Archon Vault

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:19 AM UTC
• Version: 0.1.0

Overview

The skill does what it says, but it handles wallet recovery secrets and broad backups with unsafe scripting practices that deserve careful review before installation.

Review and harden this before using it with real identities or backups. Pin or vendor `@didcid/keymaster`, avoid putting mnemonics on the command line, create private temporary directories with automatic cleanup, fail closed on backup exclusions, validate ZIP contents before extraction, and only run it in an account/environment scoped to the exact vault and files you intend to protect.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T08 · Insecure Dependencies

Error

• Location: scripts/backup/backup-to-vault.sh:43
• Finding: Unpinned npm Package Is Downloaded and Executed During Sensitive Operations<![CDATA[ ## Vulnerability Details **File Location**: `scripts/backup/backup-to-vault.sh:43,58,65,72`; `scripts/backup/disaster-recovery.sh:59,65,71,75,93,99-123`; `scripts/backup/restore-from-vault.sh:23-87`; `scripts/backup/verify-backup.sh:44`; all scripts under `scripts/vaults/` **Vulnerability Type**: Unpinned runtime dependency and supply-chain exposure **Risk Level**: High ### Vulnerable Code ```bash npx @didcid/keymaster add-vault-item backup /tmp/workspace.zip ``` Other security-sensitive invocations use the same unpinned package, including: ```bash npx @didcid/keymaster import-wallet "$MNEMONIC" > /dev/null npx @didcid/keymaster recover-wallet-did > /dev/null npx @didcid/keymaster get-vault-item backup workspace.zip "$RESTORE_DIR/workspace.zip" ``` ### Technical Analysis The scripts execute `@didcid/keymaster` through `npx` without specifying an exact package version. The project also contains no reviewed lockfile that constrains the package and its transitive dependencies. Depending on the local npm state, `npx` may download and execute the package version currently resolved by the configured registry. Consequently, the code that runs during backup, restoration, wallet reconstruction, and vault management can change after this project has been audited. These invocations occur while highly sensitive values and resources are available, including: - `ARCHON_PASSPHRASE` - `ARCHON_WALLET_PATH` - The disaster-recovery mnemonic - Workspace and OpenClaw configuration archives - Decrypted vault items - Vault membership and access-control operations A compromised package release, registry account, registry configuration, or dependency could therefore execute arbitrary code with the invoking user's permissions. ### Attack Path 1. An attacker compromises the `@didcid/keymaster` package, one of its dependencies, its publisher account, or the npm registry resolution path. 2. The attacker publishes or causes resolution to a modified package version. 3. ...[truncated 934 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@didcid/keymaster` to a reviewed exact version rather than using an unconstrained package name. 2. Add and commit a lockfile that fixes all transitive dependency versions and integrity hashes. 3. Install dependencies during a controlled deployment phase rather than during sensitive operations. 4. Invoke the locally installed package with a command that forbids network installation, such as: ```bash npx --no-install keymaster ... ``` 5. Configure npm to use a trusted registry and enforce lockfile integrity in CI. 6. Review package provenance and signatures where available. 7. Run the dependency under a restricted account or sandbox with access only to the specific files required for the requested operation. 8. Avoid exposing secrets to the package through command-line arguments. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup/backup-to-vault.sh:39
• Finding: Predictable Plaintext Backup Archives Are Written to Shared Temporary Storage<![CDATA[ ## Vulnerability Details **File Location**: `scripts/backup/backup-to-vault.sh:39-58` **Vulnerability Type**: Unsafe temporary-file handling and plaintext sensitive-data exposure **Risk Level**: High ### Vulnerable Code ```bash cd /tmp rm -f workspace.zip zip -q -r workspace.zip "$WORKSPACE_DIR" -x@"$WORKSPACE_DIR/.backup-ignore" 2>/dev/null || \ zip -q -r workspace.zip "$WORKSPACE_DIR" npx @didcid/keymaster add-vault-item backup /tmp/workspace.zip echo "✓ workspace.zip ($(du -h workspace.zip | cut -f1))" # Backup config (excludes sessions, cache, logs per patterns) echo "Backing up config..." cd ~/.openclaw rm -f /tmp/config.zip zip -q -r /tmp/config.zip . \ -x 'agents/*/sessions/*' \ -x 'agents/*/cache/*' \ -x 'logs/*' \ -x '*.log' \ -x 'browser/*' \ -x 'media/*' \ -x 'canvas/*' npx @didcid/keymaster add-vault-item backup /tmp/config.zip ``` ### Technical Analysis The script creates archives using fixed paths, `/tmp/workspace.zip` and `/tmp/config.zip`. It does not create a private temporary directory, set a restrictive `umask`, perform exclusive file creation, reject symbolic links, or remove the archives automatically after upload. On a multi-user system, predictable names in a shared temporary directory create opportunities for local races and data disclosure. A local attacker may attempt to pre-create or replace one of the paths, monitor it while the archive is being generated, or read the resulting archive when permissions derived from the user's current `umask` allow access. The workspace archive also has an unsafe fail-open fallback. If the exclusion-aware `zip` command fails for any reason, the second command archives the entire workspace without applying `.backup-ignore`. This can silently include files that the user explicitly intended to exclude. Both archives remain on disk after upload, extending the exposure period for potentially sensitive configuration, credentials, conversation state, and workspace files. ...