Agentsafe Audit

• Outcome: Review
• Latest audit: Oct 24, 2026 · 12:34 PM UTC
• Version: 0.1.0

Overview

This paid audit service needs review because its pricing disclosures conflict with its code, and deployment errors can expose secrets.

Confirm the actual price, network, and recipient before authorizing payment; do not rely on the fixed 3 USDC claim. Payment can settle before the report succeeds. Self-hosters should fix public error disclosure, replay handling, settlement-based access, and retention before accepting live payments. Treat reports as preliminary screening.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/agentsafe/payment/x402_adapter.py

Finding

Concurrent requests can reuse one payment authorization, and failed settlement does not revoke access

Content

View full analysis

Impact

Overlapping accepted requests can start multiple billable workers against one transfer authorization. Subsequent settlement rejection does not undo those jobs or their paid flags. The REST failure path additionally returns the task ID with HTTP 202, allowing report polling despite unsuccessful settlement.

T09 · Insecure Skill Coding Practices

Warning

• Location: api/index.py

Finding

Public startup-error responses can disclose configuration secrets

Content

View full analysis

Impact

Credentials included in validation diagnostics can be disclosed to remote visitors during a misconfigured deployment. The failure state is cached and served on subsequent requests.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (137)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .env.example (reported line 2)May include surrounding context.

text

# agentSAFE MCP - environment configuration
# Copy to .env and fill in real values. NEVER commit .env or real secrets.

# --- Ethereum Mainnet RPC (Infura or any JSON-RPC 2.0 endpoint) ---
INFURA_ETH_ENDPOINT=

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .env.example (reported line 2)May include surrounding context.

text

# agentSAFE MCP - environment configuration
# Copy to .env and fill in real values. NEVER commit .env or real secrets.

# --- Ethereum Mainnet RPC (Infura or any JSON-RPC 2.0 endpoint) ---
INFURA_ETH_ENDPOINT=

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · agentsafe-deploy.zip!/.env.example (reported line 2)May include surrounding context.

text

# agentSAFE MCP - environment configuration
# Copy to .env and fill in real values. NEVER commit .env or real secrets.

# --- Ethereum Mainnet RPC (Infura or any JSON-RPC 2.0 endpoint) ---
INFURA_ETH_ENDPOINT=

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · agentsafe-deploy.zip!/.env.example (reported line 2)May include surrounding context.

text

# agentSAFE MCP - environment configuration
# Copy to .env and fill in real values. NEVER commit .env or real secrets.

# --- Ethereum Mainnet RPC (Infura or any JSON-RPC 2.0 endpoint) ---
INFURA_ETH_ENDPOINT=

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · agentsafe-deploy.zip!/DEPLOYMENT.md (reported line 68)May include surrounding context.

bash

uv venv && source .venv/bin/activate
pip install . "x402[evm]==2.25.0"
export $(grep -v '^#' .env | xargs)   # or use your process manager's env file
fastmcp run agentsafe.server:create_app --host 0.0.0.0 --port 8000

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · agentsafe-deploy.zip!/scripts/run_audit.py (reported line 7)May include surrounding context.

python

Usage:
    python scripts/run_audit.py --address 0x... --task-id <id> --output report.json

Reads configuration from environment (.env not used on the worker; the
workflow injects secrets as env vars). Writes report.json on success and on
partial failure; exits 3 only on hard failure. Never prints secrets.
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · agentsafe-deploy.zip!/src/agentsafe/config.py (reported line 67)May include surrounding context.

python

class Settings(BaseSettings):
    """All runtime settings. Loaded from environment and optional .env file."""

    model_config = SettingsConfigDict(
        env_file=".env",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · agentsafe-deploy.zip!/tests/test_config.py (reported line 34)May include surrounding context.

python

"LLM_PROVIDERS_JSON": json.dumps([VALID_PROVIDER]),
    }
    base.update(overrides)
    # _env_file=None: tests must be hermetic - never read the operator's .env
    return Settings(_env_file=None, **base)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · .github/workflows/audit.yml (reported line 91)May include surrounding context.

yaml

ADERYN_VERSION="0.6.8"
          URL="https://github.com/Cyfrin/aderyn/releases/download/aderyn-v${ADERYN_VERSION}/aderyn-x86_64-unknown-linux-gnu.tar.xz"
          EXPECTED_SHA256="ffd6ca658962e211a3ac821c646f69c8e14bf1b1001cbfe091bcd4535a691e46"
          curl -fsSL --retry 3 -o /tmp/aderyn.tar.xz "${URL}"
          echo "${EXPECTED_SHA256}  /tmp/aderyn.tar.xz" | sha256sum -c -
          # Release tarball nests the binary one directory deep.
          mkdir -p /tmp/aderyn-x

