Security audit

Alkahest User

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for blockchain escrow work, but it asks users to handle wallet secrets and real asset transfers in ways that need careful review before use.

Review this skill carefully before installing. Use a hardware wallet or external signer where possible, avoid putting private keys or mnemonics in prompts, shell commands, source files, shell history, or long-lived environment variables, and test first with low-value testnet wallets. Before any transaction, independently verify the chain, contract address, token, amount, recipient or payee, arbiter, demand data, expiration, and approval scope. Prefer a pinned, locally installed, provenance-verified CLI rather than an unpinned global npm install.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:30
Finding: Unpinned Third-Party CLI Installed Globally
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:38
Finding: Wallet Private Keys and Mnemonics Accepted Through Command-Line Arguments
Content: View full analysis
]` | | Private key env | `ALKAHEST_PRIVATE_KEY=0x...` | | Mnemonic env | `ALKAHEST_MNEMONIC="word1 word2 ..."` | | Compat env | `PRIVATE_KEY=0x...` | ``` The private-key flag is then used throughout the documented workflows, including: ```bash # ERC20 escrow with auto-approve alkahest --private-key 0xKEY escrow create \ --erc20 \ --token 0xTOKEN_ADDRESS \ --amount 1000000000000000000 \ --arbiter 0xARBITER_ADDRESS \ --demand 0xENCODED_DEMAND \ --expiration 1735689600 \ --approve ``` ### Technical Analysis Command-line arguments are not an appropriate transport for wallet private keys or mnemonic phrases. Depending on the operating system and execution environment, arguments may be exposed through: - Shell history files - Process inspection facilities - Terminal session recording - CI/CD logs - Monitoring and endpoint-management agents - Agent transcripts and debugging output - Wrapper scripts and command telemetry The authentication table assigns the private-key and mnemonic flags higher priority than Ledger or environment-based methods, and most transaction examples reinforce use of the private-key flag. This creates a realistic risk that users will substitute production secrets directly into commands. Environment variables are also not ideal for long-lived wallet secrets because child processes and diagnostic tooling may expose them. They are preferable to command-line arguments only when populated by a protected secret-management mechanism and ...[truncated 1143 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/typescript-sdk.md:12
Finding: SDK Example Encourages Embedding a Private Key in Source Code
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs users to pass private keys and mnemonics on the command line and via environment variables without any safety warning or preference for safer signing methods. This is dangerous because CLI arguments can be exposed via shell history, process listings, logs, and agent telemetry, leading to wallet compromise and theft of on-chain assets.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill walks users through escrow creation and related asset-moving transactions, including token approvals and native-token transfers, without any explicit warning that these actions can move real funds irreversibly. In an agent-driven context, missing verification steps for chain, token, recipient/arbiter addresses, expiration, and amounts materially increases the risk of accidental loss or sending value to the wrong contract or network.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
Use the --arbiter address and the encoded --demand hex from step 1:

bash
# ERC20 escrow with auto-approve alkahest --private-key 0xKEY escrow create \ --erc20 \ --token 0xTOKEN_ADDRESS \

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.
Use the --arbiter address and the encoded --demand hex from step 1:

bash
# ERC20 escrow with auto-approve alkahest --private-key 0xKEY escrow create \ --erc20 \ --token 0xTOKEN_ADDRESS \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This reference documents escrow flows that lock assets and later release them based on arbiter validation, but it does not explicitly warn users that interacting with these contracts can result in real asset loss if they choose the wrong contract, arbiter, demand bytes, or network. In a CLI skill intended for buyers, sellers, and oracles, omission of financial-risk warnings increases the chance of unsafe execution of irreversible on-chain actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The payment section states that payments transfer assets immediately upon attestation creation, but it still lacks a prominent end-user warning that these are immediate, non-escrowed transfers with no hold period. In the context of an operational skill for interacting with contracts via CLI, users could misinterpret payment obligations as safer escrow-like actions and send assets irreversibly to unintended payees.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The reference instructs users to instantiate a wallet client with a raw private key string and later documents auto-arbitration behavior, but it does not include clear safety guidance about secret handling or the risks of automated on-chain decisions. In a blockchain escrow context, users may copy this pattern into production, hardcode secrets, or deploy unattended arbitration logic that can irreversibly move value based on flawed logic or compromised infrastructure.
Content: No source excerpt is available for this finding.