T09 · Insecure Skill Coding Practices
Error
- Location
GITHUB-SETUP.md:11- Finding
Public Repository Workflow Can Commit and Expose Wallet Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Kite Agent Smart Wallet Permissionless Protocol V2
Security checks for vulnerabilities and agentic risk
Overview
This is a real Telegram-controlled testnet wallet bot, but it handles private keys and can trigger wallet-changing actions with weak safeguards.
Review this carefully before installing. Use only a low-value testnet key, keep .env out of source control, restrict who can message the bot, and do not run the send/session/limit commands until the bot has explicit confirmation, address validation, ownership verification, rate limits, and safer key storage.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
telegram-bot.js:97- Finding
Telegram User IDs Are Passed Directly as Ethereum Addresses
- Content
View full analysis
- Remediation
View remediation
verified Ethereum address ``` 2. Require users to register a valid address and validate it before any contract interaction: ```javascript if (!ethers.isAddress(candidateAddress)) { throw new Error('A valid Ethereum address is required'); } const normalizedAddress = ethers.getAddress(candidateAddress); ``` 3. Cryptographically verify address ownership. For example: - Generate a server-side nonce tied to the Telegram user ID. - Ask the user to sign a domain-separated message containing the nonce and bot identity. - Recover the signer with `ethers.verifyMessage`. - Store the mapping only when the recovered address matches the submitted address. - Expire and invalidate each nonce after one use. 4. Authorize every state-changing command against the verified mapping rather than trusting command arguments or Telegram display information. 5. Restrict access to approved Telegram user IDs or chats when the bot is intended for a single operator. 6. Add per-user and global rate limits, command cooldowns, and bounded retry behavior to reduce remotely triggered resource exhaustion. 7. Return generic errors to Telegram users while retaining sanitized diagnostic details in local logs. Do not return raw `error.message` values from providers or contracts. 8. Add tests covering: - Numeric Telegram IDs. - Invalid and malformed Ethereum addresses. - Valid checksum addresses. - Unregistered Telegram accounts. - Failed and replayed ownership proofs. - Unauthorized state-changing commands. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (33)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 安装 gh CLI curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null sudo apt update sudo apt install gh
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 安装 gh CLI curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null sudo apt update sudo apt install gh
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 84% confidence
- Finding
The command chains network retrieval directly into a privileged write using a pipe, which reduces transparency and encourages execution without inspection. Even when intended for legitimate setup, this pattern is dangerous in adversarial or compromised environments because it combines remote content with immediate root-level effect.
- Content
bash # 安装 gh CLI curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null sudo apt update sudo apt install gh
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
bash # 安装 gh CLI curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null sudo apt update sudo apt install gh
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The /session add and /limit set paths perform state-changing wallet operations immediately after parsing user input, with no confirmation, no secondary approval step, and no visible authorization checks tying userId to a verified blockchain owner identity. In a chat-driven interface, accidental invocation, spoofed identity mapping, or bot abuse could permanently weaken wallet security by adding session keys or changing spending limits.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The /send command immediately encodes transfer data and submits an on-chain execute call from the bot-controlled signer without any confirmation, transaction simulation, recipient validation, or user re-authentication. In this skill context, that makes the issue more dangerous than a normal UX flaw because a chat command can directly trigger irreversible asset movement, so a mistaken or unauthorized command can cause immediate fund loss.
- Content
Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The lockfile pins the transitive dependency ws to version 8.17.1, which the supplied analysis identifies as affected by memory disclosure and memory-exhaustion denial-of-service advisories. Because this skill appears to use ethers, which can rely on WebSocket connectivity for blockchain RPC/event subscriptions, a vulnerable ws library is relevant and could expose the agent to crashes, resource exhaustion, or unintended data exposure when handling hostile network input.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js // Validate required config if (!CONFIG.privateKey) { console.error('❌ Error: PRIVATE_KEY is required'); console.log('Create .env file:'); console.log('PRIVATE_KEY=your_private_key'); console.log('TELEGRAM_BOT_TOKEN=your_bot_token'); process.exit(1);
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js // Validate required config if (!CONFIG.privateKey) { console.error('❌ Error: PRIVATE_KEY is required'); console.log('Create .env file:'); console.log('PRIVATE_KEY=your_private_key'); console.log('TELEGRAM_BOT_TOKEN=your_bot_token'); process.exit(1);
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The bot performs state-changing blockchain operations such as adding session keys, changing spending limits, and sending funds immediately based only on incoming Telegram commands, with no authentication binding between Telegram users and blockchain owners, no confirmation step, and no transaction review. Because the signer is a single server-held private key, any Telegram user who can reach the bot may be able to trigger real on-chain actions from that key or its controlled wallets.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions explicitly tell the user to create a public GitHub repository and push the entire local skill directory, but provide no warning to review contents, .gitignore, secrets, wallet material, or commit history first. In a skill/workspace context, this creates a realistic risk of accidental public disclosure of sensitive files or prior commits.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 2. 仓库名: `kite-agent-wallet` 3. 设为 Public 4. 不要勾选 README 5. 点击 Create repository ## 本地执行
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
This step pipes data fetched over the network directly into a root-privileged write operation under /usr/share/keyrings. Although adding a package signing key can be legitimate, combining remote retrieval with sudo in copy-paste instructions increases the blast radius of mistakes, tampering, or supply-chain compromise.