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · agentsafe-deploy.zip!/.github/workflows/audit.yml (reported line 91)May include surrounding context.

yaml

ADERYN_VERSION="0.6.8"
          URL="https://github.com/Cyfrin/aderyn/releases/download/aderyn-v${ADERYN_VERSION}/aderyn-x86_64-unknown-linux-gnu.tar.xz"
          EXPECTED_SHA256="ffd6ca658962e211a3ac821c646f69c8e14bf1b1001cbfe091bcd4535a691e46"
          curl -fsSL --retry 3 -o /tmp/aderyn.tar.xz "${URL}"
          echo "${EXPECTED_SHA256}  /tmp/aderyn.tar.xz" | sha256sum -c -
          # Release tarball nests the binary one directory deep.
          mkdir -p /tmp/aderyn-x

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · .github/workflows/audit.yml (reported line 108)May include surrounding context.

yaml

HEIMDALL_VERSION="0.9.3"
          URL="https://github.com/Jon-Becker/heimdall-rs/releases/download/${HEIMDALL_VERSION}/heimdall-linux-amd64"
          EXPECTED_SHA256="8d58c97f56d584d5d0737d0d0895fc8c68b7b8b2b680f2a7842245789f0b4868"
          curl -fsSL --retry 3 -o /usr/local/bin/heimdall "${URL}"
          echo "${EXPECTED_SHA256}  /usr/local/bin/heimdall" | sha256sum -c -
          chmod +x /usr/local/bin/heimdall
          heimdall --version

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · agentsafe-deploy.zip!/.github/workflows/audit.yml (reported line 108)May include surrounding context.

yaml

HEIMDALL_VERSION="0.9.3"
          URL="https://github.com/Jon-Becker/heimdall-rs/releases/download/${HEIMDALL_VERSION}/heimdall-linux-amd64"
          EXPECTED_SHA256="8d58c97f56d584d5d0737d0d0895fc8c68b7b8b2b680f2a7842245789f0b4868"
          curl -fsSL --retry 3 -o /usr/local/bin/heimdall "${URL}"
          echo "${EXPECTED_SHA256}  /usr/local/bin/heimdall" | sha256sum -c -
          chmod +x /usr/local/bin/heimdall
          heimdall --version

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · DEPLOYMENT.md (reported line 68)May include surrounding context.

bash

uv venv && source .venv/bin/activate
pip install . "x402[evm]==2.25.0"
export $(grep -v '^#' .env | xargs)   # or use your process manager's env file
fastmcp run agentsafe.server:create_app --host 0.0.0.0 --port 8000

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · Dockerfile (reported line 39)May include surrounding context.

dockerfile

# Aderyn (pinned release, official checksum). The release tarball nests the
# binary one directory deep; --strip-components=1 puts it on PATH.
RUN set -eu \
    && curl -fsSL --retry 3 -o /tmp/aderyn.tar.xz \
        "https://github.com/Cyfrin/aderyn/releases/download/aderyn-v0.6.8/aderyn-x86_64-unknown-linux-gnu.tar.xz" \
    && echo "ffd6ca658962e211a3ac821c646f69c8e14bf1b1001cbfe091bcd4535a691e46  /tmp/aderyn.tar.xz" | sha256sum -c - \
    && mkdir -p /tmp/aderyn-x \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · Dockerfile (reported line 45)May include surrounding context.

dockerfile

&& mkdir -p /tmp/aderyn-x \
    && tar -xJf /tmp/aderyn.tar.xz -C /tmp/aderyn-x --strip-components=1 \
    && mv /tmp/aderyn-x/aderyn /usr/local/bin/aderyn \
    && rm -rf /tmp/aderyn.tar.xz /tmp/aderyn-x

# Heimdall (pinned release, computed checksum; re-verify when bumping).
RUN set -eu \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · Dockerfile (reported line 45)May include surrounding context.

dockerfile

&& mkdir -p /tmp/aderyn-x \
    && tar -xJf /tmp/aderyn.tar.xz -C /tmp/aderyn-x --strip-components=1 \
    && mv /tmp/aderyn-x/aderyn /usr/local/bin/aderyn \
    && rm -rf /tmp/aderyn.tar.xz /tmp/aderyn-x

# Heimdall (pinned release, computed checksum; re-verify when bumping).
RUN set -eu \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · Dockerfile (reported line 45)May include surrounding context.

dockerfile

&& mkdir -p /tmp/aderyn-x \
    && tar -xJf /tmp/aderyn.tar.xz -C /tmp/aderyn-x --strip-components=1 \
    && mv /tmp/aderyn-x/aderyn /usr/local/bin/aderyn \
    && rm -rf /tmp/aderyn.tar.xz /tmp/aderyn-x

