Security audit

Ika Cli

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Ika CLI guide, but it needs Review because it documents high-impact wallet and signing workflows while under-warning users about exposed secrets and irreversible sharing actions.

Install only if you understand that this skill helps agents operate a real crypto-signing CLI. Avoid putting mnemonics, seeds, secret shares, or decryption keys in prompts, command arguments, shell history, logs, or JSON pipelines; use protected files or a keystore where possible, verify install artifacts, and review every transaction or make-public operation before execution.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: references/commands.md:305
Finding: Secret seed and decryption key are exposed through standard output
Content: View full analysis
] ``` Outputs encryption key (public), decryption key (secret), signer public key, and seed. ``` From `references/json-output.md:87-95`: ```markdown ## `ika dwallet generate-keypair --json` ```json { "type": "keypair", "encryption_key": "hex...", "decryption_key": "hex...", "signer_public_key": "hex...", "seed": "hex..." } ``` ``` ### Technical Analysis The documented `generate-keypair` behavior returns the secret decryption key and derivation seed through standard output, including in machine-readable JSON. Standard output is not an appropriate secret-delivery channel because it is commonly retained by: - Agent conversation and tool-call transcripts - CI/CD job logs - Terminal recording and observability systems - Shell redirection and debugging infrastructure - Automation that collects JSON command results - Clipboard or support-ticket workflows The seed is especially sensitive because the documentation states that encryption keys are deterministically derived from seed material. Disclosure may therefore allow reconstruction of the associated encryption identity. Disclosure of the decryption key directly compromises data protected for that identity. This behavior exceeds the minimum output necessary for ordinary automation. Public keys and a reference to securely stored secret material would normally be sufficient. ### Attack Path 1. A user or Agent runs `ika dwallet generate-keypair --json`. 2. The CLI writes the plaintext seed and d ...[truncated 1013 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:216
Finding: Wallet mnemonic is documented as a command-line argument
Content: View full analysis
# Import key from mnemonic ``` ``` ### Technical Analysis The example directs the user to replace `` with wallet recovery material directly on the command line. Command-line arguments are an unsafe channel for high-value credentials because they may be exposed through: - Shell history files - Process inspection utilities and operating-system telemetry - Terminal recording - Agent prompts and execution transcripts - Audit logs and endpoint monitoring - Copy-and-paste history - Error reports that reproduce the command A mnemonic generally provides deterministic recovery of the associated wallet keys. Unlike a password that can be rotated independently, disclosure may permanently compromise all accounts derived from the recovery phrase unless assets and authority are migrated. ### Attack Path 1. A user or Agent follows the example and substitutes a real recovery mnemonic for ``. 2. The shell records the command in its history, or an Agent runtime records it in a transcript. 3. Alternatively, local process monitoring captures the command-line arguments while the command runs. 4. An attacker obtains access to the history, transcript, telemetry, or process data. 5. The attacker extracts the mnemonic and imports it into another compatible wallet. 6. The attacker can sign transactions for accounts derived from the mnemonic and may transfer assets or exercise associated on-chain authority. ### Impact Assessment Mnemonic disclosure may grant complete cryptographic control over the associated wallet identities, inc ...[truncated 450 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:26
Finding: CLI installation instructions use unpinned and unverified external artifacts
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example writes sensitive secret-share material to a local file (--output-secret ./my_dwallet_secret.bin) without any warning about file permissions, secure storage, backup, or deletion. This can lead to theft of cryptographic material through accidental exposure, insecure backups, shared workstations, or inclusion in source control.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill documents supplying secret-share material either from a local file or directly via --secret-share-hex <hex> without warning that command-line arguments may be exposed through shell history, process listings, logs, and telemetry. In a crypto-signing context, disclosure of this material can directly compromise control over dWallet operations or enable unauthorized signing workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The ika dwallet share make-public command explicitly makes user secret key shares public, yet the documentation gives no warning that this materially changes the trust and signing model by enabling autonomous signing. Without an explicit caution, users may invoke it without understanding that they are weakening confidentiality and potentially expanding who or what can cause signatures to be produced.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation shows ika dwallet generate-keypair --json returning decryption_key and seed directly in JSON output, which are highly sensitive secrets. In a CLI/MCP/automation context, users commonly pipe JSON to logs, files, shell history, or downstream tools, so presenting these fields without an explicit warning or safer handling guidance materially increases the risk of credential leakage and key compromise.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
md
| `--client.config <PATH>` | Custom Sui client config path | | `--ika-config <PATH>` | Custom Ika network config path (default for all dwallet subcommands) | | `--gas-budget <MIST>` | Override default gas budget (default for all dwallet subcommands) | | `-y, --yes` | Skip confirmation prompts | | `-q, --quiet` | Suppress human-readable output (JSON still printed with `--json -q`) | ## Command Overview

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file documents -y, --yes as skipping confirmation prompts, while the skill also covers operations such as dWallet creation, validator changes, config initialization, and committee actions. The document does not warn users that bypassing confirmations can increase the risk of unintended or irreversible changes affecting wallets, configuration, or network state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The command reference states that ika dwallet generate-keypair outputs a decryption key, signer public key, and seed, but provides no explicit warning that the decryption key and seed are highly sensitive secrets that must not be logged, copied into shell history, or stored insecurely. In a CLI skill used by agents or operators, this omission is dangerous because users may run the command in unsafe environments and accidentally expose material that enables compromise of wallet-related operations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.