Security audit
Security checks for vulnerabilities and agentic risk
This backup skill needs review because its automatic payments can exceed the advertised daily spending limit.
Disable automatic wallet payments with ESTATE_MAX_SPEND_PER_DAY=0 until signing enforces the remaining daily budget, or consider the documented prepaid card workflow. Use a dedicated low-balance wallet. Only include The Estate's restore key if you accept its access to backed-up credentials. ESTATE_ENV_BUNDLE=off excludes environment secrets, but credentials already in configuration and backup files remain included.
scripts/check.mjsAutomated spending limit is not enforced against the payment actually signed
A snapshot budgeted and recorded as $0.01 can authorize a payment above the default $1.50 daily limit, up to the separate $10 ceiling. Subsequent checks continue to calculate remaining allowance from understated ledger entries, permitting further overspending.
The lockfile includes source-map-js 1.2.1, matching the supplied event-loop denial-of-service advisory involving indexed source maps. An attacker would need a path for a malicious map to reach the affected consumer, potentially hanging a build or development process; this file does not establish that path. The package is development-only, so disruption of the deployed lifeboat or heartbeat service is not demonstrated.
Vite 8.2.2 is locked as a development dependency and matches the supplied advisory set, including Windows editor-launch handling and cross-origin script execution through custom middleware. Exploitability depends on the particular advisory, operating system, enabled functionality, and access to the development server; the editor-launch dependency and three additional advisory details are not shown here. A compromised development environment could endanger wallet or snapshot secrets if available there, but the lockfile alone does not demonstrate that exposure.
The skill declares no explicit tool scope despite directing shell execution, dependency installation, wallet-key access, recurring payments, and uploads of backups containing credentials. This is a least-privilege weakness: compromised dependencies or manipulated remote content could abuse any broad permissions inherited from the agent, potentially exposing credentials or spending wallet funds. The backup purpose explains these capabilities but does not constrain them; encryption also does not prevent service-side credential access in estate-restores mode.
The lockfile includes @vitest/mocker 5.0.0, matching the supplied advisories for unauthenticated mock-registration code injection and a Windows traversal bypass. Exploitation would depend on the affected mocking functionality being active and attacker-accessible; its development-only status reduces production exposure but does not protect developer or CI environments. Code execution in an environment holding the skill's wallet or snapshot credentials could have substantial consequences, although neither credential access nor exploit reachability is established by this file.
Hono 4.13.7 is present and matches the supplied advisory concerning double decoding in serveStatic. If the skill's development or test server uses the affected static-file handler with attacker-controlled paths, crafted requests could bypass intended path restrictions and potentially expose files. Hono is marked development-only, and the lockfile does not demonstrate use of serveStatic, so this is a dependency vulnerability rather than a confirmed reachable disclosure.
The manifest pins Hono to the version identified by the reported advisory; if affected serveStatic functionality is exposed, double decoding could bypass request-path restrictions and expose otherwise restricted files. Hono is only a development dependency, which reduces likely production exposure, and this manifest does not establish vulnerable API usage or independently verify the advisory. The skill's wallet and snapshot context could increase the consequences of file exposure, but access to those assets is not demonstrated here.
When snapshot pricing is missing, malformed, or nonpositive, the policy substitutes $0.01 and can authorize an automatic snapshot instead of requiring human approval. The spending check and ledger use that estimate, while the snapshot action receives no maximum payment amount; unless the downstream payment implementation independently enforces the estimate, a higher actual charge could bypass the daily spending cap. This is particularly relevant for a recurring heartbeat with wallet access, although the provided file does not establish how downstream settlement validates prices.
If package-lock.json is missing, bootstrapDeps silently falls back to npm install without generating a lockfile, allowing dependency ranges to resolve to unreviewed versions despite the pinned-installation claim. --ignore-scripts blocks lifecycle scripts but does not prevent malicious dependency code from executing when imported; this is especially consequential for a skill that handles wallet keys, agent tokens, and state backups.
The manifest explicitly describes paying with the agent's own wallet over x402. In contrast, registerCard creates a wallet-free registration intended for owner card payments, and uploadPrepaidSnapshot consumes that owner-funded credit without an x402 payment. This introduces a materially different funding model and responsible payer, although this code does not itself charge a card.
suggest posts caller-provided text and an optional topic to a suggestions endpoint, attaching the agent's identity and authentication token when available. Product-feedback submission is separate from registration, encrypted state backup, heartbeats, coverage, and recovery; it is neither declared in the manifest nor necessary to implement those functions.
Detected: suspicious.env_credential_access