metabot

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:05 PM UTC
• Version: 1.0.0

Overview

The skill appears purpose-aligned, but it handles real wallet authority and stores recovery phrases and API keys in plaintext with weak safeguards.

Review this carefully before installing. Use it only in a constrained workspace with no valuable wallet funds, do not commit or share account.json, rotate any API key written there, and require explicit confirmation of the exact account, content, fee, and destination before any on-chain action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/utils.ts:195

Finding

Wallet Mnemonics and LLM API Keys Are Persisted in Plaintext

Content

View full analysis

account.mnemonic && account.mnemonic.trim() !== '' ) filtered.forEach(normalizeAccountLLM) const filteredData: AccountData = { accountList: filtered } fs.writeFileSync(ACCOUNT_FILE, JSON.stringify(filteredData, null, 4), 'utf-8') ``` ### Technical Analysis A generated wallet recovery mnemonic and an LLM API key loaded from environment configuration are inserted directly into an account object. The entire object is then serialized as readable JSON in the shared root-level `account.json` file. No encryption, operating-system credential store, secret reference, or explicit restrictive file mode is used. The effective permissions therefore depend on the process umask and any pre-existi ...[truncated 2168 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.ts:65

Finding

Ambiguous and Fail-Open Account Selection Can Sign with the Wrong Wallet

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/check_environment.sh:33

Finding

Automatic Installation Uses Unlocked Dependency Resolution

Content

View full analysis

/dev/null; then if [ -f "$SKILL_ROOT/node_modules/.bin/ts-node" ]; then echo "✅ ts-node 已通过 npm 安装，请使用: npx ts-node scripts/..." else echo "⚠️ 未找到 ts-node，正在安装依赖..." (cd "$SKILL_ROOT" && npm install) echo "✅ 请使用: npx ts-node scripts/main.ts \"<用户提示词>\"" fi fi ``` `package.json:16-30`: ```json "dependencies": { "@scure/bip39": "1.6.0", "bip32": "^4.0.0", "@metalet/utxo-wallet-service": "0.3.33-beta.5", "bitcoinjs-lib": "6.1.7", "ecpair": "^2.1.0", "@bitcoinerlab/secp256k1": "1.2.0", "crypto-js": "^4.2.0", "decimal.js": "^10.4.3", "meta-contract": "^0.4.16", "sharp": "^0.33.0" }, "devDependencies": { "@types/node": "^20.0.0", "@types/crypto-js": "^4.2.2", "typescript": "^5.0.0", "ts-node": "^10.9.0" } ``` ### Technical Analysis The recommended environment-check workflow automatically invokes `npm install` when dependencies are missing. The audited project tree contains no dependency lockfile, while several direct dependencies use caret ranges. Installation can therefore resolve package and transitive dependency versions that were not present when the Skill was reviewed. NPM installation may also execute package lifecycle scripts. If a dependency account, package release, or transitive dependency is compromised, installation-time code executes with ...[truncated 1643 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (85)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Reading mnemonics from account.json, deriving wallets across multiple chains, signing transactions/messages, and fetching UTXOs are high-sensitivity wallet operations. Because these are not directly reflected in the skill description, the skill invites under-informed consent and unsafe deployment in environments that would not approve a wallet-management tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Reading mnemonics from account.json, deriving wallets across multiple chains, signing transactions/messages, and fetching UTXOs are high-sensitivity wallet operations. Because these are not directly reflected in the skill description, the skill invites under-informed consent and unsafe deployment in environments that would not approve a wallet-management tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Reading mnemonics from account.json, deriving wallets across multiple chains, signing transactions/messages, and fetching UTXOs are high-sensitivity wallet operations. Because these are not directly reflected in the skill description, the skill invites under-informed consent and unsafe deployment in environments that would not approve a wallet-management tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Reading mnemonics from account.json, deriving wallets across multiple chains, signing transactions/messages, and fetching UTXOs are high-sensitivity wallet operations. Because these are not directly reflected in the skill description, the skill invites under-informed consent and unsafe deployment in environments that would not approve a wallet-management tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Reading mnemonics from account.json, deriving wallets across multiple chains, signing transactions/messages, and fetching UTXOs are high-sensitivity wallet operations. Because these are not directly reflected in the skill description, the skill invites under-informed consent and unsafe deployment in environments that would not approve a wallet-management tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Reading mnemonics from account.json, deriving wallets across multiple chains, signing transactions/messages, and fetching UTXOs are high-sensitivity wallet operations. Because these are not directly reflected in the skill description, the skill invites under-informed consent and unsafe deployment in environments that would not approve a wallet-management tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Reading mnemonics from account.json, deriving wallets across multiple chains, signing transactions/messages, and fetching UTXOs are high-sensitivity wallet operations. Because these are not directly reflected in the skill description, the skill invites under-informed consent and unsafe deployment in environments that would not approve a wallet-management tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Reading mnemonics from account.json, deriving wallets across multiple chains, signing transactions/messages, and fetching UTXOs are high-sensitivity wallet operations. Because these are not directly reflected in the skill description, the skill invites under-informed consent and unsafe deployment in environments that would not approve a wallet-management tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill states that MetaBot mnemonics and account data are stored in a root-level account.json, but it does not provide a clear warning that this file contains highly sensitive credentials. Users may inadvertently commit, share, back up insecurely, or expose the file to other tools, leading to wallet compromise and loss of control over on-chain identities or funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document explicitly instructs storing highly sensitive secrets including wallet mnemonics and LLM API keys in a shared project-root account.json. In the context of a crypto/agent skill that shares this file with other skills, this increases the chance of accidental exposure through source control, broader filesystem access, logs, backups, or other components reading the same file, which could lead to wallet compromise and credential theft.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script writes the generated mnemonic and related wallet/account data directly to local storage immediately after creation, without any confirmation, encryption, or warning to the user. Exposure of this file would allow full takeover of the created blockchain identities and any associated funds, and the same storage also contains other sensitive configuration, compounding impact.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/env-config.ts (reported line 4)May include surrounding context.

