Security audit

Xflows Bridge

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for crypto bridging, but it gives an agent sensitive wallet and transaction authority without enough scoping or safeguards.

Review carefully before installing. Use only test or low-value wallets, avoid pasting private keys or wallet passwords into chat or command arguments, pin and verify the xflows CLI source/version, require a dry run and explicit approval before any real send, and never run wallet show unless you intentionally need to export a key and can protect the output.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:16
Finding: Unpinned Global Installation of a Security-Critical Third-Party Package
Content: View full analysis
Remediation: View remediation
``` 2. Record and verify package integrity, provenance, publisher identity, and release signatures before installation. 3. Provide a lockfile or another reproducible dependency manifest where applicable. 4. Prefer a project-local, isolated installation over a global installation to reduce scope and prevent executable shadowing. 5. Review all npm lifecycle scripts and consider installing with lifecycle scripts disabled when they are unnecessary. 6. Link the skill to a specific reviewed source revision and document a reproducible mapping between source and published package. 7. Require a fresh security review before changing the pinned version. 8. Run the CLI in a restricted environment with access only to the wallet and network resources needed for the requested operation. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:30
Finding: Private Keys and Wallet Passwords Are Accepted Through Command-Line Arguments
Content: View full analysis
# new wallet xflows wallet create --name --encrypt --password # encrypted xflows wallet create --name --private-key 0x... # import key xflows wallet list # list all xflows wallet show --name [--password ] # show key xflows wallet balance --name --chain-id [--password ] # balance (own wallet) ``` ``` The complete command reference reinforces this interface: ```markdown ## wallet create Create a new EVM wallet. Saved to `~/.xflows/wallets/.json`. | Flag | Required | Description | |------|----------|-------------| | `--name ` | Yes | Wallet name (used as filename) | | `--encrypt` | No | Encrypt private key with a password | | `--password ` | No | Encryption password (prompted if `--encrypt` set without it) | | `--private-key ` | No | Import existing private key instead of generating | ``` ### Technical Analysis The documented interface encourages passing wallet encryption passwords and raw EVM private keys directly in command-line arguments. Command-line secrets can be exposed through several channels: - Shell history and command auditing. - Agent execution transcripts, tool-call records, and telemetry. - Process inspection facilities while the command is running. - Debug logs, terminal recordings, crash reports, and support bundles. - Accidental copying or disclosure of command examples containing real values. A private key is sufficient to authorize blockchain transactions independ ...[truncated 1913 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/commands.md:3
Finding: Wallet Encryption Is Optional and Raw Private-Key Display Is Supported
Content: View full analysis
.json`. | Flag | Required | Description | |------|----------|-------------| | `--name ` | Yes | Wallet name (used as filename) | | `--encrypt` | No | Encrypt private key with a password | | `--password ` | No | Encryption password (prompted if `--encrypt` set without it) | | `--private-key ` | No | Import existing private key instead of generating | ## wallet list List all saved wallets with address, encryption status, and creation date. No flags. ## wallet show Show wallet address and private key. | Flag | Required | Description | |------|----------|-------------| | `--name ` | Yes | Wallet name | | `--password ` | No | Password for encrypted wallets | ``` The quick reference presents unencrypted creation as the primary example: ```markdown xflows wallet create --name # new wallet xflows wallet create --name --encrypt --password # encrypted xflows wallet show --name [--password ] # show key ``` ### Technical Analysis Wallet encryption is optional, and the first wallet-creation example omits the `--encrypt` flag. The documentation states that wallet data is stored at `~/.xflows/wallets/.json`, but it does not specify restrictive filesystem permissions, encryption at rest by default, secure backups, or protection from indexing and synchronization services. The `wallet show` command explicitly displays the private key. In an AI-agent workflow, command output may be returned to the conversation, retained in tool traces, written to terminal logs, or captured by telemetry. Printing raw private ...[truncated 1702 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation states that wallet show reveals both the wallet address and the private key, but provides no warning about the extreme sensitivity of private keys or the risk of exposing them to logs, transcripts, screenshots, or untrusted callers. In an agent skill context, this is especially dangerous because an LLM-driven tool may be prompted to display secrets back to the user or include them in conversation history, resulting in irreversible wallet compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly states the skill can create wallets and build, sign, and send cross-chain transactions, but provides no warning that these actions are sensitive, potentially irreversible, and may expose funds if misused by an autonomous agent. In an agentic context, normalizing autonomous signing and transmission without explicit consent boundaries increases the risk of unauthorized transfers, accidental loss, or unsafe wallet handling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes broad phrases such as 'transfer ETH', 'send tokens', and 'check balance', which can cause this bridge skill to activate for generic wallet or token-transfer requests beyond the intended cross-chain context. Because the skill is capable of creating wallets, handling private keys, and initiating irreversible on-chain transactions, over-broad invocation materially increases the chance of misrouting users into a high-risk financial workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill documents commands that accept sensitive secrets directly on the command line, including '--private-key 0x...' and '--password ', and also includes 'wallet show' which can reveal private key material. Command-line secrets are commonly exposed via shell history, process listings, logs, and telemetry, and in this skill's context that exposure can directly lead to wallet compromise and irreversible theft of funds.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: The skill documents persistent storage of wallets under ~/.xflows/wallets/<name>.json, which means sensitive key material may remain on disk across sessions. In a bridge and transaction-signing skill, persistent local wallet storage increases exposure to host compromise, accidental reuse, weak file permissions, backup leakage, or later agent access beyond the original user intent.
Content: Scanner excerpt · references/commands.md (reported line 3)May include surrounding context.
md
# XFlows CLI Complete Command Reference ## wallet create Create a new EVM wallet. Saved to `~/.xflows/wallets/<name>.json`.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/commands.md (reported line 58)May include surrounding context.
md
| Flag | Required | Description | |------|----------|-------------| | `--name <name>` | Yes | Wallet name | | `--force` | No | Skip confirmation prompt | ## chains

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The transaction-sending commands describe building, signing, broadcasting, approvals, and waiting for receipts, but do not warn that blockchain transfers and bridge operations are often irreversible, may incur fees, and can result in permanent loss if chain IDs, token addresses, recipient addresses, or slippage settings are wrong. In a skill intended for autonomous assistance, omission of these warnings increases the chance that users or agents initiate risky on-chain actions without adequate confirmation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The installation section instructs users to globally install an external CLI but does not warn that the tool can interact with wallets and execute real blockchain transactions. This omission may lead users or downstream agents to treat the dependency as harmless setup rather than software capable of moving assets or handling secrets.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.