ChainAI

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:12 AM UTC
• Version: 0.0.12

Overview

This skill is openly for blockchain wallet operations, but it gives an agent raw private-key access and non-interactive paths to irreversible financial transactions.

Review this carefully before installing. Use only an empty or low-value test wallet, avoid passing private keys on the command line, do not let an agent run broadcast/send/swap commands without explicit human approval for the exact transaction, and audit or pin the npm package before trusting it with funds.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:5
• Finding: Unreviewed External npm Package Handles Wallet Private Keys## Vulnerability Details **File Location**: `SKILL.md:5-19` **Vulnerability Type**: Supply-chain exposure involving a privileged third-party dependency **Risk Level**: High ### Evidence ```yaml metadata: author: kvhnuke version: 0.0.10 openclaw: requires: env: - CHAINAI_PRIVATE_KEY bins: - npx - node primaryEnv: CHAINAI_PRIVATE_KEY emoji: '⧫' homepage: https://github.com/kvhnuke/chainai install: - kind: node package: chainai bins: [chainai] ``` Runtime execution is subsequently documented as: ```bash npx chainai@0.0.10 <command> [options] ``` ### Technical Analysis The Skill delegates all sensitive blockchain operations to the externally distributed `chainai` npm package. The installation metadata names `chainai` without an exact version or integrity digest, even though the runtime examples request version `0.0.10`. The audited project contains only `SKILL.md`; it does not include the package implementation needed to verify how the private key is read, stored, logged, or transmitted. Network access is necessary for balance queries, blockchain broadcasts, transaction-status checks, and 1inch Fusion swaps. However, giving externally retrieved executable code direct access to `CHAINAI_PRIVATE_KEY` exceeds the privileges needed for read-only operations and creates a severe supply-chain trust boundary. Documentation prohibiting key transmission does not technically enforce that behavior in the npm implementation. Running the package through `npx` may download and immediately execute registry-hosted code. Without artifact integrity verification or bundled auditable source, a compromised package release, publisher account, registry response, installation script, or dependency could access the private key and create arbitrary signatures. ### Attack Path 1. An attacker compromises the npm package, its publis ...[truncated 1331 chars]
• Remediation: ## Remediation Suggestions 1. Pin the installation metadata to an exact package version rather than specifying only `package: chainai`. 2. Lock the complete dependency graph and verify package integrity with a trusted digest, npm lockfile, and registry provenance. 3. Include or vendor the executable source in the reviewed Skill so its key handling, network destinations, installation scripts, and transitive dependencies can be audited. 4. Establish reproducible builds that prove the reviewed source corresponds to the published npm artifact. 5. Separate read-only operations from signing operations. Balance and status queries should run without access to `CHAINAI_PRIVATE_KEY`. 6. Prefer a hardware wallet, isolated signer, or narrowly scoped signing service so external package code never receives the raw private key. 7. Restrict outbound network access for signing-only commands. Permit only explicit, reviewed blockchain RPC and swap endpoints for commands that genuinely require networking. 8. Run the package in a sandbox with minimal filesystem, environment, process, and network access. 9. Audit the exact npm release and its transitive dependencies before allowing it to handle funded wallets.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:143
• Finding: Private Keys Are Accepted and Repeatedly Demonstrated as Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md:143-155` **Vulnerability Type**: Sensitive credential exposure through process arguments and command history **Risk Level**: High ### Evidence ```markdown ### `who-am-i` Return the Ethereum address derived from a private key. ```bash npx chainai@0.0.10 who-am-i -k 0xKEY # or CHAINAI_PRIVATE_KEY=0xKEY npx chainai@0.0.10 who-am-i ``` **Options**: | Flag | Required | Description | | ------------------------- | -------- | ------------------------------------------------- | | `-k, --private-key <key>` | No | Private key. Falls back to `CHAINAI_PRIVATE_KEY`. | ``` The same `-k 0xKEY` pattern is repeated for signing, sending, and swapping operations at lines 172-173, 201, 228, 270, 365-366, 464-466, and 523-524. ### Technical Analysis Passing a private key through `-k` or `--private-key` places the secret in the process argument vector. Depending on the operating system and execution environment, command-line arguments may be exposed through process-inspection interfaces, monitoring agents, diagnostic tooling, terminal recording, Agent execution traces, shell history, audit logs, crash reports, or orchestration telemetry. The inline environment-assignment example can also be retained in shell history and may be captured by command logging. While lines 31-38 advise Agents to prefer `CHAINAI_PRIVATE_KEY` and not expose keys, the operational examples repeatedly promote the less secure command-line option. Documentation warnings do not prevent automated Agents or users from copying these examples with a real key. Because an Ethereum private key is a bearer credential with no inherent scope limitation, disclosure is substantially more severe than leakage of a revocable, narrowly scoped API token. ### Attack Path 1. A user or Agent substitutes a funded wallet's real private key into a documen ...[truncated 1168 chars]
• Remediation: ## Remediation Suggestions 1. Remove `-k` and `--private-key` from all documentation examples and preferably remove the option from the CLI. 2. Do not place literal secrets in inline environment assignments. Provision secrets through a protected secret manager or an execution environment that does not record the value. 3. Prefer hardware wallets, operating-system key stores, isolated signing agents, or encrypted keystores that require explicit authorization. 4. If environment-variable compatibility must remain, ensure child-process logs and error reports redact the variable and run each command with the smallest possible environment. 5. Ensure the CLI never prints private keys in errors, debug output, stack traces, or telemetry. 6. Disable shell tracing and command echoing for sensitive operations, and document the limitations of shell history and process inspection. 7. Add automated tests that inject canary secrets and verify they never appear in stdout, stderr, process diagnostics, logs, or outbound requests. 8. For potentially irreversible signing, sending, broadcasting, and swapping operations, require explicit confirmation showing the destination, network, amount, token, fees, contract, and approval scope without displaying the key. 9. Treat any key previously passed on a command line as potentially compromised; migrate assets to a newly generated wallet and revoke relevant token approvals.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: chainai
description: 'Ethereum & EVM blockchain CLI skill — sign messages, send tokens, swap via 1inch Fusion, check balances, broadcast transactions, and manage wallets across Ethereum and BNB Smart Chain.'
metadata:
  author: kvhnuke
  version: 0.0.10
  openclaw:
    requires:
      env:
        - CHAINAI_PRIVATE_KEY
      bins:
        - npx
        - node
    primaryEnv: CHAINAI_PRIVATE_KEY
    emoji: '⧫'
    homepage: https://github.com/kvhnuke/chainai
    install:
      - kind: node
        package: chainai
        bins: [chainai]
---

