ClawHub
Back to skill

Security audit

Agent identity and reputation registration

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for blockchain agent registry work, but it gives an external MCP server wallet, signing, mainnet, and storage capabilities with several under-scoped safety controls.

Install only if you are comfortable running the external MCP package in a restricted environment. Pin and audit the package version, start it with a clean allowlisted environment, keep it on testnet by default, require explicit user confirmation before any signing or mainnet transaction, and avoid publishing sensitive wallet, endpoint, or payment metadata to shared IPFS storage unless you intend it to be public and persistent.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
skill.md:94
Finding

Unpinned Remote npm Package Execution

Content
View full analysis

Vulnerability Details

File Location: skill.md:94-97
Additional Locations: README.md:19, README.md:38, README.md:48, README.md:67, README.md:235-238
Vulnerability Type: Unpinned remote dependency retrieval and execution
Risk Level: High

Complete Code Snippet

typescript
const server = spawn('npx', ['@quantulabs/8004-mcp'], {
  stdio: ['pipe', 'pipe', 'inherit'],
  env: { ...process.env, NETWORK_MODE: 'testnet' }
});

Related installation instructions also execute the package without a version constraint:

bash
npx @quantulabs/8004-mcp

Technical Analysis

The Skill instructs the agent to execute @quantulabs/8004-mcp through npx without specifying an exact package version or integrity value. Depending on the local npm cache and npm resolution behavior, npx may retrieve the currently published package release and execute its code.

The effective executable payload can therefore change after this Skill has been reviewed. The project contains only documentation and does not include the MCP server implementation, package lockfile, integrity metadata, or vendored source needed to verify the runtime behavior.

This dependency is particularly sensitive because the documented MCP server is expected to manage cryptocurrency wallets, import private keys, unlock encrypted wallet stores, sign blockchain transactions, broadcast transactions, and communicate with external RPC and IPFS services.

Attack Path

  1. An attacker compromises the npm publisher account, package repository, build pipeline, or a future package release.
  2. The attacker publishes a modified version of @quantulabs/8004-mcp.
  3. A user or agent follows the Skill instructions and invokes npx @quantulabs/8004-mcp.
  4. npm resolves and downloads the attacker-controlled version because no exact version or integrity constraint is specified.
  5. The malicious package executes with the permissions of ...[truncated 962 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact audited version, such as @quantulabs/8004-mcp@x.y.z; do not use a floating tag or range.
  2. Install the dependency through a committed lockfile and enforce npm integrity verification.
  3. Audit or vendor the exact MCP server source used in production.
  4. Avoid downloading and executing the package dynamically during an agent session.
  5. Consider installing with lifecycle scripts disabled until package scripts have been reviewed.
  6. Run the MCP server in a sandbox or dedicated low-privilege account with restricted filesystem access.
  7. Restrict outbound network access to explicitly required blockchain RPC and storage endpoints.
  8. Separate read-only registry operations from wallet and signing operations so search functionality does not receive wallet privileges.
  9. Require explicit user confirmation and transaction previews before signing or broadcasting any transaction.

T09 · Insecure Skill Coding Practices

Error
Location
skill.md:94
Finding

Complete Process Environment Exposed to a Network-Capable Child Process

Content
View full analysis

Vulnerability Details

File Location: skill.md:94-97
Additional Location: README.md:235-238
Vulnerability Type: Excessive credential exposure through unrestricted environment inheritance
Risk Level: High

Complete Code Snippet

typescript
const server = spawn('npx', ['@quantulabs/8004-mcp'], {
  stdio: ['pipe', 'pipe', 'inherit'],
  env: { ...process.env, NETWORK_MODE: 'testnet' }
});

Technical Analysis

The spread expression ...process.env passes every environment variable from the parent agent process to the MCP child process. Agent and CI environments frequently contain unrelated sensitive values, including cloud access keys, source-control tokens, database credentials, model-provider API keys, deployment secrets, and signing-service credentials.

The child process is explicitly network-capable because its declared functionality requires blockchain RPC, registry, crawler, and IPFS communications. Registry queries and wallet operations do not justify exposing every secret held by the parent process. This violates least-privilege principles and creates a direct credential-access path if the external package is compromised or contains an exploitable defect.

The reviewed documentation does not prove that the MCP server transmits environment secrets. The vulnerability is the unnecessary disclosure of those secrets to an unaudited process that has outbound network access.

