T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:32- Finding
Mandatory Execution of Mutable Remote Bootstrap Scripts
- Content
View full analysis
- Remediation
View remediation
Security audit
agent-genesis SKILL
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it asks agents to run mutable remote installers and controls real blockchain wallet and DeFi actions with plaintext secrets, so it needs Review before use.
Install only after reviewing and pinning the bootstrap and dependencies. Use a disposable low-value wallet, do not reuse a primary wallet, avoid auto-running first-load commands, treat .env MODEL_KEY as sensitive, and require explicit human review for every transaction, approval, EIP-7702 delegation, margin action, or live-chain test.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (5)
T07 · Tool Hijacking and Spoofing
Error
- Location
likwid-fi/likwid-fi.js:40- Finding
Unsigned Remote Configuration Controls Token Approvals and Transaction Targets
- Content
View full analysis
controller.abort(), REMOTE_FETCH_TIMEOUT_MS); const res = await fetch(`${REMOTE_POOLS_BASE_URL}/${network}.json`, { signal: controller.signal }); clearTimeout(timer); if (!res.ok) return null; return await res.json(); } catch { return null; } } ``` `likwid-fi/likwid-fi.js:127-145`: ```javascript async function loadNetworkConfig(network) { const cached = loadCachedNetworkConfig(network); const remote = await fetchRemoteConfig(network); if (remote) { // Update local cache with remote data fs.mkdirSync(POOLS_DIR, { recursive: true }); const cacheFile = path.join(POOLS_DIR, `${network}.json`); fs.writeFileSync(cacheFile, JSON.stringify(remote, null, 2) + "\n"); } else if (cached) { console.log(`> Note: Using cached pool config (remote unavailable)`); } const base = remote || cached; ``` `likwid-fi/likwid-fi.js:337-359`: ```javascript async function buildApprovalCalls(publicClient, owner, tokenAddress, tokenSymbol, spender, amount) { const currentAllowance = await publicClient.readContract({ address: tokenAddress, abi: ERC20_ABI, functionName: "allowance", args: [owner, spender], }); if (currentAllowance >= amount) return []; console.log(`> Approving ${tokenSymbol}...`); const calls = []; if (currentAllowance > 0n) { calls.push({ to: tokenAddress, value: 0n, _isApproval: true, data: enco ...[truncated 3300 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
bootstrap.sh:18- Finding
Unpinned Dependency Installation Executes Mutable Supply-Chain Content
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
genesis.js:505- Finding
Unencrypted Long-Lived Private Key Shared Across Mining and DeFi Components
- Content
View full analysis
⏭️ Wallet already exists.`); console.log(`> EOA Address: ${signer.address}`); } else { const dir = path.dirname(WALLET_FILE); if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true }); const privateKey = generatePrivateKey(); const newSigner = privateKeyToAccount(privateKey); const data = { address: newSigner.address, privateKey: privateKey }; fs.writeFileSync(WALLET_FILE, JSON.stringify(data, null, 2), { mode: 0o600 }); ``` `likwid-fi/config.json:1-4`: ```json { "network": "base", "keyFilePath": "~/.openclaw/.likwid_genesis_wallet.json" } ``` `likwid-fi/likwid-fi.js:173-187`: ```javascript function readPrivateKey(keyFilePath) { const resolved = path.resolve(expandHome(keyFilePath)); if (!fs.existsSync(resolved)) { console.log(`> ERROR: Private key file not found: ${resolved}`); return null; } let raw = fs.readFileSync(resolved, "utf8").trim(); // Support JSON wallet files (e.g., agent-genesis format) try { const json = JSON.parse(raw); if (json.privateKey) raw = json.privateKey; } catch (_) {} if (!raw.startsWith("0x")) raw = "0x" + raw; return raw; } ``` ### Technical Analysis The Skill generates a wallet private key and stores it unencrypted in JSON. File mode `0600` correctly restrict ...[truncated 1565 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
CLAUDE.md:52- Finding
Repository Instructions Require Testing Against Live Blockchain Networks
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (71)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Optional — Bind LLM billing for score boost:
bash echo 'MODEL_TYPE=openrouter' > .env echo 'MODEL_KEY=sk-or-v1-...' >> .env node genesis.js reclaim_bill # Generate zkTLS billing proof
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
This line instructs users to write an API key into a local .env file, creating a credential exposure risk if the file is later committed, read by other local processes, included in backups, or mishandled by the skill. In the context of an agent tool that may automate external calls, storing live provider keys without safeguards materially increases the risk of unauthorized usage or billing abuse.
