T08 · Insecure Dependencies
Error
- Location
SKILL.md:199- Finding
Unpinned Third-Party Dependencies Execute Within a Wallet-Signing Environment
- Content
View full analysis
- Remediation
View remediation
Security audit
Submit To Agentbeat
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly transparent about its AgentBeat wallet and submission workflow, but it gives an agent risky authority over private keys, payments, and persistent wallet data.
Review before installing. Use an external signer, hardware wallet, OS keychain, or encrypted vault instead of local plaintext private-key storage; do not paste or log private keys; keep only low balances in the agent wallet; treat the AgentBeat voucher as secret; pin and review dependencies before installing; and require explicit approval for every on-chain transaction, payment destination, reward address, and public post involving wallet or voucher data.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
reference/wallet-setup.md:12- Finding
Wallet Generation Exposes Private Keys Through Standard Output and Permits Plaintext Persistence
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
reference/x402-integration.md:63- Finding
x402 Client Automatically Signs Payment Challenges Without Enforced Policy or Spending Limits
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (31)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The skill explicitly defines a local credentials file path for handling an EVM private key, creating a workflow where highly sensitive signing material may be stored on disk. Even with warnings and owner confirmation, plaintext private-key storage materially increases the risk of theft, replay, unauthorized transactions, and irreversible on-chain asset loss if the host is compromised or the file is mishandled.
- Content
md - name: EVM_PRIVATE_KEY required: false description: Agent wallet private key. Prefer loading from an external signer or credential store. Storing plaintext keys is a high-risk operation requiring owner confirmation. Required only when signing transactions. credentials_path: ~/.config/agentbeat/credentials.json --- # Submit to AgentBeat
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
Mandating that approval decisions be recorded in the same credentials.json file encourages persistent storage of operational metadata alongside potentially sensitive wallet material. Co-locating security decisions and credentials increases the blast radius of file disclosure and normalizes repeated access to a sensitive store by the skill.
- Content
md Before Step 1 / Step 3 / Step 5: 1. Must ask owner explicitly. 2. Must record decision in `~/.config/agentbeat/credentials.json` (or execution note if file unavailable). 3. Must stop if required decision is missing, ambiguous, or denied. ### `KEY_HANDLING_GATE` (before Step 1)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
This instruction explicitly offers local plaintext storage of a private key in ~/.config/agentbeat/credentials.json as an approved mode. Because blockchain private keys are bearer secrets, plaintext local storage creates a direct path to wallet compromise and irreversible transaction signing if the file is exposed by malware, backups, logs, or multi-user access.
- Content
text Please confirm private key handling: 1) external signer / secure credential store (preferred), or 2) local plaintext storage in ~/.config/agentbeat/credentials.json (high risk). Reply with one explicit approval.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
Backing up credentials.json can duplicate any stored private key into additional plaintext files, increasing the number of sensitive artifacts that an attacker can steal. Even with chmod 600, backup proliferation raises the chance of compromise through endpoint malware, syncing tools, accidental disclosure, or weak operational hygiene.
- Content
bash TIMESTAMP=$(date +%Y%m%d_%H%M%S) cp ~/.config/agentbeat/credentials.json ~/.config/agentbeat/credentials.backup.${TIMESTAMP}.json chmod 600 ~/.config/agentbeat/credentials.backup.${TIMESTAMP}.json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Creating a persistent credentials.json file as part of the wallet flow establishes a local secret storage location that may later hold an EVM private key. Predictable, persistent plaintext secret files are common compromise targets and are especially dangerous for blockchain accounts because theft enables immediate, irreversible financial abuse.
- Content
bash mkdir -p ~/.config/agentbeat touch ~/.config/agentbeat/credentials.json chmod 600 ~/.config/agentbeat/credentials.json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Although chmod 600 is protective, this finding still points to a local credentials file intended for sensitive use. Restricting permissions mitigates but does not eliminate the core risk of storing bearer secrets on disk, especially against malware, local process compromise, or unsafe backups.
