T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:8- Finding
Unrestricted Wallet Private Key Use for Automatic Paid Requests
- Content
View full analysis
- Remediation
View remediation
Security audit
Portfolio Heat
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent paid-signal purpose, but it gives an agent raw wallet signing authority for automatic paid requests without enough user-side spending controls.
Install only with a dedicated low-balance wallet on Base, not a primary wallet. Treat each invocation as a paid request, avoid automatic retries, and ensure your agent asks before spending or has an external spending limit.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to make an x402-authenticated paid network request using a locally stored EVM private key, but it does not clearly warn that invoking the skill can spend funds or that the private key is a sensitive credential. In an agent setting, this can lead to unintended paid calls, silent wallet expenditure, and unsafe handling of signing material if users or orchestrators invoke the skill without understanding the financial and credential implications.
- Content