# Heimdall (pinned release, computed checksum; re-verify when bumping).
RUN set -eu \

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · Dockerfile (reported line 45)May include surrounding context.

dockerfile

&& mkdir -p /tmp/aderyn-x \
    && tar -xJf /tmp/aderyn.tar.xz -C /tmp/aderyn-x --strip-components=1 \
    && mv /tmp/aderyn-x/aderyn /usr/local/bin/aderyn \
    && rm -rf /tmp/aderyn.tar.xz /tmp/aderyn-x

# Heimdall (pinned release, computed checksum; re-verify when bumping).
RUN set -eu \

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · Dockerfile (reported line 49)May include surrounding context.

dockerfile

# Heimdall (pinned release, computed checksum; re-verify when bumping).
RUN set -eu \
    && curl -fsSL --retry 3 -o /usr/local/bin/heimdall \
        "https://github.com/Jon-Becker/heimdall-rs/releases/download/0.9.3/heimdall-linux-amd64" \
    && echo "8d58c97f56d584d5d0737d0d0895fc8c68b7b8b2b680f2a7842245789f0b4868  /usr/local/bin/heimdall" | sha256sum -c - \
    && chmod +x /usr/local/bin/heimdall

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TERMS_OF_SERVICE.md (reported line 117)May include surrounding context.

md

circumstance. `TODO — OWNER INPUT REQUIRED: confirm with counsel that this
refund rule satisfies applicable mandatory consumer-protection law.`

## 9. Report access tokens and confidentiality

Audit reports are associated with an unguessable task identifier issued at
request time. Keep your task identifiers confidential: possession of a

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · agentsafe-deploy.zip!/Dockerfile (reported line 39)May include surrounding context.

dockerfile

# Aderyn (pinned release, official checksum). The release tarball nests the
# binary one directory deep; --strip-components=1 puts it on PATH.
RUN set -eu \
    && curl -fsSL --retry 3 -o /tmp/aderyn.tar.xz \
        "https://github.com/Cyfrin/aderyn/releases/download/aderyn-v0.6.8/aderyn-x86_64-unknown-linux-gnu.tar.xz" \
    && echo "ffd6ca658962e211a3ac821c646f69c8e14bf1b1001cbfe091bcd4535a691e46  /tmp/aderyn.tar.xz" | sha256sum -c - \
    && mkdir -p /tmp/aderyn-x \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · agentsafe-deploy.zip!/Dockerfile (reported line 45)May include surrounding context.

dockerfile

&& mkdir -p /tmp/aderyn-x \
    && tar -xJf /tmp/aderyn.tar.xz -C /tmp/aderyn-x --strip-components=1 \
    && mv /tmp/aderyn-x/aderyn /usr/local/bin/aderyn \
    && rm -rf /tmp/aderyn.tar.xz /tmp/aderyn-x

# Heimdall (pinned release, computed checksum; re-verify when bumping).
RUN set -eu \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · agentsafe-deploy.zip!/Dockerfile (reported line 45)May include surrounding context.

dockerfile

&& mkdir -p /tmp/aderyn-x \
    && tar -xJf /tmp/aderyn.tar.xz -C /tmp/aderyn-x --strip-components=1 \
    && mv /tmp/aderyn-x/aderyn /usr/local/bin/aderyn \
    && rm -rf /tmp/aderyn.tar.xz /tmp/aderyn-x

# Heimdall (pinned release, computed checksum; re-verify when bumping).
RUN set -eu \

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · agentsafe-deploy.zip!/Dockerfile (reported line 45)May include surrounding context.

dockerfile

&& mkdir -p /tmp/aderyn-x \
    && tar -xJf /tmp/aderyn.tar.xz -C /tmp/aderyn-x --strip-components=1 \
    && mv /tmp/aderyn-x/aderyn /usr/local/bin/aderyn \
    && rm -rf /tmp/aderyn.tar.xz /tmp/aderyn-x

# Heimdall (pinned release, computed checksum; re-verify when bumping).
RUN set -eu \

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · agentsafe-deploy.zip!/Dockerfile (reported line 49)May include surrounding context.

dockerfile

# Heimdall (pinned release, computed checksum; re-verify when bumping).
RUN set -eu \
    && curl -fsSL --retry 3 -o /usr/local/bin/heimdall \
        "https://github.com/Jon-Becker/heimdall-rs/releases/download/0.9.3/heimdall-linux-amd64" \
    && echo "8d58c97f56d584d5d0737d0d0895fc8c68b7b8b2b680f2a7842245789f0b4868  /usr/local/bin/heimdall" | sha256sum -c - \
    && chmod +x /usr/local/bin/heimdall

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_vercel_entry.py:105

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: .env.example.cloud:19