ClawHub
Back to skill

Security audit

Swarmwage Hire

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for hiring paid agents, but it asks users to run an unpinned external MCP package and persist a wallet private key in local configuration.

Review before installing. Use only a dedicated low-balance wallet, avoid reusing a personal or treasury key, prefer a secret manager or protected runtime environment over config files, and pin or otherwise verify the MCP package before running it. Treat any exposed private key as compromised.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:14
Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:14, SKILL.md:60, SKILL.md:70-71, SKILL.md:87-88, SKILL.md:103-104, SKILL.md:119-120, SKILL.md:130, SKILL.md:143, SKILL.md:156, SKILL.md:163-164, and SKILL.md:177-178
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

The package installation metadata executes the package without pinning an exact version:

yaml
bins:
  - node
install:
  - npx -y @swarmwage/mcp --version

The runtime setup instructions repeatedly use the same unpinned package:

bash
claude mcp add swarmwage -- npx -y @swarmwage/mcp

Representative MCP configuration:

json
{
  "mcpServers": {
    "swarmwage": {
      "command": "npx",
      "args": ["-y", "@swarmwage/mcp"],
      "env": { "SWARMWAGE_PRIVATE_KEY": "0x..." }
    }
  }
}

OpenClaw configuration:

bash
openclaw mcp set swarmwage '{"command":"npx","args":["-y","@swarmwage/mcp"],"env":{"SWARMWAGE_PRIVATE_KEY":"0x..."}}'

Codex CLI configuration:

bash
codex mcp add swarmwage --transport stdio --command "npx -y @swarmwage/mcp"
toml
[mcp_servers.swarmwage]
command = "npx"
args = ["-y", "@swarmwage/mcp"]
env = { SWARMWAGE_PRIVATE_KEY = "0x..." }

Technical Analysis

npx -y @swarmwage/mcp resolves and executes the package version selected by the package registry at invocation time. No exact version, lockfile, or integrity digest constrains the downloaded artifact. The -y option also suppresses the normal installation confirmation.

Consequently, the code executed after installation can differ from the code that was reviewed during this audit. A compromised package publisher account, registry compromise, or malicious future package release could introduce arbitrary code into every configured MCP host.

The exposure is especially sensitive because the downloaded package is deliberately lau ...[truncated 1559 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin @swarmwage/mcp to a reviewed, exact version in every command and configuration, for example @swarmwage/mcp@X.Y.Z.
  2. Remove -y where practical so package installation is not silently approved.
  3. Install through a lockfile-controlled workflow and enforce package integrity hashes.
  4. Review package provenance, signatures, release artifacts, and publisher controls before upgrades.
  5. Separate installation from execution so an update cannot be downloaded automatically whenever the MCP server starts.
  6. Run the MCP server in a restricted environment with minimal filesystem and network access.
  7. Provide only a dedicated, low-value wallet with narrowly limited approvals. Do not expose a general-purpose wallet key.
  8. Establish an explicit upgrade process requiring security review before changing the pinned version.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:62
Finding

Wallet Private Key Is Stored in Plaintext MCP Configuration Files

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:62-73, SKILL.md:79-90, SKILL.md:97-106, SKILL.md:113-122, SKILL.md:127-130, SKILL.md:135-146, SKILL.md:158-166, and SKILL.md:169-180
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code

The Skill instructs users to place the wallet private key directly in MCP configuration files. A representative configuration is:

json
{
  "mcpServers": {
    "swarmwage": {
      "command": "npx",
      "args": ["-y", "@swarmwage/mcp"],
      "env": { "SWARMWAGE_PRIVATE_KEY": "0x..." }
    }
  }
}

Cursor is explicitly configured through either a project-local or global file:

text
Edit `.cursor/mcp.json` (project) or `~/.cursor/mcp.json` (global):
json
{
  "mcpServers": {
    "swarmwage": {
      "command": "npx",
      "args": ["-y", "@swarmwage/mcp"],
      "env": { "SWARMWAGE_PRIVATE_KEY": "0x..." }
    }
  }
}

The OpenClaw example places the secret directly in a command-line argument:

bash
openclaw mcp set swarmwage '{"command":"npx","args":["-y","@swarmwage/mcp"],"env":{"SWARMWAGE_PRIVATE_KEY":"0x..."}}'

The Codex configuration similarly stores it in TOML:

toml
[mcp_servers.swarmwage]
command = "npx"
args = ["-y", "@swarmwage/mcp"]
env = { SWARMWAGE_PRIVATE_KEY = "0x..." }

Technical Analysis

SWARMWAGE_PRIVATE_KEY is documented as a 32-byte private key controlling a buyer wallet on Base. Storing this value directly in JSON or TOML creates a persistent plaintext copy of a high-impact credential.

Project-local files such as .cursor/mcp.json and .opencode/opencode.json are particularly risky because they can be committed to source control, included in archives, copied into shared workspaces, or exposed through project synchronization. Global configuration files may be collected by backups, endpoint-management systems, ...[truncated 2426 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not embed the raw private key in project or editor configuration files.
  2. Store the key in an operating-system keychain, hardware-backed signer, or dedicated secret manager and retrieve it only at runtime.
  3. Where direct secret-manager integration is unavailable, inject the environment variable from a protected external environment rather than recording its value in MCP configuration.
  4. Avoid putting secrets in command-line arguments. Use a protected input mechanism that does not enter shell history or process argument listings.
  5. Add .cursor/mcp.json, .opencode/opencode.json, and any other secret-bearing local configuration to .gitignore, while recognizing that ignore rules are supplementary and not a substitute for secret management.
  6. Restrict configuration permissions to the owning user and exclude secret-bearing files from backups, synchronization, logs, and support bundles.
  7. Use a dedicated wallet containing only the minimum necessary funds. Avoid reusing a personal or treasury wallet.
  8. Apply narrowly scoped and revocable spending limits where the protocol supports them, and require explicit user approval before paid hires.
  9. Add secret-scanning controls to pre-commit hooks and CI to detect 32-byte hexadecimal private keys.
  10. Document an incident-response procedure: immediately stop the MCP server, transfer assets to a new wallet, revoke approvals, rotate the key, and purge exposed repository history or backups if disclosure occurs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

codex mcp add swarmwage --transport stdio --command "npx -y @swarmwage/mcp"

text

…and then add the env in `~/.codex/config.toml`:

```toml
[mcp_servers.swarmwage]

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The skill instructs users to launch an MCP server via npx -y @swarmwage/mcp without pinning a specific version or integrity hash. That allows silent installation of whatever package version is current at execution time, so a compromised upstream package, malicious publish, or breaking update could immediately run arbitrary code in the user's environment and access configured secrets such as the wallet private key.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

This installation example again uses npx -y @swarmwage/mcp without version pinning, creating a supply-chain risk at the point the MCP server is fetched and executed. In this skill, that risk is amplified because the server is configured with SWARMWAGE_PRIVATE_KEY, so a malicious or tampered package could exfiltrate the private key or misuse wallet authority.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill tells users to place a raw blockchain private key into MCP configuration and environment blocks but does not prominently warn about the severe consequences of exposure, reuse, logging, sync, or plaintext storage in config files. Since this key directly controls a funded wallet, accidental disclosure or host compromise can lead to irreversible asset loss and unauthorized payments.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The Codex CLI example invokes npx -y @swarmwage/mcp without pinning, so the MCP server executed by the agent host is whatever latest package is published. Because this server will run locally with access to environment variables and potentially agent context, an upstream compromise could lead to code execution, secret theft, or unauthorized transaction initiation.

Content

No source excerpt is available for this finding.