Attack Path

  1. A sensitive token is stored in the parent process environment.
  2. The agent starts the MCP server using the documented spawn call.
  3. ...process.env copies the sensitive token into the MCP server environment.
  4. A malicious dependency release, compromised transitive dependency, or exploitable MCP operation reads the token.
  5. The process sends the token to an external endpoint using its existing network access.
  6. The attacker uses the stolen credential against the associated external se ...[truncated 707 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace unrestricted inheritance with an explicit environment allowlist.
  2. Pass only variables proven necessary, such as a controlled PATH, isolated HOME, and NETWORK_MODE.
  3. Provide required RPC or IPFS credentials through dedicated, least-privilege secrets rather than the parent agent environment.
  4. Use short-lived credentials restricted to required hosts, methods, and spending limits.
  5. Remove cloud, CI, source-control, database, and model-provider credentials from the MCP execution context.
  6. Run the child process under a separate account or container with a clean environment.
  7. Apply outbound network allowlisting to prevent arbitrary credential exfiltration.
  8. Document each environment variable consumed by the server and reject unexpected sensitive variables during startup.

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:503
Finding

Potentially Sensitive Registration and Payment Metadata Uploaded to Shared Persistent Storage

Content
View full analysis

Vulnerability Details

File Location: skill.md:503-509
Additional Locations: skill.md:265, README.md:406-416, README.md:451-475
Vulnerability Type: Insufficiently controlled disclosure to public, persistent third-party storage
Risk Level: Medium

Complete Code Snippet

markdown
### IPFS (Configured by default)
- `ipfs_configure` - Override default IPFS/Pinata settings (optional)
- `ipfs_add_json` - Store JSON (max 1MB)
- `ipfs_add_registration` - Store registration file
- `ipfs_get_registration` - Retrieve registration

> Note: IPFS is pre-configured with a shared Pinata account. No setup required for basic usage.

The documented payment workflow includes uploading proof metadata:

javascript
await mcpClient.callTool({
  name: 'x402_feedback_submit',
  arguments: {
    agentId: 'sol:AgentPubkey...',
    score: 85,
    tag1: 'x402-resource-delivered',
    tag2: 'exact-svm',
    endpoint: 'https://agent.example.com/api',
    proofOfPayment: proof.proofOfPayment,
    storeOnIpfs: true
  }
});

The documented feedback object contains correlatable transaction information:

json
{
  "agentRegistry": "solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1:HHCVWcqs...",
  "agentId": "AgentPubkey...",
  "clientAddress": "solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1:ClientPubkey...",
  "createdAt": "2026-01-23T12:00:00Z",
  "score": 85,
  "tag1": "x402-resource-delivered",
  "tag2": "exact-svm",
  "endpoint": "https://agent.example.com/api",
  "proofOfPayment": {
    "fromAddress": "ClientPubkey...",
    "toAddress": "AgentPubkey...",
    "chainId": "EtWTRABZaYq6iMfeYKouRu166VU2xqa1",
    "txHash": "5xR7mN2k..."
  }
}

Technical Analysis

The Skill states that IPFS is configured by default through a shared Pinata account. It also documents automatic IPFS uploads for registration data when no tokenUri is supplied and supports storing x402 ...[truncated 2217 chars]

Remediation
View remediation

Remediation Suggestions

  1. Disable automatic IPFS uploads by default.
  2. Require explicit, informed user confirmation before each upload.
  3. Show an exact preview of all fields that will be published and clearly state that IPFS deletion cannot be guaranteed.
  4. Use user-controlled Pinata, IPFS, Arweave, or HTTPS storage rather than a shared account.
  5. Minimize uploaded data by excluding endpoints, timestamps, addresses, tags, and proof fields not strictly required by the protocol.
  6. Never include private keys, wallet-store passwords, API credentials, authentication headers, or unrelated personal data.
  7. Provide a local build-only mode that returns the proposed file without uploading it.
  8. Apply schema validation and sensitive-data scanning before publication.
  9. Document retention, replication, access, and deletion limitations.
  10. Separate registry-search operations from storage capabilities so read-only use cannot initiate uploads.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 36)May include surrounding context.

The MCP automatically loads a .env file from the current directory.

bash
cp .env.example .env
# Edit .env with your values
npx @quantulabs/8004-mcp

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

bash
cp .env.example .env
# Edit .env with your values
npx @quantulabs/8004-mcp

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README demonstrates wallet creation, feedback submission, agent registration, and network switching to mainnet, but does not give a prominent upfront warning that these actions can trigger real blockchain transactions, spend funds, and be irreversible. In an agent-skill context, users may follow examples verbatim or let an autonomous client invoke write-capable tools, increasing the chance of accidental fund loss or unintended on-chain state changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The examples include a concrete master password value for wallet-store initialization and later reuse it for unlocking, without an explicit warning not to hardcode, log, transmit, or expose secrets. Because this skill is aimed at agents and assistant integrations, example code is likely to be copied into automation, chat transcripts, logs, or source control, increasing the risk of wallet compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documents switching to mainnet but does not place an immediate, explicit warning that subsequent write operations can broadcast irreversible real-money transactions. In this context, the same document also teaches wallet setup, funding, and many write-capable tools, so an agent or user could transition from testing to spending real funds without adequate friction or confirmation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
README.md:282

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
skill.md:226