Security audit
trip-protocol
Security checks for vulnerabilities and agentic risk
Overview
The skill largely does what it claims (temporarily rewrite SOUL.md), but its runtime scripts expect access to private wallet material and call third‑party endpoints that are not declared in the registry metadata, and there are several inconsistencies in scheduling/markers — proceed only after manual review and sandboxing.
This skill will modify your SOUL.md and uses a blockchain-NFT flow, but it also expects access to your agent's wallet material (keystore or private key) and posts trip metadata to external services. Things that don't add up: the registry claims no credentials required but the scripts call cast wallet commands and read TRIP_PRIVATE_KEY / a keystore password file; schedule-restore.sh writes .marker files while check-restores.sh expects trip-restore-*.json; SKILL.md uses a third‑party faucet (agents.devnads.com) not explained in the description. Before installing: - Do not provide your private key or keystore password to this skill until you manually audit the code and understand how keys are used. Prefer not to set TRIP_PRIVATE_KEY at all. Use a throwaway test wallet on a testnet if you want to try it. - Inspect the GitHub repo and confirm the author and release are trustworthy. The manifest includes shell scripts; review them line-by-line or run in a disposable VM/container. - Remove or change default TRIP_API_KEY and check what Convex endpoint will receive (it will be sent wallet and tx info and journals). If you don’t want data posted externally, unset CONVEX_SITE_URL/TRIP_API_KEY or modify scripts to disable POSTs. - Test with --dry-run first. Use the consume.sh dry-run flag to exercise the flow without sending transactions. - Fix the scheduling mismatch or require the agent to use a single scheduling mechanism (marker vs JSON) so restores are reliable. - Prefer running this in an isolated agent workspace with backups of SOUL.md; verify safeword handling by exercising safeword-check.sh in a sandbox. Given the key access and external communication that are not declared in metadata and the scheduling inconsistencies, I recommend treating this skill as suspicious until you or a security/technical reviewer confirm it’s safe for your agent.
SkillSpector findings are pending for this release.