Make Git Escrow

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:05 PM UTC
• Version: 1.0.0

Overview

The skill is coherent, but it needs review because it can lock crypto tokens using a wallet private key and may run unpinned package code.

Review before installing. Use only a dedicated low-value wallet, avoid entering a real private key in a command line or chat transcript, verify the git-escrows package source/version yourself, and require a final manual confirmation of chain, token, amount, arbiter, oracle, and recipient before any transaction is signed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:27
• Finding: Unpinned Package Execution Through npx or bunx## Vulnerability Details **File Location**: `SKILL.md`, line 27 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High **Vulnerable Code Snippet**: ```text Run `git-escrows --help` to verify the CLI is installed. If it fails, try `npx git-escrows --help` or `bunx git-escrows --help`. Use whichever works for all subsequent commands. If none work, tell the user to install with `npm i -g git-escrows`. ``` ### Technical Analysis The Skill instructs the Agent to execute `git-escrows` through `npx` or `bunx` without specifying a reviewed package version or validating package integrity. These package runners can retrieve the latest available package from a configured registry when it is not already installed locally. The instruction to use the successful runner for “all subsequent commands” expands the risk beyond displaying help. The remotely obtained package may subsequently process wallet configuration, access the `PRIVATE_KEY` environment variable, and construct or submit a transaction that locks ERC20 assets. This creates a supply-chain dependency on the mutable state of the package registry. Package compromise, maintainer account takeover, malicious version publication, registry substitution, or an unsafe custom registry could cause attacker-controlled code to execute in the Agent's environment. ### Attack Path 1. An attacker compromises the `git-escrows` package, its publisher account, or the package registry used by `npx` or `bunx`. 2. The attacker publishes a malicious package version under the expected package name. 3. The locally installed `git-escrows` command is unavailable, causing the Agent to follow the fallback instruction. 4. The Agent runs `npx git-escrows --help` or `bunx git-escrows --help`, downloading and executing the unpinned package. 5. The malicious package executes with the permissions and environment of the Agent. 6. It may read `.env` or `PRIVATE_KEY`, alter escrow ...[truncated 911 chars]
• Remediation: ## Remediation Suggestions - Remove automatic fallback to unversioned `npx` and `bunx` execution. - Require a specific, security-reviewed version, such as `npx git-escrows@<approved-version>`, rather than resolving the latest release. - Verify the package version and integrity digest before execution. - Prefer a project-local dependency installed from a lockfile using a reproducible installation command such as `npm ci`. - Document the expected package publisher, registry, version, and checksum. - Run the CLI in a restricted environment with access only to the files and network destinations required for the transaction. - Require the user to independently review and confirm the network, chain ID, token, arbiter, oracle, reward, recipient, and contract calldata before signing. - Use a dedicated low-balance wallet for escrow operations rather than exposing a general-purpose wallet to third-party CLI code.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:31
• Finding: Private Key Exposure Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 31-34 **Vulnerability Type**: Sensitive credential exposure **Risk Level**: High **Vulnerable Code Snippet**: ```text Check if a `.env` file exists in the current directory. If not, tell the user they need one and suggest running: ``` ```text git-escrows new-client --privateKey "0x..." --network "sepolia" ``` ### Technical Analysis The Skill recommends supplying an Ethereum private key through the `--privateKey` command-line argument. Although `0x...` is a placeholder rather than a hardcoded credential, a user following the instruction would replace it with a real key. Command-line arguments are not an appropriate transport for private keys. Depending on the operating system and execution environment, arguments may be exposed through process-listing utilities, process metadata, shell history, terminal recording, audit logs, debugging output, command telemetry, or Agent conversation and tool-call transcripts. Other processes or users with sufficient local visibility may capture the credential while the command is running or recover it from persistent records later. The same private key is intended to authorize blockchain transactions involving escrowed assets. Disclosure therefore provides direct control over the corresponding wallet rather than merely exposing a revocable application credential. ### Attack Path 1. The user follows the initialization recommendation and replaces `0x...` with a real Ethereum private key. 2. The command containing the key is passed to a shell or Agent execution tool. 3. The key becomes visible in one or more locations, such as shell history, process arguments, terminal logs, audit records, or Agent transcripts. 4. A local user, malicious process, logging-system operator, or other party with access to those records retrieves the key. 5. The attacker imports the key into a wallet or signing utility. 6. The attacker signs arb ...[truncated 724 chars]
• Remediation: ## Remediation Suggestions - Do not accept or recommend private keys as command-line arguments. - Change the CLI to obtain the key through a hidden interactive prompt that disables terminal echo. - Prefer hardware wallets, external signers, operating-system credential stores, or dedicated secret-management services. - If environment-based input is unavoidable, inject it through a protected execution environment without printing it, and ensure subprocesses and logs do not expose the value. - Prevent secrets from appearing in Agent messages, tool-call arguments, command output, telemetry, or error reports. - Store any necessary local secret file with restrictive permissions and ensure `.env` is excluded from version control. - Use a dedicated wallet with only the minimum funds and permissions required for the escrow operation. - If a real key has already been entered on a command line, treat it as compromised: move assets to a newly generated wallet, revoke token approvals where possible, and remove the command from histories and logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

---
name: make-git-escrow
description: Create a new git escrow bounty for a test suite. Use when the user wants to submit a challenge with escrowed token rewards for passing a failing test suite. Requires the git-escrows CLI (npm i -g git-escrows).
compatibility: Requires git-escrows CLI, a configured .env with PRIVATE_KEY, and network access to an Ethereum RPC endpoint.
allowed-tools: Bash Read Glob Grep
metadata:
  author: arkhai-io

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: make-git-escrow
description: Create a new git escrow bounty for a test suite. Use when the user wants to submit a challenge with escrowed token rewards for passing a failing test suite. Requires the git-escrows CLI (npm i -g git-escrows).
compatibility: Requires git-escrows CLI, a configured .env with PRIVATE_KEY, and network access to an Ethereum RPC endpoint.
allowed-tools: Bash Read Glob Grep
metadata:
  author: arkhai-io

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: make-git-escrow
description: Create a new git escrow bounty for a test suite. Use when the user wants to submit a challenge with escrowed token rewards for passing a failing test suite. Requires the git-escrows CLI (npm i -g git-escrows).
compatibility: Requires git-escrows CLI, a configured .env with PRIVATE_KEY, and network access to an Ethereum RPC endpoint.
allowed-tools: Bash Read Glob Grep
metadata:
  author: arkhai-io

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly depends on a `.env` containing `PRIVATE_KEY` but provides no user-facing guidance about secret handling, least privilege, or avoiding exposure through logs and tooling. In a workflow invoking external CLIs and networked blockchain operations, poor secret hygiene can lead to wallet compromise and loss of funds.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill automates `git-escrows submit`, which locks ERC20 tokens on-chain, but it does not require an explicit user confirmation or warning that the action is financially consequential and potentially irreversible. This is dangerous because users may trigger a real blockchain transaction without understanding the token amount, network, or finality implications.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The skill instructs use of `npx git-escrows` (and `bunx`) without pinning a version, which can fetch and execute whatever package version is currently published. In a workflow that also depends on a local `.env` with `PRIVATE_KEY` and performs on-chain actions, this increases supply-chain risk because a malicious or compromised package version could access secrets or initiate unintended blockchain transactions.

Static analysis

No suspicious patterns detected.