[truncated 1200 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set restrictive permissions before creating any sensitive temporary data: ```bash umask 077 ``` 2. Create a private temporary directory securely: ```bash TMP_DIR="$(mktemp -d)" trap 'rm -rf -- "$TMP_DIR"' EXIT HUP INT TERM ``` 3. Store all archives inside that private directory and use quoted paths. 4. Check that generated paths are regular files and not symbolic links before use. 5. Remove plaintext archives immediately after successful upload; retain automatic cleanup for failures and interruptions. 6. Do not retry without exclusions. If `.backup-ignore` is missing or malformed, fail closed and notify the user. 7. Consider streaming the archive directly into the encryption/upload process if supported, avoiding a persistent plaintext copy. 8. Explicitly set archive file permissions to owner read/write only. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup/disaster-recovery.sh:12
• Finding: Wallet Recovery Mnemonic Is Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/backup/disaster-recovery.sh:12-20,47-59` **Vulnerability Type**: Sensitive recovery secret exposed in shell history and process arguments **Risk Level**: Critical ### Vulnerable Code ```bash if [ $# -lt 1 ]; then echo "Usage: $0 \"word1 word2 ... word12\" [target-dir]" echo "" echo "Performs complete disaster recovery from your 12-word mnemonic." echo "Requires ARCHON_PASSPHRASE and ARCHON_GATEKEEPER_URL to be set." exit 1 fi MNEMONIC="$1" TARGET_DIR="${2:-.}" ``` The mnemonic is subsequently forwarded to another process: ```bash # Step 1: Import wallet from mnemonic echo "Step 1/3: Creating wallet from mnemonic..." if [ -f "$ARCHON_WALLET_PATH" ]; then echo "Warning: Wallet already exists at $ARCHON_WALLET_PATH" read -p "Overwrite? (y/N) " -n 1 -r echo if [[ ! $REPLY =~ ^[Yy]$ ]]; then echo "Aborted." exit 1 fi rm "$ARCHON_WALLET_PATH" fi npx @didcid/keymaster import-wallet "$MNEMONIC" > /dev/null ``` ### Technical Analysis The script requires the 12-word wallet mnemonic as its first positional command-line argument. This creates two separate exposure points: 1. The user's interactive shell may retain the complete invocation in command history. 2. The mnemonic is passed to the `npx` child process as an argument and may be visible through operating-system process inspection while the command is running. Redirecting standard output to `/dev/null` does not protect process arguments. The mnemonic is the root recovery secret described by the project as the master key. Possession of it may allow an attacker to reconstruct the wallet and recover aliases and vault access. The shell variable remains populated for the rest of the script unless explicitly cleared. ### Attack Path 1. The user follows the documented usage and runs the script with the mnemonic on the command line. 2. The shell records the complete command in history, or a lo ...[truncated 1012 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not accept the mnemonic as a command-line argument. 2. Read it from a protected terminal prompt with echo disabled: ```bash read -r -s -p "Enter recovery mnemonic: " MNEMONIC echo ``` 3. Prefer passing the secret to the wallet importer over standard input or a dedicated inherited file descriptor. The downstream tool must support a mode that avoids command-line arguments. 4. If the downstream tool only accepts arguments, modify or wrap it to provide a secure standard-input interface before using it for wallet recovery. 5. Clear the variable as soon as import completes: ```bash unset MNEMONIC ``` 6. Disable core dumps for the recovery process and use a restricted execution environment. 7. Update all documentation and usage examples so they never instruct users to place a mnemonic directly in a shell command. 8. Advise affected users to review shell history and rotate or migrate the wallet identity if the mnemonic may already have been exposed. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup/restore-from-vault.sh:58
