GoldKey Action Gate & Guard Beta

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:56 AM UTC
• Version: 1.0.10

Overview

The skill handles real paid GoldKey checks and wallet-adjacent workflows, but its artifacts disclose those effects and repeatedly require explicit user authorization and verification.

Install only if you intend to use GoldKey paid security checks or Guard workflows. Treat it as wallet-adjacent: approve each payment explicitly, use low-balance segregated wallets where possible, keep tokens and signatures in a secret store or stdin, verify package integrity for the Guard enforcer, and be cautious with the AgentCash npx workflow because it downloads and executes a registry package at runtime.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:63

Finding

Unverified Third-Party Package Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63–79
Vulnerability Type: Supply-chain exposure through runtime package retrieval and execution
Risk Level: Medium

Vulnerable Code

sh

npx -y agentcash@0.17.1 check \
  "https://goldkey-edge-storefront.noah-ing.workers.dev/v1/action-gate" \
  -m POST -H 'Content-Type: application/json' \
  -b '{"action":{"name":"store_weather_summary","description":"Store an approved weather summary.","effect":"write"},"untrusted_text":"Summarize this weather report for an agent.","payload":{"approved":true},"schema":{"type":"object","properties":{"approved":{"type":"boolean"}},"required":["approved"],"additionalProperties":false}}' \
  --format json

npx -y agentcash@0.17.1 accounts --format json

npx -y agentcash@0.17.1 fetch \
  "https://goldkey-edge-storefront.noah-ing.workers.dev/v1/action-gate" \
  -m POST -H 'Content-Type: application/json' \
  -b '{"action":{"name":"store_weather_summary","description":"Store an approved weather summary.","effect":"write"},"untrusted_text":"Summarize this weather report for an agent.","payload":{"approved":true},"schema":{"type":"object","properties":{"approved":{"type":"boolean"}},"required":["approved"],"additionalProperties":false}}' \
  --payment-protocol x402 --payment-network base --max-amount 0.01 --format json

Technical Analysis

The Skill directs operators to invoke agentcash@0.17.1 using npx -y. Although the dependency version is fixed, no cryptographic digest, verified local artifact, or lockfile is used to authenticate the package bytes before execution. The -y option allows retrieval and execution without an interactive installation confirmation.

Consequently, the code that runs is resolved from the active npm registry and local npm configuration at invocation time. Version pinning prevents ordinary version drift but does not protect against a compromised registry artifact, a compromised publisher account, cache poisoning, or subst ...[truncated 1823 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish expected SHA-256 and SHA-512/SRI values for the exact AgentCash package artifact.
2. Download the package archive without executing it.
3. Verify the archive’s package name, version, size, and cryptographic digest against values distributed through a trusted, independently controlled channel.
4. Install or execute only the verified local archive, with lifecycle scripts disabled where compatible with the package:

   sh

   npm install --ignore-scripts /absolute/private/verified-agentcash-0.17.1.tgz
   

5. Prefer a project-local dependency governed by a committed lockfile and integrity metadata instead of runtime npx -y retrieval.
6. Use a dedicated npm configuration that pins the expected HTTPS registry and rejects untrusted registry overrides.
7. Run the payment client with a restricted environment, minimal filesystem access, and a deliberately funded low-balance wallet.
8. Require explicit operator approval before package download, cache changes, wallet initialization, or payment, preserving the existing mandate and payment-cap controls.
9. If direct package execution remains necessary, sandbox it using OS or container controls that restrict filesystem access, environment-variable exposure, and outbound network destinations.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

Check the chain, contract, USDC address, terms hash, live supply, prices, sales-pause state, tool schemas, and Guard availability. Fail closed if live identity is unavailable or inconsistent; never infer availability or scarcity from this file.

The client pins the canonical production origin and onchain identity. Ordinary users do not set an API URL, and legacy `GOLDKEY_API_URL` is ignored. Maintainers may select a credential-free staging origin only by setting both `GOLDKEY_ALLOW_DEV_ORIGIN=1` and `GOLDKEY_DEV_API_URL`. Never send an access token, wallet signature, private key, or paid request to a noncanonical origin.

## Choose the narrowest layer

Self-Modification

High

• Category: Rogue Agent
• Confidence: 70% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/guard-beta.md (reported line 79)May include surrounding context.

md

The artifact includes the config-driven `goldkey-mcp-stdio`, `goldkey-agentcash`, `goldkey-wallet`, and `goldkey-wallet-mcp` launchers plus the lower-level SDK. Combine the shared runtime with one operator-controlled adapter configuration. No separate customer authorization client is required.

Bind operator-owned connectors before use and remove the guarded agent's original route to the MCP server, AgentCash wallet, upstream credential, or execution signer. The package:

- validates the exact 0.05- or 0.10-USDC Guard challenge before its separate local payer signs;
- enforces a durable cumulative local payment budget;

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares environment-variable requirements and describes execution of networked/payment-related commands, but it does not define an explicit tool scope such as allowed tools or permissions. In agent environments, that ambiguity can let the runtime overgrant access to env secrets or shell/network capabilities the skill relies on, increasing the blast radius if the skill is invoked with untrusted input.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.