Claude

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:50 AM UTC
• Version: 1.0.1

Overview

This skill is openly about renting and controlling servers, but it gives an agent payment credentials, root server control, and destroy authority with weak scoping guidance.

Review this before installing. Use a dedicated low-balance wallet, pin and verify the MCP package version, avoid exposing raw private keys where possible, store the AgentMetal API key as a secret, and require explicit approval before spending money, opening firewall ports, running root commands, renewing leases, or destroying servers.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:18
• Finding: Unpinned Third-Party MCP Package Executes with Access to Wallet Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 18–35 **Vulnerability Type**: Unpinned third-party dependency with access to sensitive credentials **Risk Level**: High ### Vulnerable Code ```markdown The recommended integration is the **AgentMetal MCP server** (`@agentmetal/mcp`, v0.3.0, **13 tools**), which exposes the API as tools and handles the x402 payment signing for you. ## Add the MCP server `@agentmetal/mcp` is a stdio MCP server (binary: `agentmetal-mcp`). Add it to your MCP client config: ```jsonc { "mcpServers": { "agentmetal": { "command": "node", "args": ["packages/mcp/src/index.ts"], // or: "npx", ["-y", "@agentmetal/mcp"] "env": { "WALLET_PRIVATE_KEY": "0x…", // EVM key with USDC on Base "AGENTMETAL_MAX_USDC": "50", // per-request spend cap "AGENTMETAL_API_KEY": "am_live_…" // optional, unlocks reboot/diagnostics/exec/destroy } } } } ``` ``` ### Technical Analysis The documented alternative command, `npx -y @agentmetal/mcp`, downloads and executes the package version currently selected by the package registry. It does not pin the stated `v0.3.0` release or require verification of a package digest or integrity value. The same process is explicitly given `WALLET_PRIVATE_KEY`, an EVM private key capable of authorizing USDC transactions, as well as an optional AgentMetal account API key. Consequently, the security of these credentials depends on the integrity of every package version and transitive dependency resolved when the command runs. If the package maintainer account, registry entry, release pipeline, or a transitive dependency is compromised, a malicious release can read and transmit the environment variables immediately upon execution. The documented `AGENTMETAL_MAX_USDC` setting is only described as a per-request payment cap. It does not constrain an attacker who obtains the raw private key and uses it through a separat ...[truncated 1783 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the unversioned command with an exact, reviewed version: ```bash npx -y @agentmetal/mcp@0.3.0 ``` Do not use version ranges or registry tags such as `latest`. 2. Prefer a committed lockfile and a reproducible installation process. Verify package integrity through registry integrity hashes, signed releases, provenance attestations, or an internally reviewed artifact mirror. 3. Do not provide the raw wallet private key directly to the MCP process. Use an isolated signer, hardware-backed key, restricted signing service, or narrowly scoped wallet interface that validates destination, token, chain, amount, and cumulative spending limits. 4. Use a dedicated low-value wallet containing only the funds required for the immediate operation. Rotate the wallet if dependency compromise is suspected. 5. Enforce cumulative and time-based spending limits in addition to the documented per-request cap. Require explicit confirmation for unusually large, repeated, or unexpected transactions. 6. Store the AgentMetal API key in a secret manager and issue a narrowly scoped credential if the service supports granular permissions. Avoid exposing destructive and root-execution capabilities to a process that does not require them. 7. Run the MCP server in a sandbox with restricted filesystem, network, process, and environment access. Permit outbound connections only to expected service endpoints where practical. 8. Document a dependency review and update procedure so that newer package versions are tested and approved before the pinned version is changed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly advertises provisioning infrastructure, executing arbitrary commands as root, and destroying servers, but it does not pair these capabilities with strong safety guidance, confirmation requirements, or warnings about irreversible effects and cost exposure. In an agent context, this increases the chance of accidental destructive actions, unsafe deployment, service disruption, or financially impactful misuse if the model acts on ambiguous user prompts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that a managed SSH private key is returned once, but it does not warn that this is a highly sensitive credential that grants administrative access to a live server. In an agent workflow, exposing or mishandling that key could enable unauthorized root access, persistence, data theft, or takeover of hosted services.

External Transmission

Medium

• Category: Data Exfiltration

Content

fleet management: `claim_account` → `verify_claim` (email OTP → `am_live_…` key).
- No wallet configured? The paid tools fail with a clear message; catalog/status/claim still work.
- Prefer raw HTTP? Everything is documented for agents at
  <https://api.agentmetal.dev/llms.txt>; each error envelope's `docs` field links there.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.