Tip with Grove

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:14 PM UTC
• Version: 1.0.0

Overview

This skill is a real Grove tipping guide, but it asks users to install unverified remote code and includes scripts that can move funds or monitor balances with weak safeguards.

Review this carefully before installing. Use only an isolated low-balance wallet, avoid the curl-to-bash installer unless you can verify the installer independently, do not run the auto-fund cron or batch-tip scripts with real funds until limits and validation are fixed, and treat webhook alerts as sharing account balance data with the webhook destination.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:6
• Finding: Unpinned Remote Installer Is Downloaded and Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:6`, `SKILL.md:131-133`, and `SKILL.md:252-255` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```yaml install: curl -fsSL https://grove.city/install-cli.sh | bash ``` ```bash curl -fsSL https://grove.city/install-cli.sh | bash ``` The same installation command is also recommended in error messages at: - `scripts/auto-fund.sh:115-119` - `scripts/batch-tip.sh:99-103` - `scripts/monitor-balance.sh:103-107` Those script locations print the command rather than executing it directly, but they still direct users toward the unsafe installation method. ### Technical Analysis The installation instructions retrieve mutable content from an external URL and immediately pipe it into `bash`. The downloaded script is not: - Pinned to an immutable release or content digest. - Verified using a cryptographic checksum or signature. - Included in the audited project. - Saved for inspection before execution. HTTPS protects the connection to the server under normal conditions, but it does not establish that the installer served in the future is identical to the version intended at audit time. The effective code executed by this Skill can therefore change without any modification to the reviewed repository. This behavior is especially sensitive because the installed Grove CLI is subsequently expected to create or access `~/.grove/.env` and `~/.grove/keyfile.txt`, process API credentials and private wallet material, and authorize financial transactions. ### Attack Path 1. An attacker compromises `grove.city`, its deployment credentials, DNS, TLS infrastructure, CDN, or the hosted installer. 2. The attacker replaces `install-cli.sh` with a malicious shell payload. 3. A user or autonomous agent follows the Skill's documented installation command. 4. `curl` downloads the attacker-controlled content and pipes it directly to `bash`. 5. The payload execut ...[truncated 970 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash` installation instructions. 2. Publish the CLI through a trusted package manager or provide a versioned release artifact. 3. Pin installation to an immutable version and cryptographic digest. 4. If a shell installer remains necessary, use a staged process such as: ```bash curl -fL -o install-cli.sh https://grove.city/releases/v2.0/install-cli.sh printf '%s %s\n' '<trusted-sha256>' install-cli.sh | sha256sum -c - less install-cli.sh bash install-cli.sh ``` 5. Sign release artifacts and verify signatures against a public key distributed through an independent trusted channel. 6. Document exactly which files, binaries, and permissions the installer changes. 7. Run installation with ordinary user privileges and do not request administrator access unless a specific operation strictly requires it. 8. Replace the unsafe command in all three script error messages with the verified installation procedure. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/auto-fund.sh:128
• Finding: Unvalidated Financial Values Are Interpreted as bc Programs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/auto-fund.sh:82-94`, `scripts/auto-fund.sh:128-143`, `scripts/auto-fund.sh:201-202`; `scripts/batch-tip.sh:127-148`, `scripts/batch-tip.sh:201-211`; `scripts/monitor-balance.sh:72-79`, `scripts/monitor-balance.sh:153-168` **Vulnerability Type**: Injection through dynamically constructed `bc` expressions **Risk Level**: High ### Vulnerable Code From `scripts/auto-fund.sh`: ```bash --min-balance) MIN_BALANCE="$2" shift 2 ;; --fund-amount) FUND_AMOUNT="$2" shift 2 ;; --max-balance) MAX_BALANCE="$2" shift 2 ;; ``` ```bash compare_balance() { local balance="$1" local threshold="$2" if command -v bc &> /dev/null; then if (( $(echo "$balance < $threshold" | bc -l) )); then return 0 # balance < threshold else return 1 # balance >= threshold