• Finding: Vault Archives Are Extracted Without Path, Link, or Resource Validation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/backup/restore-from-vault.sh:58-77`; `scripts/backup/disaster-recovery.sh:98-114` **Vulnerability Type**: Unsafe archive extraction **Risk Level**: High ### Vulnerable Code ```bash # Restore workspace if npx @didcid/keymaster list-vault-items backup 2>/dev/null | jq -e '.["workspace.zip"]' >/dev/null 2>&1; then echo "Downloading workspace.zip..." npx @didcid/keymaster get-vault-item backup workspace.zip "$RESTORE_DIR/workspace.zip" echo "Extracting workspace..." unzip -q "$RESTORE_DIR/workspace.zip" -d "$RESTORE_DIR/workspace" rm "$RESTORE_DIR/workspace.zip" echo "✅ Workspace restored to $RESTORE_DIR/workspace/" else echo "⚠️ workspace.zip not found in vault" fi # Restore config if npx @didcid/keymaster list-vault-items backup 2>/dev/null | jq -e '.["config.zip"]' >/dev/null 2>&1; then echo "Downloading config.zip..." npx @didcid/keymaster get-vault-item backup config.zip "$RESTORE_DIR/config.zip" echo "Extracting config..." unzip -q "$RESTORE_DIR/config.zip" -d "$RESTORE_DIR/openclaw" rm "$RESTORE_DIR/config.zip" echo "✅ Config restored to $RESTORE_DIR/openclaw/" fi ``` Equivalent unvalidated extraction occurs in `scripts/backup/disaster-recovery.sh`: ```bash npx @didcid/keymaster get-vault-item backup workspace.zip "$RESTORE_DIR/workspace.zip" unzip -q "$RESTORE_DIR/workspace.zip" -d "$RESTORE_DIR/workspace" ``` ### Technical Analysis The scripts download ZIP archives from a vault and immediately extract them with `unzip`. They do not validate: - Absolute archive paths - Parent-directory components such as `../` - Symbolic links or link targets - Special files - Duplicate or conflicting entries - Total expanded size - Compression ratio - File count - A trusted signature or manifest This is an archive-extraction trust-boundary issue. Although the intended backup is produced by the same user, the project supports multi-party vault members ...[truncated 1721 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. List and validate all archive entries before extraction. 2. Reject entries that: - Are absolute paths - Contain `..` path components - Resolve outside the intended destination - Represent symbolic links, hard links, devices, sockets, or other special files 3. Enforce maximum values for expanded size, compression ratio, individual file size, and file count. 4. Extract into a newly created private directory under `umask 077`. 5. Use a hardened archive library or extraction utility that supports explicit traversal and link protections. 6. Verify archive hashes against a signed, trusted manifest before extraction. 7. Run extraction in a sandbox with no network access and write access limited to the temporary restore directory. 8. Inspect restored configuration before instructing the user to move it into active OpenClaw directories. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/backup/verify-backup.sh:29
• Finding: Decrypted Backup Verification Files Persist in Predictable Temporary Storage<![CDATA[ ## Vulnerability Details **File Location**: `scripts/backup/verify-backup.sh:29-32,43-58,90-106` **Vulnerability Type**: Insecure retention of decrypted sensitive data **Risk Level**: Medium ### Vulnerable Code ```bash # Create temp directory for test downloads VERIFY_DIR="/tmp/backup-verify-$$" mkdir -p "$VERIFY_DIR" cd "$VERIFY_DIR" ``` The verification function downloads decrypted files into that directory: ```bash # Try to retrieve from vault if ! npx @didcid/keymaster get-vault-item backup "$item_name" "$VERIFY_DIR/$item_name" 2>&1; then echo " ✗ FAILED: Could not retrieve $item_name from vault" ERRORS=$((ERRORS + 1)) return 1 fi # Check file exists and has size if [ ! -f "$VERIFY_DIR/$item_name" ]; then echo " ✗ FAILED: $item_name not found after retrieval" ERRORS=$((ERRORS + 1)) return 1 fi local size=$(du -h "$VERIFY_DIR/$item_name" | cut -f1) echo " Retrieved: $size" ``` The files are retained after completion: ```bash if [ $ERRORS -eq 0 ]; then echo "✓ All backups verified successfully" echo "" echo "Your backups are recoverable. You can restore from:" echo " - workspace.zip ($VERIFY_DIR/workspace.zip)" echo " - config.zip ($VERIFY_DIR/config.zip)" echo " - hexmem.db ($VERIFY_DIR/hexmem.db)" else echo "✗ $ERRORS backup(s) failed verification" echo "" echo "ACTION REQUIRED: Re-run backup-to-vault.sh to fix failed backups" fi echo "" echo "Cleanup: rm -rf $VERIFY_DIR" ``` ### Technical Analysis The verification script writes complete decrypted copies of the backup items into a directory with a predictable process-ID-based name. It uses ordinary `mkdir`, inherits the current `umask`, and does not register an automatic cleanup trap. Instead of deleting the files after integrity testing, the script merely prints a cleanup command. The workspace archive, configuration archive, and memory database can therefore remain in `/tmp` indefinitely after successful verification, ...[truncated 1311 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set `umask 077` before creating verification files. 2. Replace the predictable directory with `mktemp -d`: ```bash VERIFY_DIR="$(mktemp -d)" ``` 3. Register cleanup immediately after creation: ```bash trap 'rm -rf -- "$VERIFY_DIR"' EXIT HUP INT TERM ``` 4. Delete each decrypted item immediately after its integrity check if it is no longer required. 5. Provide an explicit opt-in flag if users need to retain verified copies; secure deletion should remain the default. 6. Ensure retained files are owner-readable and owner-writable only. 7. Where supported, verify downloaded content through streaming so a complete decrypted copy is not left on disk. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (56)

