interactions. This mismatch impairs informed consent and can cause users or orchestrators to authorize a skill they believe is narrower and less stateful than it really is.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 283)May include surrounding context.
et` works): proceed silently.

Case B — WALLET_BIN is non-empty but NOT in PATH: the binary exists, just hidden. Export the directory for this session and tell the user the one-line to make it permanent. Do NOT reinstall.

bash
export PATH="$(dirname "$WALLET_BIN"):$PATH"

Then print:

text
[SETUP] awp-wallet found at <path>, added to PATH for this session. To make it permanent, run: echo 'export PATH="<dir>:$PATH"' >> ~/.bashrc # or ~/.zshrc

Case C — WALLET_BIN is empty: dependency missing. Install from the official repo:

bash
git clone https://github.com/awp-core/awp-wallet.git /tmp/awp-wallet-install \ && bash /tmp/awp-wallet-install/install.sh

After install, re-run the detection snippet above (Case A or B). If still empty after a successful install, the install script did land the binary somewhere unusual — ask the user to run find $HOME -name awp-wallet -type f 2>/dev/null and add that directory to PATH.

**CRITICAL — do NOT invent instal

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Cloning a remote repository and executing its install.sh script is classic remote code execution and supply-chain risk. If the repository, transport, or install script is compromised, the agent could execute arbitrary commands, alter the environment, exfiltrate data, or establish persistence under the user's account.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 443)May include surrounding context.
text
Parse and display each notification. After displaying, clear the file: ```bash rm -f ~/.awp/notifications.json

awp log — show recent daemon log:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 460)May include surrounding context.
awp daemon stop — stop the background daemon:

bash
kill $(cat ~/.awp/daemon.pid 2>/dev/null) 2>/dev/null && rm -f ~/.awp/daemon.pid

awp help

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 460)May include surrounding context.
awp daemon stop — stop the background daemon:

bash
kill $(cat ~/.awp/daemon.pid 2>/dev/null) 2>/dev/null && rm -f ~/.awp/daemon.pid

awp help

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill supports installing third-party worknet skills from external sources, which is effectively remote code acquisition/enablement outside the core protocol operations. Even with a confirmation prompt, this creates a clear supply-chain execution path where a malicious repository could gain code execution, data access, or persistence via the agent environment.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 593)May include surrounding context.
md
| Allocate / deallocate / reallocate | S3 | **references/commands-staking.md** | | Register a new worknet | M1 | **references/commands-worknet.md** | | Activate / pause / resume worknet | M2 | **references/commands-worknet.md** | | Update skills URI | M3 | **references/commands-worknet.md** | | Set minimum stake | M4 | **references/commands-worknet.md** | | Create governance proposal | G1 | **references/commands-governance.md** | | Vote on proposal | G2 | **references/commands-governance.md** |

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · CHANGELOG.md (reported line 1615)May include surrounding context.
md
--- ## M3 · Update Skills URI ### Contract Call

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 1443)May include surrounding context.
md
--- ## M3 · Update Skills URI ### Contract Call

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/commands-worknet.md (reported line 335)May include surrounding context.
md
--- ## M3 · Update Skills URI ### Contract Call

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entry at L0082 explicitly describes 'English-only comments,' which is a natural-language policy constraint. In this file there is no indication that users can choose another language or that the restriction is narrowly justified as a region- or compliance-specific requirement, so it fits the locale-policy violation category.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · CHANGELOG.md (reported line 163)May include surrounding context.
md
- `awp-daemon.py`: API outage no longer triggers false "Registration detected!" notification (returns None instead of False on unreachable). - `awp-daemon.py`: malformed announcement ID no longer aborts entire monitor cycle. - `awp-daemon.py`: PID write moved inside try/finally block. Input validation: - `relay-stake.py`: fractional `--lock-days` now rejected (must be whole days).

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 94% confidence
Finding: The phrase 'auto-starts without asking' documents autonomous agent behavior that bypasses user consent for launching a persistent background process. In this skill context, that is risky because users may not understand a daemon has been started, what it writes, or how to stop it.
Content: Scanner excerpt · CHANGELOG.md (reported line 559)May include surrounding context.
md
same response. Also added to the `description` field (triggering layer) so Claude sees the requirement before even reading the skill body. - **Background status monitor auto-starts without asking.** Previously Step 7 asked "Start the AWP daemon? (yes/no)" which confused users who don't know what a daemon is. Changed to silent auto-start. The daemon is a read-only monitor (polls public API, writes `~/.awp/` status files, never touches

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · CHANGELOG.md (reported line 1162)May include surrounding context.
md
- `onchain-subnet-lifecycle.py`: added missing `cancel` action (`cancelWorknet`, selector `0x9bc68d94`; Pending→None with full 100,000 AWP refund) - `onchain-subnet-update.py`: fixed registry key `"subnetNFT"` → `"worknetNFT"` (crashed on every call) - `wallet-raw-call.mjs`: added null/type guard for registry response before `Object.entries()` - `awp-daemon.py`: fixed changelog truncation off-by-one, atomic temp-file write (`os.replace`), `seen_announcement_ids` capped at 500, PID cleanup via `try/finally` - `onchain-add-position.py`: fixed float vs Decimal handling for `extend_days` - Reference docs: `staking.getBalance` response field corrected to `unallocated` (not `available`) - SKILL.md: description rewritten for improved triggering recall; `--subnet` flag clarified in M2; relay scripts noted to handle EIP-712 internally (don't expose to user)

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The changelog describes silent auto-start of a background daemon while framing it as benign. Even if read-only, a persistent background process changes system state, writes files, polls network resources, and can surprise users; that is especially sensitive in an agent skill handling wallets and blockchain activity.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This changelog records a version where the agent was instructed to autonomously run wallet installation and initialization actions on behalf of the user. In a wallet/crypto skill, normalizing unattended install/init flows is dangerous because it reduces informed consent around persistent software changes and wallet creation, and could be reused by an over-permissive agent implementation.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 95% confidence
Finding: This entry explicitly says transactions execute directly with no confirmation prompts. For a blockchain wallet skill, removing confirmation creates a real risk of unintended fund movement, approvals, or governance actions being executed from ambiguous natural-language input or agent mistakes.
Content: Scanner excerpt · CHANGELOG.md (reported line 1539)May include surrounding context.
md
- Wallet auto-manages credentials in default mode — no password files needed ### Changed - **Agent wallet model** — transactions execute directly, no confirmation prompts. This is a work wallet for AWP tasks only; users are told not to store personal assets. - `awp-wallet` installs from registry first, falls back to GitHub: `skill install awp-wallet || skill install https://github.com/awp-core/awp-wallet` - Description rewritten: 511 chars (was 916), natural language instead of keyword list - Removed all V1 `.rootNet` fallback code — V2 API is now authoritative

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The manifest explicitly says not to trigger on generic phrases like 'start working' unless AWP is explicitly mentioned in context. This changelog line instructs the user to say exactly that generic phrase, which actively conflicts with the skill's current declared trigger boundaries and can cause misactivation outside AWP-specific contexts.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: These lines document that the background status monitor 'auto-starts without asking' and describe the daemon as silently starting. Elsewhere in the same changelog, the project frames daemon auto-start as a scope-creep/security problem and later reverts to explicit opt-in consent, so this documentation directly contradicts the intended user-consent model rather than merely omitting detail.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.