Security audit

risk art agent

Security checks for vulnerabilities and agentic risk

Overview

This is a real-looking Bankr crypto and LLM integration, but it needs review because it can perform irreversible wallet actions and persists powerful credentials.

Install only if you intentionally want Bankr to access a dedicated, limited-funds crypto wallet and LLM gateway. Prefer read-only keys unless transactions are required, use separate Agent and LLM keys, enable IP allowlisting where possible, avoid copying keys into shell or IDE config, pin or verify the CLI package before global install, and require explicit human review before any trade, transfer, signature, automation, or raw transaction submission.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:52
Finding: Unpinned Global Installation of a Wallet-Authorized CLI Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:110
Finding: API Keys Exposed Through Command-Line Arguments and Diagnostic Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/safety.md:127
Finding: Plaintext High-Authority Credentials Persisted Across CLI, Agent, IDE, and Shell Configuration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (62)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill advertises high-risk financial capabilities like crypto transfers, leverage, betting, token deployment, and raw transaction signing without an upfront warning in the manifest-level description. Because routing and selection may happen before a user sees deeper safety text, users and orchestrators may invoke a dangerous capability without immediately understanding the risk profile.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 89% confidence
Finding: The skill documents a destructive authenticated action, DELETE /agent/profile, without showing any additional safety controls such as explicit user-confirmation requirements, dry-run behavior, or anti-automation safeguards. In an agent setting, exposing deletion-capable operations via natural-language workflows increases the risk that ambiguous prompts, prompt injection, or mistaken tool use could delete a user's public profile unintentionally.
Content: Scanner excerpt · references/agent-profiles.md (reported line 119)May include surrounding context.
}

text
### DELETE /agent/profile Delete the authenticated user's profile. Returns `{ "success": true }`.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · references/api-workflow.md (reported line 251)May include surrounding context.
done

text
## Output Guidelines ### Response Formatting

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · references/llm-gateway.md (reported line 210)May include surrounding context.
bankr llm claude

Pass any Claude Code flags through

bankr llm claude --model claude-sonnet-4.6 bankr llm claude --allowedTools Edit,Write,Bash bankr llm claude --resume

text

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · references/sign-submit-api.md (reported line 129)May include surrounding context.
nTransaction| Missing transaction | | 401 |Authentication required| Missing or invalid API key | | 403 |Agent API access not enabled` | API key lacks agent access |

POST /agent/submit

Submit raw transactions directly to the blockchain.

Request Body

json
{ "transaction": { "to": "0x...", "chainId": 8453, "value": "1000000000000000000", "data": "0x..." }, "description": "Transfer 1 ETH", "waitForConfirmation": true }

Transaction Fields

Field Type Required Description
to string Yes Destination address
chainId number Yes Chain ID (8453=Base, 1=Ethereum, 137=Polygon)
value string No Value in wei (as string)
data string No Calldata (hex string)
gas string No Gas limit
gasPrice string No Legacy gas price
maxFeePerGas string No EIP-1559 max fee
maxPriorityFeePerGas string No EIP-1559 priority fe

Field	Type	Required	Description
`to`	string	Yes	Destination address
`chainId`	number	Yes	Chain ID (8453=Base, 1=Ethereum, 137=Polygon)
`value`	string	No	Value in wei (as string)
`data`	string	No	Calldata (hex string)
`gas`	string	No	Gas limit
`gasPrice`	string	No	Legacy gas price
`maxFeePerGas`	string	No	EIP-1559 max fee
`maxPriorityFeePerGas`	string	No	EIP-1559 priority fe

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The invocation text is extremely broad and overlaps with many common user intents, including wallets, transfers, trading, LLM access, and raw transaction signing. In an agent routing system, this can cause over-selection of a high-privilege skill, increasing the chance that unrelated or ambiguous user requests get sent to a tool that can move funds or sign transactions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
All requests require an X-API-Key header:

bash
curl -X POST "https://api.bankr.bot/agent/prompt" \ -H "X-API-Key: bk_YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"prompt": "What is my ETH balance?"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.
bash
# Start — the response includes a threadId curl -X POST "https://api.bankr.bot/agent/prompt" \ -H "X-API-Key: $BANKR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"prompt": "What is the price of ETH?"}'