fi else balance_cents=$(echo "$balance * 100" | awk '{print int($1)}') threshold_cents=$(echo "$threshold * 100" | awk '{print int($1)}') if [[ $balance_cents -lt $threshold_cents ]]; then return 0 else return 1 fi fi } ``` ```bash new_balance=$(echo "$current_balance + $FUND_AMOUNT" | bc -l) ``` From `scripts/batch-tip.sh`: ```bash if [[ "$line" =~ , ]]; then IFS=',' read -r dest amt <<< "$line" else read -r dest amt <<< "$line" fi dest=$(echo "$dest" | xargs) amt=$(echo "$amt" | xargs) if [[ -z "$dest" ]] || [[ -z "$amt" ]]; then echo -e "${YELLOW}⚠️ Line $line_num: Skipping invalid entry${NC}" continue fi destinations+=("$dest") amounts+=("$amt") ``` ```bash total_amount=0 for amt in "${amounts[@]}"; do total_amount=$(echo "$total_amount + $amt" | bc -l) done if (( $(echo "$total_balance < $total_amount" | bc -l) )); then echo -e "${RED}Error: Insufficient balance${NC}" >&2 echo "Need at least $total_amount USDC, but only have $total_balance USDC" >&2 ex ...[truncated 2734 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate every amount, balance, interval, and threshold before arithmetic or transaction processing. 2. Use a bounded decimal grammar, for example: ```bash is_amount() { [[ "$1" =~ ^(0|[1-9][0-9]*)(\.[0-9]{1,6})?$ ]] } ``` 3. Reject negative values, scientific notation, interpreter operators, NaN-like values, blank fields, and values above documented limits. 4. Convert validated currency values into integer micro-units or another fixed smallest denomination and perform integer arithmetic in the shell or a purpose-built parser. 5. Validate JSON fields by type and range rather than trusting `jq -r` output. 6. Abort the entire batch if any row is malformed; do not silently skip malformed financial records. 7. Validate option arity before reading `$2`, providing a controlled error when an option value is missing. 8. If `bc` must be retained, pass only previously validated numeric strings and use a restricted, known implementation without shell escape extensions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/auto-fund.sh:207
• Finding: Auto-Fund Maximum Balance Is Not Enforced Before Funding<![CDATA[ ## Vulnerability Details **File Location**: `scripts/auto-fund.sh:207-212` and `scripts/auto-fund.sh:244-247` **Vulnerability Type**: Financial safety control bypass **Risk Level**: High ### Vulnerable Code ```bash # Check if new balance would exceed maximum if ! compare_balance "$new_balance" "$MAX_BALANCE"; then echo -e "${YELLOW}⚠️ Warning: New balance ($new_balance USDC) would exceed maximum ($MAX_BALANCE USDC)${NC}" echo " Consider reducing --fund-amount or increasing --max-balance" echo "" fi ``` Execution continues to the funding operation: ```bash # Execute funding echo -e "${BLUE}💸 Funding account...${NC}" fund_result=$(grove fund "$FUND_AMOUNT" --network "$NETWORK" --json 2>&1) ``` The script also supports unattended confirmation bypass: ```bash --yes) SKIP_CONFIRM=true shift ;; ``` ### Technical Analysis The script calculates the projected balance and detects when funding would exceed `MAX_BALANCE`, but it only emits a warning. It neither exits nor caps the amount before calling `grove fund`. This is particularly hazardous because the documentation recommends `--yes` for cron usage. In that mode, there is no opportunity for a person to react to the warning. The script also accepts `FUND_AMOUNT` from a command-line argument without a hard upper bound. The existing earlier check only stops funding if the current balance is already at or above the maximum. It does not enforce the maximum against the projected post-funding balance. ### Attack Path 1. The script is configured with a low minimum balance and a fund amount that would place the account above `MAX_BALANCE`. 2. The current balance falls below the minimum, so the auto-funding branch is entered. 3. The script calculates that the projected balance exceeds the maximum. 4. It prints a warning but continues. 5. If run with `--yes`, as recommended for cron, no interactive approval is requested. 6. `grove fund` is called for the full configured amount. ...[truncated 758 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat `MAX_BALANCE` as an enforced limit, not an advisory warning. 2. Abort before any transaction when the projected balance exceeds the maximum: ```bash if projected_balance_exceeds_max; then echo "Refusing to fund above configured maximum" >&2 exit 1 fi ``` 3. Alternatively, calculate and fund only: ```text min(FUND_AMOUNT, MAX_BALANCE - current_balance) ``` 4. Reject zero, negative, malformed, or excessively large funding values. 5. Add a separate hard per-transaction cap that cannot be bypassed by `--yes`. 6. For scheduled use, require an explicit configuration file with restrictive permissions rather than accepting unrestricted cron-supplied values. 7. Record the requested amount, enforced amount, projected balance, network, and transaction result in an audit log. 8. Add tests covering equality, rounding boundaries, projected-limit violations, and very large values. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/batch-tip.sh:127
