Rydberg Agent Node

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:08 AM UTC
• Version: 2.5.1

Overview

This skill is purpose-aligned for deploying a blockchain agent node, but it handles credentials and remote code in ways that warrant careful review before installation.

Install only if you are comfortable running a hot local blockchain node from ProbeChain release artifacts. Use a dedicated low-value testnet account and machine profile where possible, do not reuse passwords, treat ~/rydberg-agent/password.txt and the keystore as sensitive, and review the generated start-bg.sh before running it. The skill should ideally pin immutable releases, validate bootnode data, avoid persistent plaintext passwords, and use short-lived unlocks.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:159

Finding

Unvalidated Remote Bootnode Data Is Injected into an Executable Shell Script

Content

View full analysis

~/rydberg-agent/start-bg.sh << 'SCRIPT' #!/usr/bin/env bash cd ~/rydberg-agent ./gprobe \ --datadir ./data \ --networkid 8004 \ --port 30398 \ --http --http.addr 127.0.0.1 --http.port 8549 \ --http.api "probe,net,web3,pob,txpool" \ --http.corsdomain "http://localhost:*" \ --consensus pob \ --miner.probebase ADDR_PLACEHOLDER \ --password ./password.txt \ --ipcpath ~/rydberg-agent/gprobe.ipc \ --bootnodes "ENODE_PLACEHOLDER" \ --verbosity 3 > node.log 2>&1 & ./gprobe attach ~/rydberg-agent/gprobe.ipc --exec "admin.addPeer('ENODE_PLACEHOLDER')" 2>/dev/null SCRIPT sed -i.bak "s|ADDR_PLACEHOLDER|$ADDR|g; s|ENODE_PLACEHOLDER|$ENODE|g" ~/rydberg-agent/start-bg.sh rm -f ~/rydberg-agent/start-bg.sh.bak chmod +x ~/rydberg-agent/start-bg.sh ``` ### Technical Analysis The first line of the remotely hosted `bootnodes.txt` file is assigned to `ENODE` and substituted directly into an executable shell script using `sed`. The value is not validated against the expected enode URI syntax and is not escaped for either of the contexts in which it is embedded: 1. A double-quoted shell argument to `--bootnodes`. 2. A quoted JavaScript expression supplied to the local IPC console. Although the URL uses HTTPS and references a release tag, the tag and repository remain under upstream control. A release tag is not necessarily an immutable commit. If the repository, maintainer account, tag, or retrieved file ...[truncated 1518 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:94

Finding

Mutable Remote Executable Code Is Built or Installed Without Independent Trust Verification

Content

View full analysis

/dev/null && [ -n "$SIG_URL" ] && [ -n "$PUBKEY_URL" ]; then curl -sSL "$PUBKEY_URL" -o probechain-gpg-public.asc curl -sSL "$SIG_URL" -o SHA256SUMS.asc gpg --import probechain-gpg-public.asc 2>/dev/null gpg --verify SHA256SUMS.asc SHA256SUMS 2>/dev/null || { echo "ERROR: GPG signature verification failed" rm -f gprobe-darwin-arm64.tar.gz SHA256SUMS* exit 1 } rm -f probechain-gpg-public.asc SHA256SUMS.asc fi shasum -a 256 --check --ignore-missing SHA256SUMS || { echo "ERROR: checksum verification failed" rm -f gprobe-darwin-arm64.tar.gz SHA256SUMS ...[truncated 3085 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:85

Finding

Plaintext Wallet Password Is Retained and Exposed in Process Arguments While the Account Is Unlocked Indefinitely

