Multichain Protocol

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:43 PM UTC
• Version: 1.0.0

Overview

This skill is a real crypto-wallet integration, but it gives an agent high-impact fund-moving authority without enough transaction safety controls or disclosure.

Review this carefully before installing. Treat it as a tool that can spend real crypto, create active trading rules, and disclose configured RPC URLs to a third-party canister. Use only low-value test wallets, avoid secret-bearing RPC URLs, rotate any provider keys already used with it, and require a separate human transaction review outside the skill before any send, swap, bridge, DeFi action, or automation rule.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:45

Finding

Unverified Remote Installer Is Downloaded and Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45–51; the same command is also declared in dependency metadata at line 11
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

Vulnerable Code:

markdown

### Step 1: Install dfx (ICP SDK)

If you don't have `dfx` installed, run this single command:

```bash
sh -ci "$(curl -fsSL https://internetcomputer.org/install.sh)"

text

The dependency metadata contains the equivalent command:

```yaml
install: "sh -ci \"$(curl -fsSL https://internetcomputer.org/install.sh)\""

Technical Analysis

The installation instruction retrieves a shell program from an external URL and immediately executes its response through sh -ci. The downloaded payload is not pinned to a release, inspected, authenticated with a release signature, or checked against a known cryptographic digest.

HTTPS protects the connection in transit but does not guarantee that the endpoint will continue serving the same audited content. The effective code executed by this Skill can consequently change after publication and review. Compromise of the hosting service, its release process, DNS or certificate trust path, or another upstream dependency could turn the installer into arbitrary code.

This behavior exceeds the minimum privileges needed to document or invoke wallet functionality. Installing dfx may be a legitimate prerequisite, but directly executing mutable network content is not necessary to meet that prerequisite safely.

Attack Path

1. An attacker compromises the remote installer endpoint, its deployment process, or a relevant network trust component.
2. The endpoint begins returning a modified shell script.
3. A user installs the Skill or follows its Quickstart instructions.
4. curl retrieves the attacker-controlled response.
5. Command substitution passes the response directly to sh -ci.
6. The payload executes ...[truncated 814 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the pipe-to-shell pattern with a version-pinned release artifact from an authenticated official release channel.
2. Publish and verify a SHA-256 or stronger digest before executing or installing the artifact.
3. Prefer cryptographic release-signature verification using a pinned, independently distributed public key.
4. Download the artifact to a local file, verify it, and only then execute it as a separate step.
5. Pin the expected dfx version so that the effective dependency cannot change silently.
6. Update both the Quickstart command and the dependency metadata; leaving either occurrence unchanged preserves the exposure.
7. Document the exact files, permissions, and network access required by the installer.
8. Where possible, direct users to a trusted platform package manager rather than executing remotely supplied shell text.

T09 · Insecure Skill Coding Practices

Error

• Location: wallet_commands.py:163

Finding

Credential-Bearing EVM RPC URLs May Be Disclosed to a Third-Party Canister

Content

View full analysis

Vulnerability Details

File Location: wallet_commands.py, lines 31–40, 115–119, and 163–172
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Relevant Configuration:

python

# ── EVM RPC config ──────────────────────────────────────────────
# You MUST provide your own RPC endpoints for EVM operations.
# MeneseSDK does NOT manage EVM RPCs — this keeps costs low.
# Free public RPCs work for testing; use Alchemy/Infura for production.
EVM_RPCS = {
    "ethereum":  {"rpc": "https://eth.llamarpc.com",         "chain_id": 1},
    "arbitrum":  {"rpc": "https://arb1.arbitrum.io/rpc",     "chain_id": 42161},
    "base":      {"rpc": "https://mainnet.base.org",         "chain_id": 8453},
    "polygon":   {"rpc": "https://polygon-rpc.com",          "chain_id": 137},
    "bsc":       {"rpc": "https://bsc-dataseed1.binance.org","chain_id": 56},
    "optimism":  {"rpc": "https://mainnet.optimism.io",      "chain_id": 10},
}

Balance Request Data Flow:

python

elif chain in EVM_RPCS:
    # getMyEvmBalance takes RPC endpoint URL (not chain name!)
    rpc = EVM_RPCS[chain]["rpc"]
    output = dfx_call("getMyEvmBalance", f'("{rpc}")')
    print(f"{chain.upper()} balance: {output}")

Transaction Request Data Flow:

python

elif chain in EVM_RPCS:
    # sendEvmNativeTokenAutonomous(to, valueWei:Nat, rpcEndpoint, chainId:Nat, ?quoteId)
    config = EVM_RPCS[chain]
    wei = int(float(amount) * 1e18)
    print(f"Sending {amount} on {chain} ({wei} wei) to {to_address}...")
    print(f"  RPC: {config['rpc']} | Chain ID: {config['chain_id']}")
    output = dfx_call(
        "sendEvmNativeTokenAutonomous",
        f'("{to_address}", {wei} : nat, "{config["rpc"]}", {config["chain_id"]} : nat, null)'
    )

The resulting arguments are passed to dfx and sent to the fixed MeneseSDK canister through this function:

python

cmd = [

...[truncated 2514 chars]

