Fulfill Git Escrow

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:05 PM UTC
• Version: 1.0.0

Overview

The skill fits its escrow-submission purpose, but it needs review because it handles wallet signing credentials and suggests unsafe package and private-key setup patterns.

Install only if you are comfortable letting the agent run git-escrows commands that may use a wallet private key and submit blockchain escrow actions. Use a dedicated low-value wallet, avoid pasting private keys into command lines or chat, prefer a pinned and preinstalled git-escrows version, and confirm any fulfillment or collection action before it is run.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:36
• Finding: Unpinned Remote Package Execution Through CLI Fallback<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 36 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: High ### Vulnerable Code ```markdown Run `git-escrows --help` to verify the CLI is installed. If it fails, try `npx git-escrows --help` or `bunx git-escrows --help`. Use whichever works for all subsequent commands. If none work, tell the user to install with `npm i -g git-escrows`. ``` ### Technical Analysis The fallback directs the agent to execute `git-escrows` through `npx` or `bunx` without specifying an approved package version, integrity hash, or trusted artifact source. If the package is not already installed locally, these tools may retrieve and execute package code from a remote registry. Consequently, the code executed during a Skill run can differ from the code reviewed during the audit. A compromised package release, package ownership takeover, registry compromise, or malicious dependency update could introduce arbitrary executable behavior. The package would run with the permissions of the agent process and could potentially access the working directory, environment variables, Git credentials, and the configured `PRIVATE_KEY`. This is classified as `T08: Insecure Dependencies` because the unsafe execution path relies on an unpinned third-party dependency obtained from a mutable package source. ### Attack Path 1. An attacker compromises the `git-escrows` package, one of its transitive dependencies, or the package publication account. 2. The attacker publishes a malicious version to the package registry. 3. The locally installed `git-escrows` command is unavailable or fails. 4. Following the Skill instructions, the agent runs `npx git-escrows --help` or `bunx git-escrows --help`. 5. The package runner retrieves and executes the malicious release. 6. Malicious installation hooks or runtime code execute with the agent’s operating-system permissions. 7. The payload may read the configured wallet ...[truncated 893 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `git-escrows` to a reviewed, exact version rather than executing the latest available release: ```bash npx --yes git-escrows@1.2.3 --help ``` 2. Verify the selected package version and all transitive dependencies using a lockfile and registry integrity hashes. 3. Prefer a preinstalled, administrator-approved binary and fail closed when it is unavailable instead of automatically downloading executable code. 4. Validate package provenance, publisher identity, release signatures, and repository ownership before installation. 5. Install the dependency in an isolated environment with minimum filesystem, credential, and network access. 6. Do not expose `PRIVATE_KEY`, Git credentials, or other secrets to package installation hooks or untrusted subprocesses. 7. Document an explicit allowlisted package registry and reject alternate or user-controlled registry configurations. 8. Review and pin the global installation command as well; `npm i -g git-escrows` is also mutable when no version is specified. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:43
• Finding: Wallet Private Key Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 43–45 **Vulnerability Type**: Sensitive credential exposure through process arguments and command history **Risk Level**: High ### Vulnerable Code ```markdown If not, tell the user they need one and suggest running: ``` git-escrows new-client --privateKey "0x..." --network "sepolia" ``` ``` ### Technical Analysis The documented initialization command instructs the user to supply a wallet private key directly through the `--privateKey` command-line argument. Command-line secrets may be retained or exposed through several channels: - Interactive shell history. - Process listings and operating-system process inspection. - Terminal session recording. - Agent transcripts and command logs. - CI/CD logs or shell tracing. - Monitoring and telemetry systems that capture command arguments. A blockchain private key is a bearer credential: knowledge of the key is generally sufficient to sign transactions as the associated account. Unlike an ordinary password, unauthorized transactions cannot normally be reversed, and rotating the key requires moving control and assets to a new account. The placeholder shown in the file is not a hardcoded real secret. The vulnerability arises because the recommended usage pattern causes users to replace the placeholder with an actual private key in a command-line argument. ### Attack Path 1. A user follows the Skill’s setup recommendation. 2. The user replaces `"0x..."` with a real wallet private key and executes the command. 3. The command, including the key, is recorded in shell history, an agent transcript, terminal logs, process metadata, or telemetry. 4. A local user, malicious process, log operator, or party with transcript access reads the exposed key. 5. The attacker imports the key into a wallet or signing tool. 6. The attacker signs unauthorized blockchain transactions or impersonates the user in the escrow workflow. 7. The attacker may transfer assets ...[truncated 887 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the recommendation to pass private keys through command-line arguments. 2. Modify or use the CLI so that it reads the key from a non-echoing interactive prompt. 3. Prefer integration with an operating-system keychain, hardware wallet, encrypted keystore, or dedicated secret manager. 4. If file-based configuration is unavoidable: - Store the key in a dedicated file with restrictive permissions. - Ensure the file is excluded from Git and backups that do not support secret handling. - Pass only the file path or file descriptor to the application. - Delete temporary secret material securely after use. 5. Prevent command echoing and shell tracing while handling secrets. 6. Ensure agent transcripts, CI logs, crash reports, and telemetry redact private keys and other wallet credentials. 7. Document immediate incident-response steps for suspected exposure: stop using the account, transfer assets to a newly generated wallet, revoke applicable authorizations, and remove the secret from retained logs and histories. 8. Where supported, use transaction-specific signing with explicit user confirmation instead of making a raw private key available to the general agent process. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