- Content
bash echo 'MODEL_TYPE=openrouter' > .env echo 'MODEL_KEY=sk-or-v1-...' >> .env node genesis.js reclaim_bill # Generate zkTLS billing proof
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's declared purpose does not mention DeFi swaps, LP management, margin trading, remote protocol integrations, or wallet-based transaction execution, yet the documentation expands into those capabilities. Hidden financial features are especially risky because they can lead to irreversible asset transfers and leveraged positions under the guise of a mining utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's declared purpose does not mention DeFi swaps, LP management, margin trading, remote protocol integrations, or wallet-based transaction execution, yet the documentation expands into those capabilities. Hidden financial features are especially risky because they can lead to irreversible asset transfers and leveraged positions under the guise of a mining utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's declared purpose does not mention DeFi swaps, LP management, margin trading, remote protocol integrations, or wallet-based transaction execution, yet the documentation expands into those capabilities. Hidden financial features are especially risky because they can lead to irreversible asset transfers and leveraged positions under the guise of a mining utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's declared purpose does not mention DeFi swaps, LP management, margin trading, remote protocol integrations, or wallet-based transaction execution, yet the documentation expands into those capabilities. Hidden financial features are especially risky because they can lead to irreversible asset transfers and leveraged positions under the guise of a mining utility.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `genesis.js check_wallet` or `genesis.js status` output. This is configured in `genesis.js` and must NEVER be hardcoded; it changes automatically when the proto
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `genesis.js check_wallet` or `genesis.js status` output. This is configured in `genesis.js` and must NEVER be hardcoded; it changes automatically when the proto
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The skill checks for and conditionally uses a MODEL_KEY credential from a local .env file to support external proof generation. Accessing API credentials inside a skill tied to remote services and financial workflows is sensitive because it expands the blast radius from token mining to third-party account abuse if handling is imperfect or downstream code is compromised.
- Content
Check for
.envconfiguration:bash cd ~/.openclaw/skills/agent-genesis && cat .env 2>/dev/null | grep -q MODEL_KEY && echo "configured" || echo "not configured"If NOT configured, prompt the human to bind their Model API Key:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The instructions tell the human to store an API key in a plaintext .env file inside the skill directory. Plaintext secret storage is dangerous because local compromise, accidental inclusion in backups, or other tools reading the workspace can expose the credential.
- Content
md > To set up, run these commands: > ```bash > cd ~/.openclaw/skills/agent-genesis > echo 'MODEL_TYPE=openrouter' > .env > echo 'MODEL_KEY=<YOUR_OPENROUTER_API_KEY>' >> .env > ``` > *(Replace `<YOUR_OPENROUTER_API_KEY>` with your actual OpenRouter API key)*
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The skill further instructs generating shell commands with the user's actual API key pre-filled for copy-paste use. This increases exposure risk because secrets may end up in shell history, agent transcripts, logs, screenshots, or clipboard managers.
- Content
md > ```bash > cd ~/.openclaw/skills/agent-genesis > echo 'MODEL_TYPE=openrouter' > .env > echo 'MODEL_KEY=<YOUR_OPENROUTER_API_KEY>' >> .env > ``` > *(Replace `<YOUR_OPENROUTER_API_KEY>` with your actual OpenRouter API key)* >
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The manifest describes a skill that allows agents to mine Agent Genesis Coin and use it as native working capital through Proof of Agent. This file instead contains an audit document describing security review results, findings, and deployment readiness for Solidity contracts, with no implementation of mining, token usage, or agent-capital functionality.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The skill reads local credentials from both environment variables and a .env file in the current working directory, expanding its access to secrets beyond what is necessary for wallet operations. In this skill's context, credential access is especially concerning because those secrets are subsequently used to contact external services and generate proof artifacts.