# chainai — Ethereum Transactions Skill

> **⚠️ DI

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The `gen-wallet` command returns the private key on stdout, but the command section itself does not prominently warn that stdout will contain a live secret. In an agent setting, stdout is commonly logged, relayed, or stored, so this can directly leak the wallet key and lead to total fund compromise.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documents immediate execution paths for blockchain actions, including token swaps and transaction submission, in a context involving real funds. Even though the tool mentions confirmations in some places, it also exposes non-interactive and skip-confirmation flows that can cause irreversible financial loss if an agent executes them without an explicit user authorization checkpoint.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### `swap`

Swap tokens via 1inch Fusion. Gets a quote first, then optionally submits the order. Use `-y` to skip confirmation and submit immediately.

```bash
npx chainai@0.0.10 swap -k 0xKEY --from-token 0xFROM --to-token 0xTO --amount 1.5

• Confidence: 94% confidence
• Finding: The skill explicitly supports `swap` with `-y` to skip confirmation and submit immediately, enabling autonomous financial actions. In a blockchain context, this is especially dangerous because swaps are irreversible, may require token approvals, and can move real assets based on untrusted or mistaken input.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `--to-token <address>`    | Yes      | Destination token contract address.               |
| `--amount <amount>`       | Yes      | Amount in human-readable units (e.g. `"1.5"`).    |
| `-n, --network <network>` | No       | Network (default: `mainnet`).                     |
| `-y, --yes`               | No       | Skip confirmation prompt and submit immediately.  |

**Output (stdout)** — quote:

• Confidence: 93% confidence
• Finding: The option table explicitly advertises `-y, --yes` as a way to skip confirmation and submit immediately. This normalizes autonomous execution for a high-risk financial operation, increasing the chance that an agent will perform irreversible trades without adequate review.

Static analysis

No suspicious patterns detected.