ts

#!/usr/bin/env node

/**
 * 环境变量配置 - 读取 .env / .env.local 获取 LLM 等配置
 */

import * as fs from 'fs'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/env-config.ts (reported line 41)May include surrounding context.

ts

#!/usr/bin/env node

/**
 * 环境变量配置 - 读取 .env / .env.local 获取 LLM 等配置
 */

import * as fs from 'fs'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/env-config.ts (reported line 4)May include surrounding context.

ts

#!/usr/bin/env node

/**
 * 环境变量配置 - 读取 .env / .env.local 获取 LLM 等配置
 */

import * as fs from 'fs'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/env-config.ts (reported line 41)May include surrounding context.

ts

#!/usr/bin/env node

/**
 * 环境变量配置 - 读取 .env / .env.local 获取 LLM 等配置
 */

import * as fs from 'fs'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/env-config.ts (reported line 11)May include surrounding context.

ts

import * as path from 'path'

const ROOT_DIR = path.join(__dirname, '..', '..')
const ENV_FILE = path.join(ROOT_DIR, '.env')
const ENV_LOCAL_FILE = path.join(ROOT_DIR, '.env.local')
const ENV_EXAMPLE_FILE = path.join(ROOT_DIR, '.env.example')

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/env-config.ts (reported line 12)May include surrounding context.

ts

const ROOT_DIR = path.join(__dirname, '..', '..')
const ENV_FILE = path.join(ROOT_DIR, '.env')
const ENV_LOCAL_FILE = path.join(ROOT_DIR, '.env.local')
const ENV_EXAMPLE_FILE = path.join(ROOT_DIR, '.env.example')

function parseEnvFile(filePath: string): Record<string, string> {

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script generates a new wallet mnemonic and stores it directly in the account file, creating a plaintext long-term secret at rest. In an agent skill context, this is especially dangerous because the user may not realize the assistant is creating and persisting custodial wallet material locally, and compromise of that file results in full wallet takeover across supported chains.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code derives signing credentials from the mnemonic and transmits signature/public-key material to external services for reward initialization without explicit user disclosure or consent. Even if the mnemonic itself is not sent, hidden network use of wallet-derived credentials expands trust boundaries and can enable account linkage, unintended authorization flows, or abuse if the remote service or transport/logging path is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This function derives the private key from the loaded mnemonic and signs arbitrary transaction material without any visible approval, policy check, or transaction preview in the code shown. That is dangerous because a compromised caller, prompt-injection path, or unintended tool invocation could produce valid blockchain signatures that move funds or authorize irreversible on-chain actions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents commands that invoke environment-sensitive and network-capable tooling, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where an agent may over-grant execution, network access, or filesystem access beyond what the user expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill encourages sending Buzz messages to the default MVC network without clearly warning that the content may be transmitted or permanently recorded on-chain and may be publicly visible. Users could disclose sensitive or personal information under the mistaken assumption that this is a normal private application message.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using 'npx ts-node' without pinning a version makes execution depend on whatever package version is currently resolved from the registry or local environment. This weakens reproducibility and can expose users to supply-chain compromise or unexpected behavior if a malicious or incompatible version is installed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The second unpinned 'npx ts-node' usage has the same supply-chain and reproducibility problem: runtime behavior depends on external package resolution at execution time. In a skill that can manipulate wallets and send on-chain data, that execution ambiguity is especially risky.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language description is entirely in Chinese and provides no indication that users may choose another language or that the skill is region-specific. Under the policy criteria, forcing a specific language without opt-in is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.