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The skill explicitly encourages persistent dedicated agent wallets and stored API credentials for autonomous use. While operationally useful, session persistence combined with trading, signing, and submission capabilities increases blast radius if the host, config file, or agent workflow is compromised.
Content: Scanner excerpt · SKILL.md (reported line 481)May include surrounding context.
md
## Safety & Access Control **Dedicated Agent Wallet**: When building autonomous agents, create a separate Bankr account rather than using your personal wallet. This isolates agent funds — if a key is compromised, only the agent wallet is exposed. Fund it with limited amounts and replenish as needed. **API Key Types**: Bankr uses a single key format (`bk_...`) with capability flags (`agentApiEnabled`, `llmGatewayEnabled`). You can optionally configure a separate LLM Gateway key via `bankr config set llmKey` or `BANKR_LLM_KEY` — useful when you want independent revocation or different permissions for agent vs LLM access.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 94% confidence
Finding: The documentation explicitly notes that /agent/submit executes transactions immediately with no confirmation prompt. In a system that supports autonomous agents and natural-language requests, absence of an enforced confirmation step for irreversible on-chain actions creates a direct path to accidental or malicious fund transfer.
Content: Scanner excerpt · SKILL.md (reported line 495)May include surrounding context.
md
- Store keys in environment variables (`BANKR_API_KEY`, `BANKR_LLM_KEY`), never in source code - Add `~/.bankr/` and `.env` to `.gitignore` — the CLI stores credentials in `~/.bankr/config.json` - Test with small amounts on low-cost chains (Base, Polygon) before production use - Use `waitForConfirmation: true` with `/agent/submit` — transactions execute immediately with no confirmation prompt - Rotate keys periodically and revoke immediately if compromised at [bankr.bot/api](https://bankr.bot/api) **Reference**: [references/safety.md](references/safety.md)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: The sign endpoint can transmit signing requests to a remote service and produce legally/financially meaningful signatures. In a crypto skill, this is materially risky because signatures can enable approvals, token spending, delegated actions, or transaction authorization without the user fully understanding the payload.
Content: Scanner excerpt · SKILL.md (reported line 737)May include surrounding context.
bash
# Sign a plain text message curl -X POST "https://api.bankr.bot/agent/sign" \ -H "X-API-Key: $API_KEY" \ -H "Content-Type: application/json" \ -d '{"signatureType": "personal_sign", "message": "Hello, Bankr!"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: The sign endpoint can transmit signing requests to a remote service and produce legally/financially meaningful signatures. In a crypto skill, this is materially risky because signatures can enable approvals, token spending, delegated actions, or transaction authorization without the user fully understanding the payload.
Content: Scanner excerpt · SKILL.md (reported line 737)May include surrounding context.
bash
# Sign a plain text message curl -X POST "https://api.bankr.bot/agent/sign" \ -H "X-API-Key: $API_KEY" \ -H "Content-Type: application/json" \ -d '{"signatureType": "personal_sign", "message": "Hello, Bankr!"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: EIP-712 typed-data signing is especially dangerous because malicious permits, order signatures, or delegation approvals can be hard for non-experts to interpret while still authorizing asset movement or control. In this skill's context, exposing such capability through natural-language tooling substantially raises phishing and prompt-manipulation risk.
Content: Scanner excerpt · SKILL.md (reported line 743)May include surrounding context.
md
-d '{"signatureType": "personal_sign", "message": "Hello, Bankr!"}' # Sign EIP-712 typed data (permits, orders) curl -X POST "https://api.bankr.bot/agent/sign" \ -H "X-API-Key: $API_KEY" \ -H "Content-Type: application/json" \ -d '{"signatureType": "eth_signTypedData_v4", "typedData": {...}}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: Signing transactions, even without immediate broadcast, can create pre-authorized payloads ready for submission elsewhere. Because the skill also supports raw transaction submission and agent-driven workflows, this capability can be chained into irreversible fund loss if a malicious or mistaken prompt generates a harmful transaction.
Content: Scanner excerpt · SKILL.md (reported line 749)May include surrounding context.
md
-d '{"signatureType": "eth_signTypedData_v4", "typedData": {...}}' # Sign a transaction without broadcasting curl -X POST "https://api.bankr.bot/agent/sign" \ -H "X-API-Key: $API_KEY" \ -H "Content-Type: application/json" \ -d '{"signatureType": "eth_signTransaction", "transaction": {"to": "0x...", "chainId": 8453}}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The submit endpoint enables direct raw transaction broadcasting to the blockchain, which is irreversible and can transfer assets or execute arbitrary contract calldata. In an LLM-mediated skill, combining natural-language intent parsing with arbitrary transaction submission creates a very high-risk path for accidental or manipulated fund movement.
Content: Scanner excerpt · SKILL.md (reported line 761)May include surrounding context.
bash
# Submit a raw transaction curl -X POST "https://api.bankr.bot/agent/submit" \ -H "X-API-Key: $API_KEY" \ -H "Content-Type: application/json" \ -d '{

