Handshake58 DRAIN

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:15 PM UTC
• Version: 1.8.0

Overview

The skill is transparent about its purpose, but it asks users to give a wallet private key to an unpinned globally installed package that can spend funds.

Install only with a fresh low-balance wallet, never a main wallet. Prefer a pinned, audited package version in an isolated environment, and assume chat content sent through provider endpoints may be visible to those third-party providers.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:35

Finding

Unpinned Globally Installed Package Receives a Wallet Private Key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 35; security-sensitive environment configuration is documented at lines 39–54
Vulnerability Type: Unpinned third-party dependency with access to cryptographic credentials
Risk Level: High

Vulnerable Code

bash

npm install -g drain-mcp

The installed package is subsequently configured with a wallet private key:

json

{
  "mcpServers": {
    "drain": {
      "command": "drain-mcp",
      "env": {
        "DRAIN_PRIVATE_KEY": "0x_your_polygon_wallet_private_key"
      }
    }
  }
}

Technical Analysis

The installation command retrieves the current registry version of drain-mcp without pinning an exact version or verifying package integrity. Installing it globally also makes the package executable broadly within the user's environment rather than confining it to a project-local dependency boundary.

This package is particularly security-sensitive because it is launched with DRAIN_PRIVATE_KEY. According to the Skill documentation, the package loads this key into memory and uses it to sign EIP-712 payment vouchers and Polygon transactions. Although the documentation states that the raw key is not transmitted, the reviewed project contains only SKILL.md; it does not contain the npm package implementation needed to independently enforce or verify that claim.

Consequently, registry compromise, maintainer-account compromise, or a malicious future package release could change the effective executable behavior after this Skill has been audited. The risk does not depend on the legitimate current version being malicious: the mutable installation instruction makes later package versions part of the trust boundary.

Attack Path

1. An attacker compromises the npm package, its publisher account, or the package distribution process.
2. The attacker publishes a modified release under the same drain-mcp package name.
3. A ...[truncated 1218 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin drain-mcp to an exact, independently audited version rather than installing the mutable latest release.
2. Publish and verify a cryptographic integrity digest or signed provenance for the approved package artifact.
3. Use a project-local installation with a committed lockfile instead of a global installation.
4. Review the actual package source corresponding exactly to the pinned artifact and verify that builds are reproducible.
5. Run the MCP process under a dedicated, unprivileged operating-system account or sandbox with restricted filesystem and network access.
6. Pass only the minimum required environment variables to the process.
7. Continue using a dedicated low-value wallet, but enforce wallet balance and allowance limits rather than relying solely on documentation.
8. Revoke token allowances and rotate the wallet key immediately if package integrity is ever uncertain.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:146

Finding

Marketplace-Controlled Provider URLs Receive Chat Content and Supply Agent Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 146–161; transmitted data and trust assumptions are documented at lines 190–213
Vulnerability Type: Untrusted dynamic network destination and external instruction handling
Risk Level: Medium

Vulnerable Code

text

POST {provider.apiUrl}/v1/chat/completions
Content-Type: application/json
X-DRAIN-Voucher: {"channelId":"0x...","amount":"150000","nonce":"1","signature":"0x..."}

text

GET {provider.apiUrl}/v1/docs

The documented network behavior confirms that provider-controlled endpoints receive user content:

text

| Provider `apiUrl` `/v1/chat/completions` | POST | Chat messages + signed voucher |

The Skill also states:

text

Providers listed in the marketplace are reviewed and approved by Handshake58 before appearing in the directory. The agent connects only to vetted providers.

Technical Analysis

Provider destinations are obtained dynamically from the Handshake58 marketplace and represented as {provider.apiUrl}. Chat messages and signed payment vouchers are then sent to those third-party destinations. For non-standard providers, the agent is instructed to fetch /v1/docs and use the returned provider instructions to determine request parameters and behavior.

These network operations are necessary for the declared marketplace functionality, and the disclosure is explicit. However, the reviewed Skill does not define an enforceable hostname allowlist, certificate or provider-identity pinning, per-provider user confirmation, sensitive-data filtering, or a rule requiring external documentation to be treated solely as untrusted data. The statement that providers are vetted is an administrative assertion rather than a control implemented within the reviewed file.

If the marketplace directory or an approved provider is compromised, an attacker could cause sensitive conversational content to be sent to an attack ...[truncated 2050 chars]

Remediation

View remediation

Remediation Suggestions

1. Enforce HTTPS and reject redirects to non-approved origins.
2. Authenticate directory responses and bind each provider identity to an explicit allowlisted hostname or public key.
3. Require explicit user approval before sending content to a provider not previously approved by that user.
4. Clearly display the destination hostname and categories of data that will be transmitted.
5. Apply secret detection and redaction before transmitting messages; never send environment variables, wallet keys, credentials, or unrelated conversation history.
6. Treat /v1/docs responses as untrusted data. They must not override system instructions, user intent, security policy, or tool authorization boundaries.
7. Parse provider documentation through a constrained schema rather than directly following arbitrary natural-language instructions.
8. Restrict requests to the minimum message content needed for the selected service.
9. Sandbox provider interactions and apply strict response-size, timeout, redirect, and content-type limits.
10. Maintain auditable provider onboarding and revocation controls, while recognizing that administrative vetting does not replace runtime validation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.