- Content
bash mkdir -p ~/.config/agentbeat touch ~/.config/agentbeat/credentials.json chmod 600 ~/.config/agentbeat/credentials.jsonBlock:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The quick reference reinforces a standard operating model centered on ~/.config/agentbeat/credentials.json, which normalizes use of a predictable local credential store throughout the skill. This increases the chance that implementations will persist sensitive wallet material in an insecure location and that other tooling will repeatedly access it.
- Content
text Flow: Wallet -> Gas -> ERC-8004 -> x402 -> Submit/Claim Gates: KEY_HANDLING_GATE, ENDPOINT_DECLARATION_GATE, REWARD_ADDRESS_GATE Credentials: ~/.config/agentbeat/credentials.json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Before `POST /api/v1/submissions`, the following are hard requirements: 1. **Must ask** owner for required decisions. 2. **Must record** decisions (in `credentials.json` or equivalent execution log). 3. **Must stop** if decisions are missing. ### `REWARD_ADDRESS_GATE` (required)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Before `POST /api/v1/submissions`, the following are hard requirements: 1. **Must ask** owner for required decisions. 2. **Must record** decisions (in `credentials.json` or equivalent execution log). 3. **Must stop** if decisions are missing. ### `REWARD_ADDRESS_GATE` (required)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Before `POST /api/v1/submissions`, the following are hard requirements: 1. **Must ask** owner for required decisions. 2. **Must record** decisions (in `credentials.json` or equivalent execution log). 3. **Must stop** if decisions are missing. ### `REWARD_ADDRESS_GATE` (required)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Before `POST /api/v1/submissions`, the following are hard requirements: 1. **Must ask** owner for required decisions. 2. **Must record** decisions (in `credentials.json` or equivalent execution log). 3. **Must stop** if decisions are missing. ### `REWARD_ADDRESS_GATE` (required)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Before `POST /api/v1/submissions`, the following are hard requirements: 1. **Must ask** owner for required decisions. 2. **Must record** decisions (in `credentials.json` or equivalent execution log). 3. **Must stop** if decisions are missing. ### `REWARD_ADDRESS_GATE` (required)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Before `POST /api/v1/submissions`, the following are hard requirements: 1. **Must ask** owner for required decisions. 2. **Must record** decisions (in `credentials.json` or equivalent execution log). 3. **Must stop** if decisions are missing. ### `REWARD_ADDRESS_GATE` (required)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The skill instructs the agent to write an unrecoverable voucher required to claim rewards into a predictable local file path under ~/.config/agentbeat/credentials.json. Storing a claim token in a generic credentials file increases the chance of accidental exposure through backups, logs, overbroad file reads by other tools, or later public sharing workflows mentioned in the document.
- Content
}
text **Save the `voucher` immediately.** It cannot be retrieved later and is required to claim rewards. Write it to `~/.config/agentbeat/credentials.json`. > **Voucher usage beyond claiming (requires owner consent):** The voucher may also serve as proof of submission in campaign activities — for example, replying to official campaign tweets or posting in the MoltBook comment section. However, sharing the voucher or wallet address publicly is an **irreversible, sensitive operation**. You **must** ask your owner for explicit confirmation before posting it anywhere. Present the exact text you plan to post and the destination URL, and wait for approval. Never share it autonomously.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 73% confidence
- Finding
This section explicitly offers a workflow option for 'local plaintext approved' private key storage in ~/.config/agentbeat/credentials.json. Even with owner approval, normalizing plaintext private key persistence in a predictable file path creates a serious secret-at-rest risk: compromise of the user account, backups, logs, or developer tooling could expose the wallet and allow theft of funds or identity takeover.
- Content
text Please confirm private key handling: 1) "external signer approved" (preferred), or 2) "local plaintext approved" for ~/.config/agentbeat/credentials.json (high risk). If neither is approved, I will stop.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
The wallet-creation step introduces persistent local state for the agent's wallet, including possible private-key retention subject to the skill's approval gate. Session persistence is risky here because long-lived storage of blockchain credentials increases exposure time and creates a durable target for compromise beyond the immediate execution context.
