T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.sh:49- Finding
Arbitrary Code Execution Through Python Source Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Kasia
Security checks for vulnerabilities and agentic risk
Overview
This Kaspa messaging skill is purpose-aligned, but its setup and background polling guidance create avoidable wallet-secret, local-code-execution, and persistence risks that users should review before installing.
Install only if you are comfortable with a wallet-connected tool. Use a dedicated wallet with minimal funds, avoid passing a seed phrase on the command line, review and lock down mcporter.json permissions, only point setup.sh at a trusted kasia-mcp checkout, and do not enable background polling unless you explicitly choose its schedule, storage location, retention, and removal process.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T08 · Insecure Dependencies
Error
- Location
scripts/setup.sh:26- Finding
Automatic Execution of Scripts From a Caller-Supplied npm Project
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.sh:49- Finding
Wallet Mnemonic Exposed Through Command-Line Input and Plaintext Configuration
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Error
- Location
SKILL.md:70- Finding
Documentation Encourages Unbounded Cross-Session Background Polling
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script accepts a wallet mnemonic via a command-line argument and then persists it into the mcporter configuration as an environment variable. This is dangerous because command-line arguments may be exposed via shell history or process listings, and the mnemonic is then stored in plaintext on disk, directly risking wallet compromise if the host or config file is accessed.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill invokes external tooling and explicitly instructs creating a polling script that writes message data to a file, but it does not declare any tool scope such as allowed-tools or permissions. That mismatch weakens auditability and least-privilege controls, making it easier for an agent or operator to grant broader capabilities than intended, especially where file writes and blockchain actions are involved.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill promotes encrypted on-chain messaging and private-data storage but does not warn that blockchain writes are persistent, visible at the metadata layer, and cost money. Even if content is encrypted, addresses, timing, counterparties, message frequency, and any mis-stored data may create lasting privacy exposure, while users may also incur irreversible transaction costs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The setup instructions tell users to supply a wallet mnemonic on the command line and note that a wallet mnemonic or private key is configured in mcporter, but they do not warn that these are highly sensitive secrets. Command-line arguments, shell history, process listings, logs, or config files may expose the mnemonic/private key, which could let an attacker steal the wallet and impersonate the user on-chain.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script creates or modifies the mcporter configuration automatically without prompting the user for confirmation. While this is common setup behavior, it can unexpectedly alter local tool configuration and trust boundaries, especially because this skill configures a messaging/payment-related MCP server that may later handle sensitive wallet operations.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The protocol reference directs use of a default third-party indexer and documents address-based query endpoints, but it does not warn that querying these services exposes wallet addresses, timing, aliases/scopes, and conversation/payment metadata to an external operator. Even if message contents are encrypted, this can still leak relationship and activity patterns, which is a real privacy risk in a messaging skill centered on confidential communication.
- Content
Static analysis
No suspicious patterns detected.