Agent Casino

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:19 PM UTC
• Version: 2.0.1

Overview

This skill is transparent about being a real-USDC casino tool, but it asks users or agents to sign transaction data supplied by a remote API without local validation.

Review before installing or using with any funded wallet. Only sign transactions after independently verifying the Base chain, contract addresses, function calls, spender, amount, and calldata; do not rely on the API description alone. Treat game choices, salts, wallet addresses, and balances as visible to the API operator, and avoid using CASINO_URL overrides except in a trusted test setup.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/casino.js:14
• Finding: Unvalidated Remote Transaction Data Can Induce Malicious Real-Money Transactions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/casino.js:5`, `scripts/casino.js:14-28`, `scripts/casino.js:70-135`; `SKILL.md:51-54`, `SKILL.md:108-115` **Vulnerability Type**: Trusting unvalidated transaction targets and calldata supplied by a remote API **Risk Level**: High ### Vulnerable Code ```javascript const BASE_URL = process.env.CASINO_URL || 'https://casino.lemomo.xyz'; ``` ```javascript async function request(method, path, body) { const opts = { method, headers: { 'Content-Type': 'application/json' }, }; if (body) opts.body = JSON.stringify(body); const res = await fetch(`${BASE_URL}${path}`, opts); const data = await res.json(); if (!res.ok) { console.error(`Error ${res.status}: ${data.error || JSON.stringify(data)}`); process.exit(1); } return data; } ``` The returned transaction fields are printed without validation: ```javascript case 'deposit': { if (!address || !amount) { console.error('--address and --amount required'); process.exit(1); } const d = await request('POST', '/deposit', { address, amount }); console.log(`Needs approval: ${d.needsApproval}`); console.log('Transactions to sign:'); d.transactions.forEach((tx, i) => { console.log(` ${i + 1}. ${tx.description}`); console.log(` to: ${tx.to}`); console.log(` data: ${tx.data}`); }); break; } case 'withdraw': { if (!amount) { console.error('--amount required'); process.exit(1); } const d = await request('POST', '/withdraw', { amount }); console.log(`${d.transaction.description}`); console.log(` to: ${d.transaction.to}`); console.log(` data: ${d.transaction.data}`); break; } ``` The documented workflow encourages signing the returned data: ```text 1. Deposit: POST /deposit → sign & send approve + deposit txs 2. Create: POST /create → sign & send createGame tx (save salt!) ``` ### Technical Analysis The remote service controls the transaction destination and calldata displayed to the ...[truncated 2204 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the expected Base Mainnet chain ID and reject requests intended for any other chain. 2. Pin the documented CasinoRouter, RPSGame, and USDC addresses in trusted local code. 3. ABI-decode every returned transaction before it is displayed or handed to a wallet. 4. Enforce an allowlist of operation-specific destination addresses and function selectors. 5. Validate all decoded arguments, including: - Approval spender and exact or narrowly bounded approval amount. - Deposit and withdrawal amount. - Game ID, choice, commitment, and stake. - Recipient and player address. - Zero native-currency value where appropriate. 6. Reject unknown contracts, selectors, extra transactions, malformed calldata, and unexpected response fields. 7. Prefer constructing calldata locally from pinned, audited ABIs instead of accepting opaque transaction data from the API. 8. Display a human-readable, locally decoded transaction summary and require explicit confirmation for approvals and transfers. 9. Avoid unlimited token approvals. If approval is required, restrict it to the exact intended amount. 10. Treat `CASINO_URL` overrides as unsafe development functionality, or require an explicit warning and trusted-host allowlist. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/casino.js:93
• Finding: Commit-Reveal Choices and Salts Are Disclosed to the Remote API<![CDATA[ ## Vulnerability Details **File Location**: `scripts/casino.js:93-113`, `scripts/casino.js:125-127`; `SKILL.md:79-100` **Vulnerability Type**: Disclosure of commit-reveal preimages to a remote service and through command-line arguments **Risk Level**: Medium ### Vulnerable Code ```javascript case 'create': { if (!choiceNum) { console.error('--choice required (rock|paper|scissors or 1|2|3)'); process.exit(1); } const body = { choice: choiceNum }; if (salt) body.salt = salt; const d = await request('POST', '/create', body); console.log(`Commitment: ${d.commitment}`); console.log(`Salt: ${d.salt}`); console.log(`Choice: ${d.choice}`); console.log(`⚠️ SAVE YOUR SALT — you need it to reveal!`); console.log(`\nTransaction to sign:`); console.log(` ${d.transaction.description}`); console.log(` to: ${d.transaction.to}`); console.log(` data: ${d.transaction.data}`); break; } case 'join': { if (!id || !choiceNum) { console.error('--id and --choice required'); process.exit(1); } const body = { gameId: id, choice: choiceNum }; if (salt) body.salt = salt; const d = await request('POST', '/join', body); console.log(`Game: ${d.gameId}`); console.log(`Salt: ${d.salt}`); console.log(`⚠️ SAVE YOUR SALT — you need it to reveal!`); console.log(`\nTransaction to sign:`); console.log(` ${d.transaction.description}`); console.log(` to: ${d.transaction.to}`); console.log(` data: ${d.transaction.data}`); break; } ``` The reveal command also accepts the secret through a process argument and sends it to the service: ```javascript case 'reveal': { if (!id || !choiceNum || !salt) { console.error('--id, --choice, and --salt required'); process.exit(1); } const d = await request('POST', '/reveal', { gameId: id, choice: choiceNum, salt }); ``` ### Technical Analysis A commit-reveal protocol is intended to conceal each player's choice until the reveal phase. Here, `/create` and `/join` receive the plaintext choice be ...[truncated 1931 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Generate salts locally using a cryptographically secure random-number generator. 2. Compute the choice-and-salt commitment locally from an explicitly documented encoding. 3. For `create` and `join`, send only the commitment to the API; do not disclose the plaintext choice or salt. 4. Send the choice and salt only during the reveal phase, when disclosure is required by the protocol. 5. Verify locally that generated reveal calldata contains the intended game ID, choice, and salt. 6. Store salts in a user-protected file or secret store with restrictive permissions until reveal. 7. Avoid accepting salts directly through command-line arguments. Use protected standard input, an interactive hidden prompt, or a restricted file descriptor. 8. Prevent salts and choices from appearing in ordinary logs, telemetry, error reports, and shell history. 9. Update the documentation to explain which parties can observe commitment preimages and avoid claiming full commit-reveal fairness while the API knows those preimages. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill describes network interactions with a third-party API and implicitly requires wallet-related operations, but it does not declare any explicit tool scope or permissions boundaries. In an agent setting, this can cause the host to expose broader network or environment capabilities than intended, increasing the risk of unauthorized requests or unsafe handling of wallet-connected actions involving real funds.

External Transmission

Medium

• Category: Data Exfiltration

Content

### GET /balance/:address
Query Router balance for an address.
```bash
curl https://casino.lemomo.xyz/balance/0xYOUR_ADDRESS
```
Returns: `{ "address": "0x...", "balance": "1.05", "balanceRaw": "1050000" }`

• Confidence: 88% confidence
• Finding: The skill instructs the agent to send wallet addresses and game activity to an external domain, which constitutes external data transmission to an untrusted third-party service. In this specific skill, the risk is heightened because the service is tied to real-money gameplay and may influence transaction preparation, exposing sensitive behavioral or financial metadata and creating phishing or transaction-manipulation risk if the endpoint is compromised or misleading.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/casino.js:6