• Finding: Batch Tipping Does Not Enforce Per-Tip or Aggregate Payment Limits<![CDATA[ ## Vulnerability Details **File Location**: `scripts/batch-tip.sh:127-148`, `scripts/batch-tip.sh:198-218`, and `scripts/batch-tip.sh:233-242` **Vulnerability Type**: Insufficient validation and authorization controls for batch payments **Risk Level**: High ### Vulnerable Code Amounts are accepted when merely nonempty: ```bash # Validate if [[ -z "$dest" ]] || [[ -z "$amt" ]]; then echo -e "${YELLOW}⚠️ Line $line_num: Skipping invalid entry${NC}" continue fi destinations+=("$dest") amounts+=("$amt") ``` Only an aggregate balance comparison is performed: ```bash # Calculate total tip amount total_amount=0 for amt in "${amounts[@]}"; do total_amount=$(echo "$total_amount + $amt" | bc -l) done echo " Total balance: $total_balance USDC" echo " Total to tip: $total_amount USDC" echo "" if (( $(echo "$total_balance < $total_amount" | bc -l) )); then echo -e "${RED}Error: Insufficient balance${NC}" >&2 echo "Need at least $total_amount USDC, but only have $total_balance USDC" >&2 exit 1 fi ``` The script then suppresses the CLI's per-payment confirmation: ```bash for i in "${!destinations[@]}"; do dest="${destinations[$i]}" amt="${amounts[$i]}" progress=$((i + 1)) printf " [%d/%d] Tipping %s → %s USDC... " "$progress" "$total_count" "$dest" "$amt" if grove tip "$dest" "$amt" --network "$NETWORK" --yes > /dev/null 2>&1; then echo -e "${GREEN}✓${NC}" results+=("✓ $dest") success_count=$((success_count + 1)) else echo -e "${RED}✗ Failed${NC}" results+=("✗ $dest") failed_count=$((failed_count + 1)) fi done ``` ### Technical Analysis The script validates whether destinations are tippable, but it does not establish that each amount is: - A valid positive decimal. - Within a safe per-recipient maximum. - Within a safe aggregate batch maximum. - Consistent with a trusted batch manifest. Before execution, the user is shown the total count and comp ...[truncated 1768 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce strict positive-decimal validation for every row before any network or payment operation. 2. Add configurable and mandatory limits for: - Maximum amount per tip. - Maximum aggregate amount per batch. - Maximum number of recipients. 3. Abort the entire batch if any row fails parsing or destination validation. 4. Display a complete itemized manifest containing destination, amount, network, and aggregate total before confirmation. 5. Bind approval to a digest of the parsed manifest so the underlying file cannot be changed between validation and execution. 6. Consider requiring a second confirmation for batches above a defined risk threshold. 7. Avoid passing `--yes` unless the script has independently enforced all authorization policy. 8. Provide a transaction journal and explicit retry mechanism so failed rows are not ambiguously repeated. 9. Use integer smallest-unit arithmetic for all totals and comparisons. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The content mentions monitoring and automation utilities that operate on live account state, write logs, and potentially trigger notifications, which is far broader than a simple guide. A misleading manifest reduces scrutiny and can cause long-running automation to be enabled without adequate risk acknowledgment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The content mentions monitoring and automation utilities that operate on live account state, write logs, and potentially trigger notifications, which is far broader than a simple guide. A misleading manifest reduces scrutiny and can cause long-running automation to be enabled without adequate risk acknowledgment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The content mentions monitoring and automation utilities that operate on live account state, write logs, and potentially trigger notifications, which is far broader than a simple guide. A misleading manifest reduces scrutiny and can cause long-running automation to be enabled without adequate risk acknowledgment.

