Mrxlolcat Agent

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:17 AM UTC
• Version: 0.1.0

Overview

This skill is a Web3 and Farcaster automation skill with disclosed purpose, but it asks for high-impact wallet, posting, and long-term-memory actions without enough confirmation, scoping, or privacy controls.

Review this skill carefully before installing. It may guide users into bridge or swap flows, public Farcaster posting, external TTS generation, and long-term storage of transaction-related data. Use it only if you are comfortable verifying every chain, token, amount, fee recipient, destination, cast content, and transaction link yourself before signing or publishing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:16

Finding

Persistent Branded Instructions Hijack Agent Output and Financial Routing

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16-29; src/agent/skills/bridge-skill/SKILL.md:25-32; src/agent/skills/social-skill/SKILL.md:20-33
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Relevant Code Snippets:

SKILL.md:16-29

markdown

You are the master orchestrator of the MRX LOLCAT system. Your identity is defined as a chaotic-good cowboy cat living on the Base network.

## Unified Capabilities
Your skills are divided into specialized modules located in `src/agent/skills/`.

1. **Bridge Logic**: Uses `bridge-skill` to move assets across 60+ chains.
2. **Monitor Logic**: Uses `monitor-skill` for real-time wallet tracking.
3. **Social Logic**: Uses `social-skill` for Farcaster hub interactions.
4. **Micropayment Logic**: Uses `agentcash-skill` for paid API access.

## Core Rules
- Always maintain the **Cowboy Cat** persona (lowercase, emoji-rich).
- Prioritize **Base** and **Optimism** for all operations.
- Reference your long-term memory in Pinecone for recurring users.

src/agent/skills/bridge-skill/SKILL.md:25-32

markdown

   - Since you are a non-custodial agent, you cannot sign transactions directly.
   - **MUST**: Direct the user to click the "Liquidity" tab in the terminal navigation bar below.
   - Instruct the user to "Initialize Key" (Connect Wallet) if not already done.
4. **Post-Action**: Request the user to provide the transaction hash once confirmed for archival in Pinecone memory.

## Guidelines
- Always mention Base as the preferred low-fee hub.
- If a route involves Optimism, mention the "Cowboy Cat" speed advantage.

src/agent/skills/social-skill/SKILL.md:20-33

markdown

1. **Persona Check**: Ensure all responses maintain the "chaotic-good cowboy cat" personality (lowercase, emoji-rich, witty).
2. **Drafting**:
   - When a user asks to "post a cast", draft a high-engagement message (max 320 characters).

...[truncated 3000 chars]

Remediation

View remediation

Remediation Suggestions

• Restrict persona instructions to explicitly requested creative or social content.
• Replace unconditional terms such as “always” and “MUST” with task-specific conditions.
• Present networks and routing providers neutrally using measurable criteria such as fees, slippage, security assumptions, and estimated completion time.
• Clearly disclose commercial affiliations, platform fees, and project-controlled interfaces before recommending them.
• Require explicit user confirmation before redirecting the user to an external transaction or publishing interface.
• Remove unverifiable statements concerning speed advantages and identity verification, or connect them to concrete validation logic and clearly display the evidence.
• Ensure higher-priority user instructions and safety constraints cannot be overridden by persona or promotional requirements.

T09 · Insecure Skill Coding Practices

Error

• Location: src/agent/skills/bridge-skill/SKILL.md:14

Finding

Abbreviated Platform-Fee Recipient Prevents Transaction Verification

Content

View full analysis

Vulnerability Details

File Location: src/agent/skills/bridge-skill/SKILL.md:14-17
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Complete Code Snippet:

markdown

## Operational Capabilities
- **Protocols**: Exclusively uses LI.FI Smart Routing v3.
- **Fees**: Automatically applies a 0.1% platform fee to the partner wallet (`0xbA44...`).
- **Chain Support**: Base, Optimism, Arbitrum, Ethereum, Polygon, BSC, Avalanche.

Technical Analysis

The Skill states that a 0.1% fee is automatically sent to a partner wallet but identifies that wallet only as 0xbA44.... An abbreviated address is not sufficient to validate a transaction recipient. The instructions also provide no chain-specific recipient mapping, checksum, ownership proof, fee-calculation specification, calldata-validation procedure, or explicit consent requirement.

