Make Git Escrow

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:05 PM UTC
• Version: 1.0.0

Overview

The skill is coherent, but it needs review because it can lock crypto tokens using a wallet private key and may run unpinned package code.

Review before installing. Use only a dedicated low-value wallet, avoid entering a real private key in a command line or chat transcript, verify the git-escrows package source/version yourself, and require a final manual confirmation of chain, token, amount, arbiter, oracle, and recipient before any transaction is signed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:27

Finding

Unpinned Package Execution Through npx or bunx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 27
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code Snippet:

text

Run `git-escrows --help` to verify the CLI is installed. If it fails, try `npx git-escrows --help` or `bunx git-escrows --help`. Use whichever works for all subsequent commands. If none work, tell the user to install with `npm i -g git-escrows`.

Technical Analysis

The Skill instructs the Agent to execute git-escrows through npx or bunx without specifying a reviewed package version or validating package integrity. These package runners can retrieve the latest available package from a configured registry when it is not already installed locally.

The instruction to use the successful runner for “all subsequent commands” expands the risk beyond displaying help. The remotely obtained package may subsequently process wallet configuration, access the PRIVATE_KEY environment variable, and construct or submit a transaction that locks ERC20 assets.

This creates a supply-chain dependency on the mutable state of the package registry. Package compromise, maintainer account takeover, malicious version publication, registry substitution, or an unsafe custom registry could cause attacker-controlled code to execute in the Agent's environment.

Attack Path

1. An attacker compromises the git-escrows package, its publisher account, or the package registry used by npx or bunx.
2. The attacker publishes a malicious package version under the expected package name.
3. The locally installed git-escrows command is unavailable, causing the Agent to follow the fallback instruction.
4. The Agent runs npx git-escrows --help or bunx git-escrows --help, downloading and executing the unpinned package.
5. The malicious package executes with the permissions and environment of the Agent.
6. It may read .env or PRIVATE_KEY, alter escrow ...[truncated 911 chars]

Remediation

View remediation

Remediation Suggestions

• Remove automatic fallback to unversioned npx and bunx execution.
• Require a specific, security-reviewed version, such as npx git-escrows@<approved-version>, rather than resolving the latest release.
• Verify the package version and integrity digest before execution.
• Prefer a project-local dependency installed from a lockfile using a reproducible installation command such as npm ci.
• Document the expected package publisher, registry, version, and checksum.
• Run the CLI in a restricted environment with access only to the files and network destinations required for the transaction.
• Require the user to independently review and confirm the network, chain ID, token, arbiter, oracle, reward, recipient, and contract calldata before signing.
• Use a dedicated low-balance wallet for escrow operations rather than exposing a general-purpose wallet to third-party CLI code.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:31

Finding

Private Key Exposure Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-34
Vulnerability Type: Sensitive credential exposure
Risk Level: High

Vulnerable Code Snippet:

text

Check if a `.env` file exists in the current directory. If not, tell the user they need one and suggest running:

text

git-escrows new-client --privateKey "0x..." --network "sepolia"

Technical Analysis

The Skill recommends supplying an Ethereum private key through the --privateKey command-line argument. Although 0x... is a placeholder rather than a hardcoded credential, a user following the instruction would replace it with a real key.

Command-line arguments are not an appropriate transport for private keys. Depending on the operating system and execution environment, arguments may be exposed through process-listing utilities, process metadata, shell history, terminal recording, audit logs, debugging output, command telemetry, or Agent conversation and tool-call transcripts. Other processes or users with sufficient local visibility may capture the credential while the command is running or recover it from persistent records later.

The same private key is intended to authorize blockchain transactions involving escrowed assets. Disclosure therefore provides direct control over the corresponding wallet rather than merely exposing a revocable application credential.

Attack Path

1. The user follows the initialization recommendation and replaces 0x... with a real Ethereum private key.
2. The command containing the key is passed to a shell or Agent execution tool.
3. The key becomes visible in one or more locations, such as shell history, process arguments, terminal logs, audit records, or Agent transcripts.
4. A local user, malicious process, logging-system operator, or other party with access to those records retrieves the key.
5. The attacker imports the key into a wallet or signing utility.
6. The attacker signs arb ...[truncated 724 chars]

Remediation

View remediation

Remediation Suggestions

• Do not accept or recommend private keys as command-line arguments.
• Change the CLI to obtain the key through a hidden interactive prompt that disables terminal echo.
• Prefer hardware wallets, external signers, operating-system credential stores, or dedicated secret-management services.
• If environment-based input is unavoidable, inject it through a protected execution environment without printing it, and ensure subprocesses and logs do not expose the value.
• Prevent secrets from appearing in Agent messages, tool-call arguments, command output, telemetry, or error reports.
• Store any necessary local secret file with restrictive permissions and ensure .env is excluded from version control.
• Use a dedicated wallet with only the minimum funds and permissions required for the escrow operation.
• If a real key has already been entered on a command line, treat it as compromised: move assets to a newly generated wallet, revoke token approvals where possible, and remove the command from histories and logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: make-git-escrow
description: Create a new git escrow bounty for a test suite. Use when the user wants to submit a challenge with escrowed token rewards for passing a failing test suite. Requires the git-escrows CLI (npm i -g git-escrows).
compatibility: Requires git-escrows CLI, a configured .env with PRIVATE_KEY, and network access to an Ethereum RPC endpoint.
allowed-tools: Bash Read Glob Grep
metadata:
  author: arkhai-io

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

---
name: make-git-escrow
description: Create a new git escrow bounty for a test suite. Use when the user wants to submit a challenge with escrowed token rewards for passing a failing test suite. Requires the git-escrows CLI (npm i -g git-escrows).
compatibility: Requires git-escrows CLI, a configured .env with PRIVATE_KEY, and network access to an Ethereum RPC endpoint.
allowed-tools: Bash Read Glob Grep
metadata:
  author: arkhai-io

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

---
name: make-git-escrow
description: Create a new git escrow bounty for a test suite. Use when the user wants to submit a challenge with escrowed token rewards for passing a failing test suite. Requires the git-escrows CLI (npm i -g git-escrows).
compatibility: Requires git-escrows CLI, a configured .env with PRIVATE_KEY, and network access to an Ethereum RPC endpoint.
allowed-tools: Bash Read Glob Grep
metadata:
  author: arkhai-io

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly depends on a .env containing PRIVATE_KEY but provides no user-facing guidance about secret handling, least privilege, or avoiding exposure through logs and tooling. In a workflow invoking external CLIs and networked blockchain operations, poor secret hygiene can lead to wallet compromise and loss of funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill automates git-escrows submit, which locks ERC20 tokens on-chain, but it does not require an explicit user confirmation or warning that the action is financially consequential and potentially irreversible. This is dangerous because users may trigger a real blockchain transaction without understanding the token amount, network, or finality implications.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs use of npx git-escrows (and bunx) without pinning a version, which can fetch and execute whatever package version is currently published. In a workflow that also depends on a local .env with PRIVATE_KEY and performs on-chain actions, this increases supply-chain risk because a malicious or compromised package version could access secrets or initiate unintended blockchain transactions.

Content

No source excerpt is available for this finding.