External Script Fetching

High

• Category: Supply Chain

Content

version: "2.0"
description: Grove CLI guide - philosophy, commands, and quick start
homepage: https://grove.city
install: curl -fsSL https://grove.city/install-cli.sh | bash
updated: 2026-02-10
user-invocable: true
metadata:

• Confidence: 99% confidence
• Finding: The manifest's install command fetches and executes a remote shell script from the internet. This is a classic supply-chain and remote-code-execution risk because trust is delegated entirely to a mutable external resource at execution time.

Chaining Abuse

High

• Category: Tool Misuse

Content

version: "2.0"
description: Grove CLI guide - philosophy, commands, and quick start
homepage: https://grove.city
install: curl -fsSL https://grove.city/install-cli.sh | bash
updated: 2026-02-10
user-invocable: true
metadata:

• Confidence: 98% confidence
• Finding: Piping network-retrieved content directly into bash is dangerous command chaining because it combines download and execution with no inspection boundary. This eliminates opportunities for validation and makes compromise of the upstream source immediately exploitable.

External Script Fetching

High

• Category: Supply Chain

Content

**Requirements:**

- Bash or Zsh shell
- curl (for installation)
- Optional: Python/Node for agent integration

# Grove CLI — Complete Guide <!-- omit in toc -->

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Hidden Instructions

High

• Category: Prompt Injection

Content

- curl (for installation)
- Optional: Python/Node for agent integration

# Grove CLI — Complete Guide <!-- omit in toc -->

**Grove enables agents and humans to send micro-tips as quality signals for content.**

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Chaining Abuse

High

• Category: Tool Misuse

Content

### Installation

```bash
curl -fsSL https://grove.city/install-cli.sh | bash
```

**What gets installed:**

• Confidence: 98% confidence
• Finding: The installation section teaches the same unsafe download-to-shell pattern, reinforcing insecure operator behavior. In a skill meant for agents and humans, this is especially risky because agents may automate the exact chain without review.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The guide directs storage of a wallet private key in ~/.grove/keyfile.txt without any security warning, access-control guidance, or mention of encryption. Plaintext private key storage materially increases the risk of credential theft from local compromise, backups, logs, or permissive file permissions.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# 1. Install
curl -fsSL https://grove.city/install-cli.sh | bash

# 2. Create wallet + fund it
grove setup    # Choose option 2: Wallet + Crypto

• Confidence: 99% confidence
• Finding: The quick-start section repeats the pattern of downloading and executing a remote installer in one step. Repetition in the operational path increases the likelihood that users or agents will execute unverified code without scrutiny.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# 1. Install
curl -fsSL https://grove.city/install-cli.sh | bash

# 2. Create wallet + fund it
grove setup    # Choose option 2: Wallet + Crypto

• Confidence: 98% confidence
• Finding: The agent wallet mode quick start again uses chained remote script execution, now in a context that leads directly into wallet creation and funding. That combination heightens impact because compromised installer code could immediately target credentials or funds.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This skill is described as a CLI guide/documentation aid, but the script performs real financial operations by automatically funding a Grove account. That mismatch is dangerous because users may trust or run the skill expecting passive guidance, while it can move funds from a local wallet and trigger on-chain transactions.