Ae1

High

• Category: analysis-evasion

Content

./scripts/backup/verify-backup.sh <backup-did>

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Backup config (excludes sessions, cache, logs per patterns)
echo "Backing up config..."
cd ~/.openclaw
rm -f /tmp/config.zip
zip -q -r /tmp/config.zip . \
  -x 'agents/*/sessions/*' \
  -x 'agents/*/cache/*' \

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

npx @didcid/keymaster get-vault-item backup workspace.zip "$RESTORE_DIR/workspace.zip"
    echo "Extracting workspace..."
    unzip -q "$RESTORE_DIR/workspace.zip" -d "$RESTORE_DIR/workspace"
    rm "$RESTORE_DIR/workspace.zip"
    echo "✅ Workspace restored to $RESTORE_DIR/workspace/"
else
    echo "⚠️  workspace.zip not found in vault"

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

npx @didcid/keymaster get-vault-item backup workspace.zip "$RESTORE_DIR/workspace.zip"
    echo "Extracting workspace..."
    unzip -q "$RESTORE_DIR/workspace.zip" -d "$RESTORE_DIR/workspace"
    rm "$RESTORE_DIR/workspace.zip"
    echo "✅ Workspace restored to $RESTORE_DIR/workspace/"
else
    echo "⚠️  workspace.zip not found in vault"

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

npx @didcid/keymaster get-vault-item backup config.zip "$RESTORE_DIR/config.zip"
    echo "Extracting config..."
    unzip -q "$RESTORE_DIR/config.zip" -d "$RESTORE_DIR/openclaw"
    rm "$RESTORE_DIR/config.zip"
    echo "✅ Config restored to $RESTORE_DIR/openclaw/"
else
    echo "⚠️  config.zip not found in vault"

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

npx @didcid/keymaster get-vault-item backup config.zip "$RESTORE_DIR/config.zip"
    echo "Extracting config..."
    unzip -q "$RESTORE_DIR/config.zip" -d "$RESTORE_DIR/openclaw"
    rm "$RESTORE_DIR/config.zip"
    echo "✅ Config restored to $RESTORE_DIR/openclaw/"
else
    echo "⚠️  config.zip not found in vault"

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Session Persistence

Medium

• Category: Rogue Agent

Content

## Features

- **Vault Management** — Create vaults, manage items and members
- **Multi-Party Access** — Share vaults with other DIDs
- **Encrypted Backups** — Backup workspace/config to your vault
- **Disaster Recovery** — Restore everything from your 12-word mnemonic

