Security audit

Agieth

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a domain/DNS tool, but it also includes under-disclosed crypto-transfer functions that can move funds if a private key is available.

Install only if you trust agieth.ai for agent-driven domain, DNS, Cloudflare, and payment workflows. Prefer manual wallet payment, do not provide an Ethereum private key unless it is a dedicated low-balance wallet, and require human review before purchases, DNS deletions, tunnel/subscription changes, or any blockchain transaction.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares required environment variables and clearly documents outbound network access, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: a user or platform may authorize the skill under the false assumption that it has no sensitive capabilities, even though it can access secrets and transmit data to external services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented behavior extends beyond the headline description into financially and operationally sensitive actions, including blockchain payments, optional wallet private key use, Cloudflare tunnel creation, and account/balance operations. This mismatch is dangerous because users may consent to a domain/DNS management skill without realizing it can move funds, use private keys, or create externally reachable hosting infrastructure.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill’s stated purpose is domain, DNS, and Cloudflare management, but it also includes wallet generation and direct on-chain payment functionality. That expands the trust boundary significantly: an agent granted this skill could create keys and transmit cryptocurrency, enabling irreversible fund movement well beyond the advertised operational scope.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code reads an Ethereum private key from environment variables and uses it to sign and broadcast ETH/ERC20 transactions. In an agent environment, this creates a direct path from ambient secrets to irreversible asset transfer, which is especially dangerous because the skill’s main domain-management purpose does not justify access to blockchain signing material.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The helper methods send authenticated requests using a bearer API key without any built-in disclosure, confirmation, or safety gating. In an agent setting, hidden credential-bearing calls can cause unintended external actions or data exposure if invoked implicitly from higher-level workflows.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Deleting DNS records is a destructive action that can immediately break email, websites, or service routing, yet the method performs the operation directly with no confirmation or safeguard. In an autonomous-agent context, this increases the chance of accidental or malicious service disruption.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Domain registration is an external, potentially billable and effectively irreversible operation, but the method executes it without any visible warning or confirmation requirement. This can lead to unwanted purchases, registrar-side commitments, or abuse if an agent is induced to act on attacker-controlled inputs.

Missing User Warnings

High

Confidence: 99% confidence
Finding: This method signs and broadcasts ETH transfers using a private key, with no user-facing warning, policy gate, or confirmation despite the transfers being irreversible. In skill context, this is more dangerous because the skill is presented as infrastructure/domain management, so operators may not expect it to have spend authority over cryptocurrency funds.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The ERC20 transfer function uses a private key to perform token transfers without any disclosure or explicit confirmation, creating a path to irreversible asset loss. Because the skill’s declared purpose does not center on crypto custody or payments, this hidden capability materially increases the risk of operator deception and agent misuse.

Static analysis

No suspicious patterns detected.