SHLL Safe Execution

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:58 AM UTC
• Version: 6.0.4

Overview

This DeFi skill is coherent and not deceptive, but it needs Review because it combines transaction authority, private-key handling, and unpinned remote npm execution.

Install only if you are comfortable with AI-operated DeFi transactions and can use a dedicated low-balance operator wallet. Pin and verify the npm package before use, avoid npx -y latest-version execution, never provide an owner or main-wallet key, and review each write-operation confirmation carefully.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:57

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:9, SKILL.md:167, README.md:15, and README.md:57-58
Vulnerability Type: Unpinned and automatically executed npm dependency
Risk Level: Medium

Vulnerable Code

SKILL.md:9 and SKILL.md:167:

bash

npm install -g shll-skills --registry https://registry.npmjs.org

README.md:15:

bash

npm install -g shll-skills

README.md:57-58:

json

"command": "npx",
"args": ["-y", "shll-skills", "--mcp"],

Technical Analysis

The documented installation paths do not pin shll-skills to an exact audited version or verify a package integrity digest. In particular, npx -y automatically downloads and executes whichever package version npm resolves at invocation time without an interactive approval step.

The package is intended to run with access to RUNNER_PRIVATE_KEY, a sensitive operator-wallet credential. However, this artifact contains only README.md and SKILL.md; it does not include the installed package's source code, a dependency lockfile, or integrity metadata. Consequently, the effective executable payload and the claimed protections cannot be verified from the reviewed project.

This creates a supply-chain trust gap: a compromised maintainer account, malicious package release, registry compromise, or unexpectedly changed latest release could cause users to execute code different from the version originally reviewed.

Attack Path

1. An attacker compromises the npm package, its publishing account, or a release dependency and publishes a malicious version under shll-skills.
2. A user or AI agent follows the documented unpinned global installation command or starts the MCP server through npx -y.
3. npm resolves, downloads, and executes the malicious release.
4. The package runs in a process whose environment contains RUNNER_PRIVATE_KEY.
5. Malicious code reads and exfiltrates that key, submits unintende ...[truncated 1108 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every installation and execution command to a specific audited version, for example:

   bash

   npm install -g shll-skills@6.0.4 --registry https://registry.npmjs.org
   

   json

   {
     "command": "npx",
     "args": ["--no-install", "shll-skills@6.0.4", "--mcp"]
   }
   

2. Avoid unattended remote execution through npx -y. Install a reviewed package first and run the locally installed binary.
3. Publish and verify npm provenance, signatures, and integrity hashes. Document a reproducible verification procedure before execution.
4. Include the executable source, exact dependency manifest, and lockfile in the audited artifact so package and transitive-dependency behavior can be reviewed.
5. Use a controlled internal registry or approved package mirror where practical.
6. Run the package in a sandbox with minimal filesystem, environment, and network permissions.
7. Expose only the dedicated low-value operator key to the process. Never expose owner-wallet credentials or unrelated secrets.
8. Preserve the documented transaction confirmation requirements and independently verify deployed contract addresses and PolicyGuard behavior.
9. Keep the version references consistent: README.md identifies version 6.0.2, while SKILL.md identifies 6.0.4.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

NFT, or bypass spending limits.
    Treat it as a restricted session key, not a master key.
  guidance: >
    Use generate-wallet to create a purpose-built operator wallet.
    Fund it with ~$1 BNB for gas only. Do not store trading capital in this wallet.
    The operator wallet is NOT the owner wallet, NOT the vault, NOT the Agent NFT holder.
---

# SHLL — Contract-Enforced Safe Execution for AI Agents on BNB Chain

## What is SHLL?

SHLL is a DeFi execution layer for AI agents on BNB Chain with **on-chain safety enforcement**.
Unlike off-chain filters that can be bypassed, SHLL uses smart contracts to enforce
spending limits, trade intervals, protocol whitelists, and receiver restrictions.
Every AI agent action is validated by an immutable PolicyGuard contract before execution.

Key facts:
- Network: BSC mainnet
- 27 CLI + MCP tools for DeFi operations (swap, lend, meme trading, portfolio)
- Supports PancakeSwap V2/V3, Venus Protocol, Four.meme
- MCP Server compatible with Claude,

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md

5. Do not repeat private keys after initial `generate-wallet` output.
6. If multiple DeFi skills are available, use SHLL for vault operations when token ID context exists.
7. Treat raw calldata as high risk. Use strict recipient checks.
8. Do not bypass security controls for convenience.

## Security Model

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 87% confidence

Finding

The README explicitly instructs the AI to set RUNNER_PRIVATE_KEY automatically and avoid asking the user to manage that secret during onboarding. In a skill whose purpose is to autonomously execute on-chain financial transactions, this encourages the agent to handle sensitive key material and make operational decisions without an explicit user confirmation boundary, increasing the risk of unauthorized trades or unsafe secret handling.

Content

Scanner excerpt · README.md (reported line 128)May include surrounding context.

shll-run swap -f BNB -t USDC -a 0.1 -k 5

text

In OpenClaw, AI should set `RUNNER_PRIVATE_KEY` for the current session automatically. Do not ask the user to edit environment variables manually during chat onboarding.

### Commands

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 84% confidence

Finding

The skill instructs the AI to set RUNNER_PRIVATE_KEY automatically for the current session in OpenClaw rather than requiring an explicit user action. Even though this is framed as convenience for an operator hot wallet, automatic handling of a private key by the agent increases the chance of unintended secret ingestion, storage, propagation across tools, or use in the wrong session context.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md

- Immediately explain that this is the operator hot wallet for AI only.
- Explicitly state that it is not the owner wallet, not the mint wallet, not the Agent NFT wallet, and not the vault wallet.
- Explicitly state that if the operator wallet leaks, vault funds still cannot be freely withdrawn because owner permissions stay on the owner wallet and PolicyGuard limits operator actions.
- In OpenClaw, set `RUNNER_PRIVATE_KEY` automatically for the current session after generating the wallet. Do not ask the user to set the environment variable manually.

2. Verify gas:
- Ensure the operator wallet has a small BNB balance for gas.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

md

- `four_buy`
- `four_sell`

Read-only commands (no confirmation needed): `config`, `policies`, `status`, `history`, `portfolio`, `price`, `tokens`, `search`, `balance`, `four_info`.

## CLI Commands

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

This section again directs the AI to manage RUNNER_PRIVATE_KEY automatically and to run readiness checks autonomously after setup. The readiness checks are low risk, but automatic secret configuration by the agent creates a broader trust boundary and can normalize silent handling of credentials, which is dangerous in multi-tool or prompt-injection-prone environments.

Content

Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.

md

2. Always call it the operator wallet or AI hot wallet.
3. Always explain the dual-wallet model the first time setup is discussed.
4. Always warn that the operator wallet must not be used to mint, rent, or hold the Agent NFT.
5. Do not ask the user to manually set `RUNNER_PRIVATE_KEY` in OpenClaw; AI should do it.
6. After setup is complete and the user provides a token-id, run readiness checks automatically before asking the user what to do next.
7. When multiple listings are available, recommend one by default and explain why.
8. Prefer the structured `status.readiness` fields over ad-hoc prose when deciding the next user-facing instruction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.