- Content
chmod 600 ~/.config/agentbeat/credentials.backup.${TIMESTAMP}.json
text ## Step 1: Create or Locate EVM Wallet Action:
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
Persisting the voucher to ~/.config/agentbeat/credentials.json creates durable local storage for a sensitive bearer-style token that enables reward claiming. Because the voucher cannot be retrieved later and may also be reused in campaign contexts, compromise of that file could let another process or user claim rewards or misuse the submission proof.
- Content
}
text **Save the `voucher` immediately.** It cannot be retrieved later and is required to claim rewards. Write it to `~/.config/agentbeat/credentials.json`. > **Voucher usage beyond claiming (requires owner consent):** The voucher may also serve as proof of submission in campaign activities — for example, replying to official campaign tweets or posting in the MoltBook comment section. However, sharing the voucher or wallet address publicly is an **irreversible, sensitive operation**. You **must** ask your owner for explicit confirmation before posting it anywhere. Present the exact text you plan to post and the destination URL, and wait for approval. Never share it autonomously.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Voucher usage beyond claiming (requires owner consent): The voucher may also serve as proof of submission in campaign activities — for example, replying to official campaign tweets or posting in the MoltBook comment section. However, sharing the voucher or wallet address publicly is an irreversible, sensitive operation. You must ask your owner for explicit confirmation before posting it anywhere. Present the exact text you plan to post and the destination URL, and wait for approval. Never share it autonomously.
cURL Example
bash curl -X POST https://api.agentbeat.fun/api/v1/submissions \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
cURL Example
bash curl -X POST https://api.agentbeat.fun/api/v1/submissions \ -H "Content-Type: application/json" \ -d '{ "name": "MyDeFiAgent",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md |-------------|-------------|------------------| | `web` | Public website or dashboard | `https://youragent.example.com/` | | `A2A` | Google A2A agent-to-agent protocol | `https://youragent.example.com/.well-known/agent-card.json` | | `API` | REST or GraphQL API | `https://api.youragent.example.com/v1` | | `MCP` | Model Context Protocol server | `https://youragent.example.com/mcp` | **If your agent has no independent endpoint** (e.g. it runs inside an IDE, as a CLI tool, or within another platform), omit the `services` field entirely. Use this minimal registration file instead:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file provides multiple examples that use a raw
PRIVATE_KEYto sign live on-chain transactions, but it does not warn that private keys are highly sensitive secrets or that blockchain writes are irreversible and spend funds. In an agent skill that guides autonomous submission and wallet setup, this omission increases the chance an operator exposes credentials to the agent runtime, logs, or prompts, or authorizes unintended transactions on mainnet.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
After generating, save the address (and non-secret metadata only) to
~/.config/agentbeat/credentials.json:bash mkdir -p ~/.config/agentbeat cat > ~/.config/agentbeat/credentials.json << EOF { "address": "$ADDRESS",
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
"network": "base" } EOF chmod 600 ~/.config/agentbeat/credentials.json
text > **Do not write the private key to this file by default.** Storing a plaintext private key on disk is a high-risk operation. The preferred approach is to keep the key in an external signer, OS keychain, or encrypted vault. If no external option is available, you **must** ask the owner for explicit confirmation before persisting the key. See the "Private key handling" section in SKILL.md for the full decision flow.
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
"network": "base" } EOF chmod 600 ~/.config/agentbeat/credentials.json
text > **Do not write the private key to this file by default.** Storing a plaintext private key on disk is a high-risk operation. The preferred approach is to keep the key in an external signer, OS keychain, or encrypted vault. If no external option is available, you **must** ask the owner for explicit confirmation before persisting the key. See the "Private key handling" section in SKILL.md for the full decision flow.
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
"network": "base" } EOF chmod 600 ~/.config/agentbeat/credentials.json
text > **Do not write the private key to this file by default.** Storing a plaintext private key on disk is a high-risk operation. The preferred approach is to keep the key in an external signer, OS keychain, or encrypted vault. If no external option is available, you **must** ask the owner for explicit confirmation before persisting the key. See the "Private key handling" section in SKILL.md for the full decision flow.
Static analysis
No suspicious patterns detected.