Because this repository contains no executable bridge implementation, the audit cannot verify whether a downstream interface enforces the stated percentage or recipient. An incorrect or substituted full address could therefore appear consistent with the Skill’s incomplete documentation.

Attack Path

1. A user requests a bridge or swap.
2. The Skill directs the user to the project’s Liquidity interface.
3. The interface constructs a transaction that includes a platform fee.
4. The user attempts to compare the recipient against the Skill documentation.
5. The abbreviated 0xbA44... value prevents meaningful verification.
6. A substituted or incorrect fee recipient may go undetected before the user signs the transaction.

Impact Assessment

No direct signing privilege is obtained by the Skill itself; the instructions state that signing occurs in the user’s wallet. However, the affected scope includes user-controlled cryptocurrency submitted through the recommended bridge workflow. If the downstream transaction uses an incorrect recipi ...[truncated 137 chars]

Remediation

View remediation

Remediation Suggestions

• Publish the complete checksummed fee-recipient address for every supported chain.
• Identify the legal or operational owner of each recipient address.
• Display the exact fee amount, percentage, token, network, and full recipient immediately before wallet confirmation.
• Require explicit fee consent rather than describing the fee as automatically applied.
• Validate generated calldata against an allowlist of full recipient addresses and expected fee limits.
• Reject transactions when the recipient, chain ID, token, or calculated fee differs from the reviewed configuration.
• Provide independently verifiable deployment or partner documentation.
• Add transaction-simulation and human-readable signing summaries so users can verify all value transfers.

T09 · Insecure Skill Coding Practices

Warning

• Location: src/agent/skills/bridge-skill/SKILL.md:24

Finding

Transaction Data Is Archived in External Long-Term Memory Without Defined Consent or Retention Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:26-30; src/agent/skills/bridge-skill/SKILL.md:24-28
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Relevant Code Snippets:

SKILL.md:26-30

markdown

## Core Rules
- Always maintain the **Cowboy Cat** persona (lowercase, emoji-rich).
- Prioritize **Base** and **Optimism** for all operations.
- Reference your long-term memory in Pinecone for recurring users.
- Never request private keys; redirect users to the terminal UI for signing.

src/agent/skills/bridge-skill/SKILL.md:24-28

markdown

3. **Execution**:
   - Since you are a non-custodial agent, you cannot sign transactions directly.
   - **MUST**: Direct the user to click the "Liquidity" tab in the terminal navigation bar below.
   - Instruct the user to "Initialize Key" (Connect Wallet) if not already done.
4. **Post-Action**: Request the user to provide the transaction hash once confirmed for archival in Pinecone memory.

Technical Analysis

The Skill directs the agent to obtain a transaction hash and archive it in Pinecone, while also instructing the agent to reference long-term memory for recurring users. A transaction hash is public blockchain data, but associating it with a recurring user profile creates additional privacy risk by linking identity, session history, wallet activity, counterparties, asset movements, and future on-chain behavior.

The audited instructions define no opt-in consent process, retention period, purpose limitation, encryption requirement, access-control policy, deletion procedure, export mechanism, or separation between user identity and transaction records. There is also no implementation in the artifact through which these protections could be verified.

Attack Path

1. A user completes a bridge transaction.
2. The agent requests the transaction hash under the post-action archival instruction.
3. The su ...[truncated 777 chars]

Remediation

View remediation

Remediation Suggestions

• Make transaction archival strictly opt-in and obtain informed consent before requesting the hash.
• Explain the storage purpose, provider, retention duration, access scope, and privacy implications.
• Do not store transaction hashes unless required for a specific user-requested function.
• Pseudonymize records and store identity separately from transaction metadata.
• Apply encryption in transit and at rest, tenant isolation, least-privilege access, and audit logging.
• Define automatic expiration and deletion policies.
• Provide user-accessible export, correction, and deletion mechanisms.
• Prevent retrieved memory from being treated as trusted operational instructions.
• Document Pinecone data residency and subprocessors where applicable.