External Script Fetching

High

• Category: Supply Chain

Content

# Check if grove CLI is available
if ! command -v grove &> /dev/null; then
    echo -e "${RED}Error: grove CLI not found${NC}" >&2
    echo "Install with: curl -fsSL https://grove.city/install-cli.sh | bash" >&2
    exit 1
fi

• Confidence: 90% confidence
• Finding: The script instructs users to install the CLI via a 'curl | bash' pipeline, which executes remote code directly without prior verification. If the remote host, connection, or served script is compromised, users could execute arbitrary code on their machine, which is especially serious in a skill that also interacts with wallet material and funding flows.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script autonomously decides when to fund based on balance thresholds and is designed for cron-driven repeated execution, which creates unattended spending behavior. In the context of a CLI guide skill, this capability is unjustified and increases the chance of unintended or excessive funding if balances are misread, outputs are spoofed, or the environment is manipulated.

External Script Fetching

High

• Category: Supply Chain

Content

# Check if grove CLI is available
if ! command -v grove &> /dev/null; then
    echo -e "${RED}Error: grove CLI not found${NC}" >&2
    echo "Install with: curl -fsSL https://grove.city/install-cli.sh | bash" >&2
    exit 1
fi

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

# Check if grove CLI is available
if ! command -v grove &> /dev/null; then
    echo -e "${RED}Error: grove CLI not found${NC}" >&2
    echo "Install with: curl -fsSL https://grove.city/install-cli.sh | bash" >&2
    exit 1
fi

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This script performs real financial operations, including live balance checks and on-chain tipping, despite the skill being presented as a CLI guide/documentation asset. That mismatch is dangerous because users may treat it as informational helper content while it can move funds, increasing the risk of unintended transfers or social-engineered execution.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The script automates batch financial transfers using grove tip with --yes, which suppresses command-level confirmation and enables repeated payments from a file. In the context of a documentation/guide skill, this capability is unjustified and increases the likelihood of accidental or bulk unauthorized value transfer if a user runs it on untrusted or mistaken input.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements an active monitoring utility with logging, alerting, and a persistent loop, which materially exceeds the declared skill purpose of being a CLI guide/documentation resource. In an agent-skill context, hidden operational behavior increases attack surface and user surprise because a documentation skill is not expected to perform ongoing account-state monitoring.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: This code sends account balance data to an arbitrary user-supplied webhook, creating external data transmission that is not justified by a documentation-only skill. Even if intended for legitimate alerting, outbound egress from an unexpectedly included script can leak operational or financial information to third parties.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises shell-driven installation and operational workflows but does not declare any tool scope or allowed-tools boundaries. In an agent ecosystem, missing capability constraints increases the chance an agent executes shell commands unexpectedly, especially because the document includes install, setup, funding, and tipping commands.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill is presented as documentation, yet it contains concrete executable instructions for installation, wallet creation, account funding, and sending real tips. In agent contexts, documentation-like packaging around transactional behavior can induce execution without sufficient safety gating.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The manifest instructs users to pipe a remote script directly into bash, which executes unreviewed network content immediately with local shell privileges. If the remote server, transport, or script is compromised, this becomes a direct arbitrary code execution path.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The guide includes handling of sensitive wallet material and autonomous funding/tipping workflows, which materially expands the skill's security footprint beyond a basic CLI reference. Exposure or misuse of wallet keys and unattended funding logic can directly lead to asset loss.

Session Persistence

Medium

• Category: Rogue Agent

Content

# 1. Install
curl -fsSL https://grove.city/install-cli.sh | bash

# 2. Create wallet + fund it
grove setup    # Choose option 2: Wallet + Crypto

# 3. Start tipping

• Confidence: 78% confidence
• Finding: The workflow encourages persistent local wallet state and ongoing funded usage, which creates session persistence around sensitive financial capabilities. In agent contexts, persistent credentials and funded wallets enlarge the blast radius of later compromise or unintended invocation.

Static analysis

No suspicious patterns detected.