circle chain skill

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:17 AM UTC
• Version: 1.1.2

Overview

This skill is a coherent guide for a Circle Chain SDK and CLI, but users should be cautious because it relies on an external npm package for sensitive wallet and account operations.

Before installing, treat the npm package as the code you are trusting: prefer a reviewed pinned version, avoid global install unless you need the `circle` command, and do not enter account, wallet, or payment-password data until you are comfortable with the package provenance. Set an explicit gateway host or `CIRCLE_SKIP_GEO=1` if you do not want the SDK to contact the GeoIP service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10
• Finding: Unpinned Third-Party Package Installation with Global CLI Exposure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 10 and 30–34 **Vulnerability Type**: Unreviewed and unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown - **npm**: `@lidh04/circle-chain-sdk` — local dependency: `npm i @lidh04/circle-chain-sdk` ``` ```bash ### Install globally npm install -g @lidh04/circle-chain-sdk circle --help ``` ### Technical Analysis The Skill directs users or agents to install `@lidh04/circle-chain-sdk` without pinning an exact version or supplying a lockfile, integrity hash, source commit, or other reproducible provenance. The package implementation is not included in the audited artifact, so its installation scripts and runtime behavior cannot be independently verified. The global installation command is particularly sensitive because it may: - Execute npm lifecycle scripts with the installing user's privileges. - Add a package-controlled `circle` executable to the user's command path. - Allow a future release to change behavior without any corresponding modification to this reviewed Skill. - Expose authentication credentials, payment passwords, wallet operations, and transfer data to a compromised dependency when users invoke the documented functionality. This is a supply-chain risk rather than proof that the named package is currently malicious. The risk arises from implicitly trusting mutable, unaudited package content. ### Attack Path 1. An attacker compromises the package publisher account, registry distribution channel, or a future package release. 2. The attacker publishes a modified version containing a malicious lifecycle script or CLI implementation. 3. A user follows the unpinned command `npm install -g @lidh04/circle-chain-sdk`. 4. npm retrieves the latest matching release and may execute its installation lifecycle scripts. 5. The package installs a globally available `circle` executable. 6. When the user subsequently performs login, wallet, pa ...[truncated 815 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a reviewed, exact version rather than allowing npm to resolve a mutable latest release. 2. Commit and enforce a lockfile containing registry integrity hashes. 3. Provide verifiable source provenance, including the corresponding repository commit and build process. 4. Audit package source, transitive dependencies, npm lifecycle scripts, and published tarball contents before recommending installation. 5. Prefer a project-local installation over `npm install -g`, and invoke the CLI through an explicit local path or a package script. 6. Disable lifecycle scripts during installation where compatible, for example by using npm's script-disabling controls. 7. Use registry allowlisting, package-signing or provenance verification, and automated dependency monitoring. 8. Clearly warn users that the package processes authentication and financial information, and advise them not to supply sensitive credentials until the installed artifact has been verified. ]]>

other

Note

• Location: SKILL.md:128
• Finding: Automatic Disclosure of Public IP Address to an External GeoIP Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 128–143 **Vulnerability Type**: Privacy information disclosure through automatic external GeoIP lookup **Risk Level**: Low ### Vulnerable Code ```markdown **GeoIP behavior (Node.js only):** - On first call to `getGatewayHttp()` without a valid `~/.ccl/http-geo.cache`, the SDK fetches your public IP country from `https://ipwho.is/`. - **CN** country code → keeps the bundled default host (circle-node.net). - **Any other** country → uses `www.circlecoin.me` (overseas host). - Result is cached to `~/.ccl/http-geo.cache` with a 7-day TTL. - Setting an explicit `host` in `http.config` **disables Geo-based host selection**. - Disable entirely with environment variable `CIRCLE_SKIP_GEO=1`. ``` ### Technical Analysis According to the Skill documentation, the first call to `getGatewayHttp()` contacts `https://ipwho.is/` when no valid GeoIP cache or explicit host is available. The external service necessarily receives the user's public IP address, request time, and ordinary network connection metadata. The country result is then retained in `~/.ccl/http-geo.cache` for seven days. Geo-based gateway selection is ancillary to the SDK's principal authentication, wallet, transfer, and mining functions. A fixed default gateway or an explicitly selected host would provide the core functionality without disclosing the user's network location to an additional third party. Consequently, an automatic opt-out lookup exceeds the minimum network access required for basic SDK configuration. The documentation provides two mitigations—setting an explicit host or defining `CIRCLE_SKIP_GEO=1`—but the default remains automatic disclosure rather than informed opt-in consent. ### Attack Path 1. A Node.js application imports the SDK and calls `getGatewayHttp()`. 2. The user has no valid `~/.ccl/http-geo.cache` and has not configured an explicit gateway host. 3. `CIRCLE_SKIP_GEO=1` is not present in the process envi ...[truncated 1081 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make GeoIP lookup explicitly opt-in and obtain informed user consent before the first external request. 2. Default to a fixed gateway or require users to select a gateway during configuration. 3. If GeoIP routing remains available, disclose the destination, transmitted metadata, purpose, retention behavior, and opt-out mechanism before use. 4. Consider performing region selection locally or through an already required service rather than contacting an additional third party. 5. Store only the minimum necessary cache value, apply restrictive file permissions, and provide a documented cache-deletion command. 6. For privacy-sensitive environments, configure an explicit host or set `CIRCLE_SKIP_GEO=1` before importing or invoking the SDK. 7. Add tests verifying that no GeoIP request occurs when consent is absent, an explicit host is configured, or the opt-out variable is set. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent

Content

| Export | Description |
|--------|------------|
| `getGatewayHttp()` | Resolve effective HTTP settings (defaults → Geo hint → user `http.config`). Returns object with `host`, `protocol`, `timeoutRead`, `timeoutWrite`, `retryCount`, `retryWaitTime`, `sslSupport`. |
| `mergeUserHttpConfig(updates)` | Write key/value pairs to `~/.ccl/http.config`. |
| `getUserHttpConfigPath()` | Return path to `~/.ccl/http.config`. |
| `clearGatewayHttpCache()` | Invalidate in-memory cache for config and Geo host hint. |
| `refreshGatewayHttpGeoCache()` | Force refresh GeoIP lookup (Node only). |

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documents that the SDK performs an automatic GeoIP lookup against a third-party service (`https://ipwho.is/`) and caches the result, but it does not clearly warn that this transmits the user's public IP and related request metadata off-device. In a security/privacy context, undocumented outbound disclosure can surprise users, violate privacy expectations, and create compliance risk, especially because it occurs automatically on first configuration resolution.

Static analysis

No suspicious patterns detected.