Content

View full analysis

password.txt) unset NODE_PWD ``` ```bash # Create account ./gprobe --datadir ./data account new --password password.txt ``` ```bash ./gprobe \ --datadir ./data \ --networkid 8004 \ --port 30398 \ --http --http.addr 127.0.0.1 --http.port 8549 \ --http.api "probe,net,web3,pob,txpool" \ --http.corsdomain "http://localhost:*" \ --consensus pob \ --miner.probebase ADDR_PLACEHOLDER \ --password ./password.txt \ --ipcpath ~/rydberg-agent/gprobe.ipc \ --bootnodes "ENODE_PLACEHOLDER" \ --verbosity 3 > node.log 2>&1 & ``` ```bash # Unlock account via local IPC (not exposed over HTTP) ./gprobe attach ~/rydberg-agent/gprobe.ipc --exec \ "personal.unlockAccount('ADDR_PLACEHOLDER', '$(cat password.txt)', 0)" 2>/dev/null ``` ### Technical Analysis The Skill stores the account password in plaintext at `~/rydberg-agent/password.txt` and does not remove it after account creation or startup. The use of `umask 077` appropriately restricts the file at creation, but it does not protect the credential from processes running as the same user, later permission changes, user-level malware, backups, or accidental disclosure. The command substitution `$(cat password.txt)` inserts the secret directly into the argument passed to `gprobe attach`. Depending on operating-system process inspection controls and timing, command-line arguments may be observable through process listings or process metadata. The account is unlocked using duration `0`, which conventionally represents an indefinite unlock. This exceeds the minimum privilege necessary for a one-time registration ...[truncated 1717 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill stores the node password in plaintext on disk as password.txt, creating a durable local secret that can be read by malware, backups, other processes running as the user, or accidental disclosure. Even with umask 077, plaintext-at-rest credentials materially increase credential theft risk.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

# Securely save password (restricted permissions, never echoed to terminal)
read -sp "Enter node password (min 6 chars): " NODE_PWD && echo
(umask 077; printf '%s' "$NODE_PWD" > password.txt)
unset NODE_PWD

# Detect OS and download binary

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

curl -sSL "$PUBKEY_URL" -o probechain-gpg-public.asc
        curl -sSL "$SIG_URL" -o SHA256SUMS.asc
        gpg --import probechain-gpg-public.asc 2>/dev/null
        gpg --verify SHA256SUMS.asc SHA256SUMS 2>/dev/null || { echo "ERROR: GPG signature verification failed"; rm -f gprobe-darwin-arm64.tar.gz SHA256SUMS*; exit 1; }
        echo "GPG signature verified (ProbeChain <[e-mail]>)"
        rm -f probechain-gpg-public.asc SHA256SUMS.asc
    fi

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

curl -sSL "$PUBKEY_URL" -o probechain-gpg-public.asc
        curl -sSL "$SIG_URL" -o SHA256SUMS.asc
        gpg --import probechain-gpg-public.asc 2>/dev/null
        gpg --verify SHA256SUMS.asc SHA256SUMS 2>/dev/null || { echo "ERROR: GPG signature verification failed"; rm -f gprobe-darwin-arm64.tar.gz SHA256SUMS*; exit 1; }
        echo "GPG signature verified (ProbeChain <[e-mail]>)"
        rm -f probechain-gpg-public.asc SHA256SUMS.asc
    fi

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md

fi
    shasum -a 256 --check --ignore-missing SHA256SUMS || { echo "ERROR: checksum verification failed"; rm -f gprobe-darwin-arm64.tar.gz SHA256SUMS; exit 1; }
    rm -f SHA256SUMS
    tar xzf gprobe-darwin-arm64.tar.gz && rm -f gprobe-darwin-arm64.tar.gz
    chmod +x gprobe
else
    # All other platforms: build from source using pinned release tag

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md

fi
    shasum -a 256 --check --ignore-missing SHA256SUMS || { echo "ERROR: checksum verification failed"; rm -f gprobe-darwin-arm64.tar.gz SHA256SUMS; exit 1; }
    rm -f SHA256SUMS
    tar xzf gprobe-darwin-arm64.tar.gz && rm -f gprobe-darwin-arm64.tar.gz
    chmod +x gprobe
else
    # All other platforms: build from source using pinned release tag

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

Using a plaintext password file for account creation reinforces insecure secret handling and leaves credential material available on disk beyond the initial setup phase. In a deployment skill that also starts long-lived services, this creates ongoing credential exposure.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md

curl -sSL "https://raw.githubusercontent.com/${REPO}/${RELEASE_TAG}/genesis.json" -o genesis.json

# Create account
./gprobe --datadir ./data account new --password password.txt

# Initialize genesis
./gprobe --datadir ./data init genesis.json

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

Passing --password ./password.txt to the node startup path means the long-running service depends on a plaintext password file remaining on disk. This turns a one-time secret into persistent standing access for local attackers to unlock and control the account.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md