---
name: fulfill-git-escrow
description: Fulfill a git escrow bounty by writing a solution or submitting an existing one. Use when the user wants to solve a test suite challenge, write code to pass tests, and claim a token reward. Requires the git-escrows CLI (npm i -g git-escrows).
compatibility: Requires git-escrows CLI, git, a configured .env with PRIVATE_KEY, and network access to an Ethereum RPC endpoint.
allowed-tools: Bash Read Write Edit Glob Grep
metadata:
  author: arkhai-io

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: fulfill-git-escrow
description: Fulfill a git escrow bounty by writing a solution or submitting an existing one. Use when the user wants to solve a test suite challenge, write code to pass tests, and claim a token reward. Requires the git-escrows CLI (npm i -g git-escrows).
compatibility: Requires git-escrows CLI, git, a configured .env with PRIVATE_KEY, and network access to an Ethereum RPC endpoint.
allowed-tools: Bash Read Write Edit Glob Grep
metadata:
  author: arkhai-io

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: fulfill-git-escrow
description: Fulfill a git escrow bounty by writing a solution or submitting an existing one. Use when the user wants to solve a test suite challenge, write code to pass tests, and claim a token reward. Requires the git-escrows CLI (npm i -g git-escrows).
compatibility: Requires git-escrows CLI, git, a configured .env with PRIVATE_KEY, and network access to an Ethereum RPC endpoint.
allowed-tools: Bash Read Write Edit Glob Grep
metadata:
  author: arkhai-io

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The example command shows a raw private key argument (`--privateKey "0x..."`) with no warning not to paste real secrets into terminals, chat, shell history, or logs. This is especially risky because users may imitate examples literally, exposing a wallet key that can lead to irreversible compromise of blockchain assets and identity.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly depends on a `.env` containing `PRIVATE_KEY` and instructs the agent to perform blockchain-related submission actions, but it provides no warning about sensitive credential handling or transaction risk. In this context, omission of safety guidance increases the chance of accidental secret exposure, misuse of signing authority, or unintended financial actions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill recommends running `npx git-escrows` as a fallback without pinning a specific package version. That can execute whatever version is currently resolved from the registry at runtime, creating a supply-chain risk, especially because this skill also expects local secrets and blockchain-signing capability in the same environment.

Static analysis

No suspicious patterns detected.