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes Bankr as a crypto trading agent and LLM gateway for wallets, transactions, NFTs, leverage, betting, token deployment, automation, and raw transaction signing/submission. This file additionally documents creation, update, and deletion of public agent profile pages and project updates, which is a distinct social/content management capability not reflected in the manifest description.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 876)May include surrounding context.
Create profile:

bash
curl -X POST "https://api.bankr.bot/agent/profile" \ -H "X-API-Key: $BANKR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"projectName": "My Agent", "tokenAddress": "0x...", "description": "An AI trading agent"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-workflow.md (reported line 40)May include surrounding context.
Request:

bash
curl -X POST "https://api.bankr.bot/agent/prompt" \ -H "X-API-Key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"prompt": "What is my ETH balance?"}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The workflow includes examples for token swaps and other trading actions without an explicit warning that these operations can be irreversible and financially risky. In a crypto-trading skill, users may copy these patterns directly, so omission of a confirmation/risk warning increases the chance of accidental loss even if no malicious behavior is present.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This reference file instructs users on setting automated trading actions, including limit orders, stop losses, DCA, TWAP, and scheduled commands, but it does not clearly warn that these actions can execute later without further confirmation and may create real financial loss. In a crypto trading skill that supports live asset transfers and order execution, omission of explicit risk, auto-execution, and balance/gas consequences can cause users to trigger unintended or poorly understood financial actions.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The docs explicitly advertise bankr llm credits add 25 -y to skip confirmation and also encourage auto top-up from a wallet. In a finance-linked skill, reducing friction around spending actions increases the risk of unintended or automated fund depletion, especially if an agent or script invokes the command without adequate user review.
Content: Scanner excerpt · references/llm-gateway.md (reported line 79)May include surrounding context.
bash
bankr llm credits add 25 # Add $25 credits (USDC default) bankr llm credits add 50 --token 0x... # Add $50 from a specific token bankr llm credits add 25 -y # Skip confirmation prompt

Configure automatic top-up so credits never run out:

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/llm-gateway.md (reported line 96)May include surrounding context.
md
## LLM Gateway Setup If the user already has a Bankr account, they just need to configure the gateway. If not, they need to create one first. ### Have Bankr Account

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The OpenClaw setup writes provider config containing apiKey: "your_key_here" into ~/.openclaw/openclaw.json, which implies storing a reusable secret in a local config file. Persisting credentials in plaintext config files can expose them through weak file permissions, backups, dotfile syncing, or accidental commits, leading to unauthorized use of the LLM gateway and possibly broader Bankr access if the same key is reused.
Content: Scanner excerpt · references/llm-gateway.md (reported line 154)May include surrounding context.
Auto-install the Bankr provider into your OpenClaw config:

bash
# Write config to ~/.openclaw/openclaw.json bankr llm setup openclaw --install # Preview the config without writing

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation tells users to add ANTHROPIC_AUTH_TOKEN to ~/.zshrc or ~/.bashrc, creating a long-lived secret in shell startup files without any warning about credential exposure. Shell profiles are commonly backed up, synced, inspected by other tools, or accidentally shared, so this increases the chance of API key compromise and unauthorized gateway use.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/llm-gateway.md (reported line 255)May include surrounding context.
The gateway is compatible with standard OpenAI and Anthropic SDKs — just override the base URL.

curl (OpenAI format)

bash
curl -X POST "https://llm.bankr.bot/v1/chat/completions" \

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Missing User Warnings

Tool Parameter Abuse

Direct Prompt Extraction

External Model or Provider Selection

Pass any Claude Code flags through

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

POST /agent/submit

Request Body

Transaction Fields

Vague Triggers

External Transmission

External Transmission

Session Persistence

Autonomous Decision Making

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Description-Behavior Mismatch

External Transmission

External Transmission

Missing User Warnings

Missing User Warnings

Autonomous Decision Making

Session Persistence

Session Persistence

Missing User Warnings

External Transmission

curl (OpenAI format)

Static analysis