--http.corsdomain "http://localhost:*" \
  --consensus pob \
  --miner.probebase ADDR_PLACEHOLDER \
  --password ./password.txt \
  --ipcpath ~/rydberg-agent/gprobe.ipc \
  --bootnodes "ENODE_PLACEHOLDER" \
  --verbosity 3 > node.log 2>&1 &

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The script interpolates $(cat password.txt) directly into an IPC command that unlocks the account indefinitely with duration 0. This exposes the password to script contents and process/runtime artifacts and creates a permanently unlocked account, significantly increasing the blast radius of any local compromise.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md

./gprobe attach ~/rydberg-agent/gprobe.ipc --exec "admin.addPeer('ENODE_PLACEHOLDER')" 2>/dev/null

# Unlock account via local IPC (not exposed over HTTP)
./gprobe attach ~/rydberg-agent/gprobe.ipc --exec "personal.unlockAccount('ADDR_PLACEHOLDER', '$(cat password.txt)', 0)" 2>/dev/null

# Start mining via IPC
./gprobe attach ~/rydberg-agent/gprobe.ipc --exec "miner.start(1)" 2>/dev/null

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

SCRIPT

sed -i.bak "s|ADDR_PLACEHOLDER|$ADDR|g; s|ENODE_PLACEHOLDER|$ENODE|g" ~/rydberg-agent/start-bg.sh rm -f ~/rydberg-agent/start-bg.sh.bak chmod +x ~/rydberg-agent/start-bg.sh

text

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrase "deploy rydberg validator" materially misrepresents what the skill does, because the skill explicitly deploys an Agent node and performs installation, registration, and background execution. This can cause unintended activation for users seeking different behavior and increases the chance the agent will run invasive system actions under an ambiguous request.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The declared permissions include outbound network access and system command execution, which are high-risk capabilities in a skill that downloads software and launches a node. In context, these capabilities are expected for deployment, but they still expand the attack surface and warrant strong guardrails and explicit consent.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

- network:outbound
  - system:exec
requirements:
  - curl
  - tar
  - shasum
  - git (source build only)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill does not prominently disclose upfront that it will execute shell commands, write secrets and binaries to disk, fetch remote content, and launch a background node process. That omission weakens informed consent and makes potentially risky behavior easier to trigger without the user understanding the consequences.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The skill fetches release metadata from GitHub at runtime and then uses that data to select code to download or source to build. Because trust is rooted in a live network response and source tags rather than a pinned artifact digest or independently trusted key, a compromised upstream, release process, or repo could supply malicious code for execution.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

REPO="ProbeChain/Rydberg-Mainnet"

# Fetch latest release metadata from the official ProbeChain GitHub organization
RELEASE_JSON=$(curl -sSL "https://api.github.com/repos/${REPO}/releases/latest")
RELEASE_TAG=$(echo "$RELEASE_JSON" | grep '"tag_name"' | head -1 | cut -d'"' -f4)

if [ "$OS" = "Darwin" ] && [ "$ARCH" = "arm64" ]; then

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The start script fetches the latest release tag again at runtime to obtain bootnode data, creating mutable remote dependency after installation. This allows network-supplied configuration to influence peer connectivity and node behavior without strong authenticity guarantees beyond GitHub transport.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md

# Fetch official bootnode pinned to release tag (immutable reference)
REPO="ProbeChain/Rydberg-Mainnet"
RELEASE_TAG=$(curl -sSL "https://api.github.com/repos/${REPO}/releases/latest" | grep '"tag_name"' | head -1 | cut -d'"' -f4)
ENODE=$(curl -sSL "https://raw.githubusercontent.com/${REPO}/${RELEASE_TAG}/bootnodes.txt" | head -1)

cat > ~/rydberg-agent/start-bg.sh << 'SCRIPT'

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The trigger set lacks boundaries for when the skill should not activate, despite the skill performing privileged operations like executing shell commands, downloading code, and starting a persistent service. Broad activation criteria increase the risk of accidental invocation and unintended system modification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The instruction "Always reply in the user's language (Chinese if Chinese)" sets a language behavior rule rather than offering a user choice. While mild, it still hardcodes locale handling instead of explicitly asking or allowing opt-in when language preference is ambiguous.

Content

No source excerpt is available for this finding.