Remediation

View remediation

Remediation Suggestions

1. Clearly disclose that the complete RPC URL is transmitted to the MeneseSDK canister and must be treated as visible to that service.
2. Explicitly prohibit API keys, passwords, user information, or other secrets in URLs sent to the canister.
3. Prefer local RPC access: have the client contact the configured RPC endpoint directly and transmit only the minimum resulting transaction data needed by the signing service.
4. If the canister must access an RPC endpoint, use a user-controlled proxy with a credential-free public URL. The proxy should inject the provider credential server-side.
5. Restrict proxy access by origin, method, chain, contract, rate, and spending or quota limits.
6. Remove print(f" RPC: {config['rpc']} ...") or redact URL user information, paths, and query values before logging.
7. Avoid placing secret-bearing URLs in command-line arguments, which may be observable in process listings and diagnostic records.
8. Validate configured URLs and reject embedded user information, known API-key query parameters, and secret-bearing provider URL formats.
9. Use separate, scoped, rate-limited, low-quota credentials for this integration, and establish rotation and revocation procedures.
10. Advise existing users who configured private RPC URLs to rotate those credentials and inspect provider usage logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · wallet_commands.py (reported line 11)May include surrounding context.

python

wallet_commands.py addresses              # Get all 19 chain addresses
    python3 wallet_commands.py balance sol             # Check SOL balance
    python3 wallet_commands.py balance icp             # Check ICP balance
    python3 wallet_commands.py send sol 0.01 <addr>    # Send 0.01 SOL
    python3 wallet_commands.py send icp 1.5 <principal> # Send 1.5 ICP
    python3 wallet_commands.py send btc 0.001 <addr>   # Send BTC
    python3 wallet_commands.py send eth 0.01 <addr>    # Send ETH (requires EVM_RPCS config)
    python3 wallet_commands.py swap sol <input> <output> <amount> <slippage>  # Raydium swap

Calls MeneseSDK canister (urs2a-ziaaa-aaaad-aembq-cai) via dfx.
All address/balance queries are FREE. Sends cost $0.05 each. Swaps cost $0.075.

IMPORTANT: For EVM chains (ETH, ARB, BASE, etc.), you must provide your own
RPC endpoint. Configure EVM_RPCS below with your own URLs.

Tested: Feb 11, 2026
"""

import subprocess
import sys

CANISTER_ID = "urs2a-ziaa

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description substantially overstates what this code chunk does. The code is a command-line Python script that calls a specific canister through the dfx CLI. Its observable capabilities are limited to: retrieving addresses, checking balances on certain chains, sending native assets on multiple chains, and executing a Raydium swap. The description advertises a much broader wallet/DeFi automation platform, including cross-chain bridging, multiple DEX integrations, DeFi position management, automated trading strategies, and payment processing, none of which appear in this chunk. The primary purpose is related to wallet operations, so this is not unrelated code, but the implemented feature set is materially narrower than declared.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill prominently advertises transfers, swaps, bridging, and automated trading but does not provide a clear, upfront warning that these actions are irreversible, may incur fees/slippage, and can cause financial loss. In a wallet skill operating across 19 chains, omission of strong risk disclosures makes unsafe use more likely and can lead users or agents to initiate destructive on-chain actions without informed consent.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: multichain-protocol
description: Turn any AI agent into a 19-chain crypto wallet via MeneseSDK on ICP. Send tokens, swap on DEXes (Raydium, Uniswap, ICPSwap, KongSwap, Cetus, Minswap), bridge cross-chain, manage DeFi positions (Aave, Lido, LP), automate trading (DCA, stop-loss, rebalancing), and process payments — all from a single ICP canister.
version: 1.0.0
metadata:
  openclaw:
    emoji: "🌐"
    requires:
      bins:
        - name: dfx
          install: "sh -ci \"$(curl -fsSL https://internetcomputer.org/install.sh)\""
          check: "dfx --version"
        - name: python3
          install: "apt in

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

Or manually: copy `SKILL.md` + `wallet_commands.py` to your workspace.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 907)May include surrounding context.

md

Or manually: copy `SKILL.md` + `wallet_commands.py` to your workspace.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The send command performs irreversible blockchain transfers immediately from command-line arguments with no interactive confirmation, destination verification, dry-run, or explicit safety gate. In an agent skill context, this is especially dangerous because an LLM-driven or scripted workflow could be induced to send funds to an attacker-controlled address with a single tool invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The swap function executes an asset-changing transaction without a strong warning, quote review, confirmation prompt, or preview of expected output and price impact. In the context of an autonomous wallet skill, this materially increases the chance of prompt-induced, mistaken, or manipulated swaps that can cause direct financial loss.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares shell-capable installation behavior (sh -ci with curl) but does not declare any explicit tool scope or permissions boundaries. In an agent environment, missing scope metadata increases the chance that shell access is granted too broadly or invoked without clear user understanding, especially because installation commands fetch and execute remote content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example prompts are natural-language phrases such as 'send 0.1 ETH' or 'swap 100 USDC to SOL' that could be matched during ordinary conversation and trigger high-risk financial actions. In an autonomous or semi-autonomous agent, broad trigger phrasing increases the likelihood of unintended invocation, accidental transfers, or prompt-injection-assisted transaction execution.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · wallet_commands.py (reported line 55)May include surrounding context.

python

if is_query:
        cmd.insert(3, "--query")

    result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
    if result.returncode != 0:
        return f"ERROR: {result.stderr.strip()}"
    return result.stdout.strip()