T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:6- Finding
Unbounded Automatic Cryptocurrency Payments Using a Wallet Private Key
- Content
View full analysis
- Remediation
View remediation
Security audit
Btc Price Tick
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed paid BTC price lookup, but it asks agents to use a raw wallet private key for automatic paid calls without spending limits or strong user controls.
Install only with a dedicated low-balance wallet on Base, never a primary wallet key. Set external rate limits and budgets before enabling agent use, especially for polling or automated workflows, because repeated calls can spend funds automatically.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill declares EVM_PRIVATE_KEY as a required environment secret for a function that only retrieves a BTC price tick, creating an unnecessary request for highly sensitive signing material. Even if intended for x402 micropayments, exposing a blockchain private key to an agent skill materially increases the chance of wallet misuse, unauthorized spending, or key exfiltration if the skill or its dependencies are compromised.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation says payment authorization is handled automatically and demonstrates passing a private key directly into the client, but it does not prominently warn that each invocation can spend funds and that the supplied key is extremely sensitive. In an agent context, this is dangerous because users may enable unattended polling loops or broad tool access, leading to repeated charges or unsafe secret exposure without informed consent.
- Content
Static analysis
No suspicious patterns detected.