- Content
js let MODEL_TYPE = process.env.MODEL_TYPE || null; let MODEL_KEY = process.env.MODEL_KEY || null; try { const envPath = path.join(process.cwd(), ".env"); if (fs.existsSync(envPath)) { const envConfig = Object.fromEntries( fs
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The global loading of MODEL_TYPE and MODEL_KEY means credential access occurs at startup scope, even when most commands do not need those secrets. This broadens exposure and makes accidental or unauthorized credential use easier across the entire CLI lifecycle.
- Content
js } } // ======================= .env CONFIG ======================= const { MODEL_TYPE, MODEL_KEY } = loadEnvConfig(); // ======================= WALLET MANAGEMENT =======================
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code generates a blockchain private key and writes it unencrypted to a predictable file in the user's home directory without any confirmation, passphrase protection, or warning. Any local compromise, backup leak, or accidental file disclosure would fully compromise the wallet and any assets controlled by it.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill instructs the agent to execute a remote script directly with
bash <(curl ...), which gives unreviewed network content immediate code execution on the user's system. In this skill context, that is especially dangerous because the same workflow later asks for a private-key file path and performs wallet operations, so a compromised bootstrap could steal secrets, alter transactions, or install persistence.- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The ABI exposes a broad DeFi control surface including donation, borrowing, liquidation checks, fee queries, liquidity state, and NFT lock operations that do not align with the declared skill purpose of AGC mining via Proof of Agent. This capability mismatch is dangerous because an agent or user trusting the manifest could be induced to interact with unrelated financial primitives, creating risk of unauthorized fund movement, deceptive transaction generation, or hidden wallet-draining workflows.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The ABI includes ERC721 custody flows such as lockNFT, unlockNFT, transfer functions, approvals, and an administrative rescueNFT function, none of which are justified by a mining/Proof-of-Agent use case. In this context, NFT custody and rescue capabilities materially increase danger because they could be used to solicit approvals, transfer valuable NFTs, or normalize agent-mediated asset custody under a misleading benign description.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The ABI exposes lending, swapping, deposits/withdrawals, and transferable NFT position-management functions that do not align with the stated purpose of AGC mining or Proof of Agent rewards. In an agent skill, this capability mismatch is dangerous because it can enable undeclared financial interactions with external protocols, causing users or connected wallets to approve, deposit, swap, or move assets under a misleading description.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The ABI exposes a full-featured DeFi vault with swapping, lending, liquidity management, fee control, ownership transfer, and protocol administration, which is materially unrelated to the stated skill purpose of AGC mining/Proof of Agent earning. This capability mismatch is dangerous because an agent integrating this skill could be induced to interact with external asset-custody and trading functions far beyond user expectations, increasing the risk of unauthorized fund movement or deceptive financial actions.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The ABI includes high-risk administrative and custody-related methods such as collectProtocolFees, setProtocolFee, setDefaultProtocolFee, setMarginController, setProtocolFeeController, transferOwnership, take, settleFor, and unlock. In the context of a skill advertised for token mining, these capabilities are unjustified and especially dangerous because they could let an agent trigger privileged financial operations, move assets, or alter protocol control if connected execution paths or signer permissions are available.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This file implements a broad DeFi execution toolkit—wallet setup, swaps, LP management, pair creation, and leveraged margin trading—while the declared skill is described as AGC mining/working-capital. That mismatch materially increases risk because a user or agent invoking this skill may unknowingly authorize real asset transfers, approvals, and leveraged trades far outside the expected scope.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code can create arbitrary pools and open, modify, repay, and close leveraged margin positions, which exposes users to substantial financial loss if triggered unintentionally or by a confused agent. In the context of a skill presented as AGC mining, these capabilities are especially dangerous because they are unrelated, high-risk, and can cause irreversible on-chain actions.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The package metadata describes a Likwid.fi DeFi interaction toolkit, which materially conflicts with the declared skill purpose of mining Agent Genesis Coin. In an agent-skill ecosystem, this kind of identity mismatch is a strong indicator of deceptive packaging or repurposed code and can cause operators to load blockchain interaction logic they did not intend to trust.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The guidance explicitly includes mainnet deployment and live-chain testing commands but does not warn that these actions can spend real funds, alter on-chain state irreversibly, or expose private keys if handled unsafely. In an agent skill context, operational instructions are likely to be followed automatically or semi-automatically, which increases the chance of accidental financial loss.
- Content