Security audit

Agent Layer

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for installing an agent crypto wallet, but it uses unpinned npm execution with auto-approval for a high-impact wallet and host-plugin install.

Review the npm package and publisher before installing, prefer a pinned exact version, avoid running the installer with elevated privileges, and understand that this may install persistent wallet and AI-host integrations able to affect financial workflows.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:32
Finding: Unpinned npm Package Is Downloaded and Executed Without Interactive Confirmation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The manifest/metadata advertises npx agentlayer without a version pin, normalizing a non-deterministic execution pattern before the user even reaches the detailed commands. While not itself an execution site in this line, it encourages insecure installation behavior that can lead to the same supply-chain compromise as the later commands.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill metadata and trigger phrases explicitly direct users toward invoking an npm package via npx without a pinned version. That causes execution of whatever package version is current at runtime, creating a supply-chain risk where a compromised or malicious update could run arbitrary code on the host during wallet installation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The install flows use --yes to auto-approve wallet and plugin installation without any adjacent warning that the commands will execute remote package code and modify the local system. In the context of a wallet/plugin installer, suppressing prompts and omitting explicit consent increases the chance that users or agents will perform impactful system and financial-surface changes without understanding the risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This command executes npx @agentlayer.tech/wallet install --yes without version pinning, so the host will fetch and run the latest published package code. For a wallet installer, that is especially dangerous because compromise could lead to arbitrary system changes, credential theft, wallet seed exposure, or malicious plugin deployment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The second unpinned invocation on this line repeats the same supply-chain risk for the claude-code install step. Even if the first package execution were safe, the follow-on unpinned plugin install still allows arbitrary code from the current registry version to execute with user privileges.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The second unpinned npx call on the same line independently introduces remote-code-execution risk during the Codex plugin installation step. Given the wallet context, exploitation could affect both the host environment and financial operations exposed to the agent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The second invocation on this line repeats the same unpinned supply-chain exposure for the Hermes-specific plugin installation. An attacker controlling or poisoning the package version could execute arbitrary code, implant persistence, or tamper with wallet-related configuration.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.