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The README instructs users to run `npx @didcid/keymaster` without pinning a specific version. This allows execution of whatever package version is current at runtime, creating a supply-chain risk if a malicious or compromised update is published. In a security-sensitive skill involving identity, vault access, and recovery operations, that risk is more dangerous because the invoked tool may handle credentials or secrets.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README advertises backup and restore operations but does not warn that restore may overwrite local files or that backup/restore may transfer large amounts of sensitive data. Users may invoke these commands without understanding destructive effects, causing data loss or unintended exposure of workspace/config contents. Given this skill explicitly handles disaster recovery and bulk backups, the missing warnings are more risky than in a non-destructive utility.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill exposes shell-based operational capability through documented script entrypoints but does not declare any tool scope, permissions, or allowed-tools boundary. That omission weakens least-privilege controls and makes it easier for an agent or user to invoke powerful filesystem and backup/restore operations without an explicit policy guardrail.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Prerequisites

- Archon identity configured (`~/.archon.env` with wallet path and passphrase)
- Run `archon-keymaster` first to create your DID if you don't have one

## Backup Operations

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: Invoking `npx @didcid/keymaster` without an exact pinned version allows execution of whatever package version resolves at runtime. In a backup script handling encrypted vault operations and passphrase-protected wallet access, a compromised or malicious upstream package could exfiltrate sensitive backups, wallet material, or vault contents.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: This unpinned `npx` invocation runs during archival of `~/.openclaw` configuration, which may contain sensitive agent configuration and operational metadata. Because the script also exports `ARCHON_PASSPHRASE`, a malicious package version could access environment secrets and the files being uploaded to the vault.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The same supply-chain risk applies here for the optional hexmem database backup. Because this command processes a local database file that may contain memory/state data, compromise of the runtime-resolved package could disclose highly sensitive application data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: Even though this invocation only lists vault items, it still executes unpinned code from the package registry and may run with access to the same environment and credentials. The impact is somewhat lower than the upload operations, but a malicious package could still harvest secrets or manipulate output.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The script invokes `npx @didcid/keymaster` without pinning an exact package version, so `npx` may fetch and execute whatever version is currently published. In a disaster-recovery workflow handling a mnemonic and wallet restoration, a compromised or malicious upstream package could exfiltrate secrets or alter recovered data, making this substantially more dangerous than ordinary unpinned tooling.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The recovery flow sends mnemonic-derived wallet recovery operations to a remote gatekeeper/seed-bank service but does not explicitly warn the operator that sensitive recovery metadata and wallet state will traverse the network. In a disaster-recovery context, users may reasonably expect a local-only process, so the missing disclosure increases the chance of unsafe use on untrusted networks or with untrusted endpoints.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: This unpinned `npx` execution occurs during wallet DID recovery immediately after mnemonic import, when the environment contains highly sensitive recovery material. If the fetched package is substituted upstream, the attacker gains an ideal opportunity to steal wallet-derived secrets or manipulate identity recovery.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: Listing recovered identities via an unpinned `npx` package still requires executing remote package code that may differ over time. Although this step is less sensitive than mnemonic import, it still runs in a wallet recovery context and could expose local wallet metadata or tamper with output.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: Checking for the `backup` alias executes an unpinned package in a sensitive recovery flow. A malicious or compromised package could falsify alias checks, misdirect restoration, or gather wallet metadata from the environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: Listing vault items through unpinned `npx` introduces a supply-chain execution point before restore decisions are made. In this context, tampered package code could misreport available backup contents or trigger unauthorized network/data access.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The script again relies on an unpinned `npx` package to decide whether `workspace.zip` exists. Because restore logic is driven by this output, malicious package changes could influence control flow or hide/forge backup state.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: Downloading a vault item with an unpinned runtime-fetched package is especially risky because the package directly handles restored content and likely authenticated access to the vault. A compromised package could exfiltrate vault contents, credentials, or replace downloaded artifacts with attacker-controlled data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: This unpinned package invocation determines whether `config.zip` exists in the backup vault. Even read-oriented operations are dangerous here because the code path runs with access to wallet state and network endpoints during recovery.

Static analysis

No suspicious patterns detected.