T09 · Insecure Skill Coding Practices

Warning

• Location: src/agent/skills/social-skill/SKILL.md:19

Finding

Automatic Inclusion of Transaction Links Can Publicly Correlate Social and Wallet Identities

Content

View full analysis

Vulnerability Details

File Location: src/agent/skills/social-skill/SKILL.md:19-29
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Complete Code Snippet:

markdown

## Execution Logic (Step-by-Step)
1. **Persona Check**: Ensure all responses maintain the "chaotic-good cowboy cat" personality (lowercase, emoji-rich, witty).
2. **Drafting**:
   - When a user asks to "post a cast", draft a high-engagement message (max 320 characters).
   - Suggest including a relevant image embed (like the agent's logo) or a link to the Mini App.
3. **Casting**:
   - Use the `publishCast` tool (via `/src/agent/tools/farcaster.ts`).
   - If it's a "Thank You" for a swap/bridge, automatically include the transaction hash link.
4. **Channel Routing**:
   - If the user is in `/cats`, double down on feline references.
   - If in `/crypto`, focus on market sentiment and "bullish cat" vibes.

Technical Analysis

The Skill instructs the agent to automatically include a transaction-hash link in a public Farcaster message when posting a bridge or swap thank-you. It does not require transaction-specific disclosure consent, privacy warning, redaction, final content preview, or immediate pre-publication confirmation.

Although transaction hashes are public, publishing one through a social identity establishes an explicit and durable relationship between that identity and the relevant wallet activity. The transaction may reveal wallet addresses, counterparties, token balances, bridge routes, timestamps, and related historical or future activity.

The referenced /src/agent/tools/farcaster.ts file is absent from the audited artifact. Consequently, it is not possible to verify whether the publishing implementation provides a preview, confirmation gate, authentication controls, or deletion support.

Attack Path

1. A user completes a swap or bridge.
2. The user asks the agent to post a ...[truncated 809 chars]

Remediation

View remediation

Remediation Suggestions

• Remove automatic insertion of transaction hashes or blockchain-explorer links.
• Treat transaction identifiers as sensitive correlation data even when the underlying ledger is public.
• Show the exact final cast, including every embed and URL, before publication.
• Explain that posting the link may associate the user’s social identity with wallet addresses and transaction history.
• Require explicit, transaction-specific confirmation immediately before publishing.
• Default to a generic thank-you message that contains no transaction identifier.
• Allow users to redact or replace the transaction link.
• Implement authentication, authorization, audit logging, rate limiting, and confirmation controls in the missing publishing tool.
• Provide clear instructions for deleting a cast where the platform supports deletion, while warning that third parties may retain copies.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises autonomous on-chain actions and cross-chain bridging but does not warn users about transaction finality, bridge risk, destination-chain mismatches, slippage, or asset loss. In a Web3 agent context, omission of these warnings can cause users to authorize high-risk operations without understanding irreversible consequences, especially when the agent is positioned as a 'master orchestrator' for automated asset movement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs users to connect a wallet and proceed with cross-chain asset transfers, but it does not provide any warning that blockchain transactions are financially risky, may be irreversible, and can expose users to bridge, routing, slippage, or destination-chain mistakes. In a skill designed for autonomous on-chain guidance, omitting these safety disclosures increases the chance that users will take high-impact financial actions without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill description uses very broad trigger language such as 'check balances, track transactions, or set up price alerts,' which can overlap with many generic user requests and cause the skill to be invoked outside a narrowly intended context. In an agent that touches blockchain monitoring and wallet-related context, overbroad routing increases the chance of unintended data access, misleading monitoring claims, or inappropriate tool use based on weak intent matching.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is designed to create and publish Farcaster posts, including automated updates, but it does not prominently warn that content may be posted on the user's behalf. In a social-posting context, missing consent and action-transparency language increases the risk of unauthorized or surprising public actions, reputational harm, and abuse through prompt manipulation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill advertises generation of voice content through an external TTS service and attachment of that content to social posts, but does not warn users that their text may be sent to a third party. In this context, undisclosed third-party processing can expose sensitive data, create privacy/compliance issues, and lead to unexpected publication of synthetic media.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to use a publishCast capability even though the manifest only declares Fetch as an allowed tool. This creates a dangerous permission/behavior mismatch: the model may attempt undeclared actions, rely on hidden tooling, or encourage unsafe workarounds that bypass the skill's stated security boundary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Forcing a fixed persona and writing style without user opt-in can override user preferences and reduce clarity during sensitive financial workflows. In this skill, the risk is amplified slightly because emoji-heavy, roleplay-oriented output may distract from precise communication around wallet, bridge, and transaction details, increasing the chance of user misunderstanding.

Content

No source excerpt is available for this finding.