Security audit

AI Mine

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent AIT mining purpose, but it asks the agent to run unpinned third-party code with wallet and API credentials, including credentials pasted in chat.

Review before installing. Use only a dedicated low-value wallet, never paste private keys in chat, prefer secure environment-based secrets, set strict API spending limits, and only run the miner if you trust the referenced GitHub repository and its npm dependency chain.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:31
Finding: Execution of Mutable, Unverified Third-Party Code
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:42
Finding: Wallet and API Secrets Accepted Through Chat and Command-Line Arguments
Content: View full analysis
--openai-key ` using the keys they provided. Do not echo the keys back in full. Do not ask the user to manually edit .env or openclaw.json. ``` ### Technical Analysis The Skill explicitly allows a user to submit a cryptocurrency wallet private key and an OpenAI API key in a conversation. Conversation content may be retained in application history, server logs, telemetry, backups, or model-processing infrastructure, depending on the deployment. When secrets are submitted through chat, the Skill instructs the Agent to interpolate them into command-line arguments. On many operating systems, process arguments can be observed through process-management interfaces by sufficiently authorized local users or monitoring software. They may also be captured in execution telemetry, task history, debugging output, shell auditing, or error reports. The instruction not to echo keys back does not prevent exposure through the original conversation, generated command, process listing, or execution logs. Environment-variable injection is preferable to ...[truncated 1728 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs users to provide a wallet private key and OpenAI API key, but it lacks a prominent warning that these are highly sensitive credentials and should not be shared casually in chat. In context, this is especially dangerous because the private key controls blockchain funds and the OpenAI key can incur direct billing abuse; the skill even supports accepting them from conversation text, increasing exposure through logs, transcripts, and agent memory.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The skill explicitly supports collecting a blockchain private key and OpenAI API key from the conversation and then passing them to a command, which is a credential-handling anti-pattern. This is dangerous because secrets may be exposed in chat logs, agent traces, process listings, shell history, or persisted config generated by the init routine; with a wallet private key, compromise can directly result in theft of on-chain assets.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
`cd "$AIMINE_DIR/miner" && npx ts-node src/index.ts init --private-key <key> --openai-key <key>` using the keys they provided. Do not echo the keys back in full. Do not ask the user to manually edit .env or openclaw.json. ---

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The phrase "Supported user intents (English trigger phrases)" imposes an English-only language constraint in the skill's natural-language interface. The file does not offer alternative languages, user choice, or a justification for why English is required, which makes it a language-policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger examples include very broad phrases such as 'status' and 'check balance' that can collide with ordinary conversation and unintentionally activate the skill. In this skill, unintended activation is more dangerous than usual because activation can lead to installing software, querying a wallet, or initiating mining operations tied to private keys and paid API usage.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: The skill is designed to have the agent autonomously clone a repository and install dependencies without a human review step. Autonomous execution is materially risky here because it runs third-party code from GitHub and package dependencies on the user's machine, which could lead to supply-chain compromise or unexpected system changes if the repo or dependency chain is malicious or later altered.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
cd "$AIMINE_DIR/miner" && npm install

text
Do not ask the user to open a terminal or run these manually. ---

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 95% confidence
Finding: This instruction pushes the agent to autonomously initialize the miner with highly sensitive secrets and discourages safer manual review of configuration files. In context, that is more dangerous than ordinary automation because it couples secret handling with execution of third-party code, creating risk of secret leakage into process arguments, shell history, logs, telemetry, or the miner's own configuration artifacts.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
`cd "$AIMINE_DIR/miner" && npx ts-node src/index.ts init --private-key <key> --openai-key <key>` using the keys they provided. Do not echo the keys back in full. Do not ask the user to manually edit .env or openclaw.json. ---

Static analysis

No suspicious patterns detected.