- Content
bash # 安装 gh CLI curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null sudo apt update sudo apt install gh
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 76% confidence
- Finding
This command writes a new apt source configuration with sudo, modifying system package trust settings. In context it is standard package setup, but it still asks users to make privileged system changes without verification guidance, which could enable supply-chain risk if copied from an untrusted document.
- Content
bash # 安装 gh CLI curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null sudo apt update sudo apt install gh
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md # 安装 gh CLI curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null sudo apt update sudo apt install gh # 登录
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md # 安装 gh CLI curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null sudo apt update sudo apt install gh # 登录
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The one-command workflow creates a public repository and immediately pushes the current directory, removing the user's chance to inspect what will be published. Because it operates on the active source tree, any sensitive files, generated artifacts, or embedded credentials present locally could be exposed publicly in a single step.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README instructs users to place a raw private key and Telegram bot token directly into environment variables without any warning about secret handling, storage hygiene, or the consequences of leakage. In the context of a Telegram-controlled wallet, exposure of either secret can enable unauthorized wallet operations, and loss of the private key can directly compromise funds or delegated permissions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The command list advertises wallet creation, session authorization, limit changes, and fund transfers without warning that these actions may be irreversible or security-sensitive. Because the skill is designed to control a wallet over Telegram, users may underestimate the risk of granting sessions, changing limits, or sending funds, increasing the chance of accidental loss or abuse if the bot or chat context is mishandled.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs users to place a raw wallet private key in an environment file to operate a Telegram-controlled crypto wallet, but provides no security warning, no guidance on secure storage, and no mention of transaction-drain risk. In a cryptocurrency context, exposure or misuse of that key would directly enable irreversible theft of funds, and coupling it to a bot interface increases the sensitivity of the setup.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guide instructs users to place a blockchain private key and Telegram bot token into a local .env file but provides no warning about the extreme sensitivity of those secrets, nor guidance on excluding the file from source control or restricting local access. In this context, disclosure of either secret can directly enable wallet compromise or bot takeover, and the private key can lead to irreversible asset theft.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The guide documents a /send command that transfers crypto funds without warning that transactions are value-bearing and typically irreversible once submitted. In a Telegram wallet workflow, users may invoke the command casually or under social engineering pressure, increasing the chance of mistaken or fraudulent transfers.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The command handler initializes a signer from KITE_WALLET_PRIVATE_KEY and then uses that signer to create wallets, add session keys, update limits, and execute transfers based on chat commands. In a Telegram-style bot context, this is dangerous because a single long-lived private key becomes the authority for all on-chain operations, and any authorization mistake, account mapping flaw, or bot compromise can lead to unauthorized blockchain actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest explicitly advertises Telegram-based wallet control and smart-wallet capabilities but provides no prominent warning that the skill can initiate sensitive financial actions. In a wallet-control context, missing disclosure increases the risk of users invoking transfers, approvals, session-key grants, or spending-limit changes without appreciating the security consequences, especially through a chat interface that can blur intent and confirmation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code reads highly sensitive environment variables including PRIVATE_KEY and TELEGRAM_BOT_TOKEN, but only logs missing-config errors and never provides a user-facing warning or explanatory comment about handling credentials. For a code file, accessing credentials should have some disclosure unless clearly covered elsewhere in the skill description, which is not present here.
- Content
Static analysis
No suspicious patterns detected.