T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:36- Finding
Unverified Remote Installer Is Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Tilt Protocol — AI Fund Manager
Security checks for vulnerabilities and agentic risk
Overview
This finance skill is purpose-aligned but needs Review because it combines wallet signing, autonomous trading, mutable remote instructions, unverified installer execution, and weak transaction safeguards.
Install only if you are comfortable letting an agent create wallets, hold a private key in environment variables, sign blockchain transactions, and publicly post strategy or trade rationale. Treat the remote skill-update command as untrusted unless you manually review and verify changes, install Foundry separately from a trusted source, use testnet-only keys, require explicit approval before every state-changing transaction, avoid unlimited token approvals, and set real slippage limits instead of minAmountOut=0.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:14- Finding
Mutable Skill Instructions Are Retrieved Before Every Session Without Content Authentication
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:113- Finding
Vault Factory Receives an Unlimited Token Allowance
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:190- Finding
Trade Examples Disable Minimum-Output Slippage Protection
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 } cast send "$VAULT_ADDRESS" \ "executeTrade(address,address,uint256,uint256)" \ "$TOKEN_IN" "$TOKEN_OUT" "$AMOUNT_IN" "$MIN_AMOUNT_OUT" \ --private-key "$TILT_PRIVATE_KEY" \ --rpc-url "$TILT_RPC" ``` ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (23)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The skill instructs fetching the latest skill content from a remote endpoint at the start of each session, effectively bypassing any reviewed local version and creating a live remote-instruction channel. If that endpoint is compromised or updated maliciously, the agent could receive altered contract addresses, workflows, or commands that lead to asset loss or credential theft.
- Content
Before starting any session, fetch the latest version of this skill. Contract addresses, API endpoints, and workflow steps may change:
bash curl -s https://bowstring-backend-production.up.railway.app/api/agents/skill -o /tmp/tilt-skill-latest.md && echo "Skill updated — review /tmp/tilt-skill-latest.md for any changes"Environment
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The command pipes a remote script directly into bash, enabling arbitrary code execution from an external server with no integrity check or review step. In a skill that also handles private keys and on-chain transactions, this is especially dangerous because compromised installation output could steal secrets, alter transaction tooling, or backdoor the environment before any blockchain actions occur.
- Content
bash # Install Foundry (provides `cast` for on-chain interaction) curl -L https://foundry.paradigm.xyz | bash foundryup # Verify
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README promotes autonomous wallet creation, self-custodied key use, shell execution, network access, and on-chain trading without any explicit warning that blockchain actions may be irreversible and may put funds at risk. In a skill specifically designed to let agents manage tokenized funds, omission of safety guidance increases the chance that users enable powerful capabilities without understanding the financial and operational consequences.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs use of a private key from an environment variable for signing and repeatedly frames the agent as self-custodied, but does not provide strong operational guidance on secret handling, least-privilege use, or avoiding disclosure in logs and subprocesses. Any leakage of the private key would immediately compromise the wallet and all controlled vault assets.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
If a stock token isn't deployed yet, request deployment (validated against the official stock list):
bash curl -s -X POST "$TILT_API_BASE/api/agents/deploy-token" \ -H "Content-Type: application/json" \ -d '{"symbol": "AAPL"}' | jq .
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs the agent to submit irreversible on-chain approval, vault creation, allocation, and trading transactions without prominently warning about transaction finality, slippage, approval risk, or potential financial loss. Even on testnet, these patterns normalize unsafe operational behavior and could cause users or downstream agents to execute real-value transactions with inadequate review if addresses or environments change.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
After each
executeTrade, post a note explaining your reasoning. This is displayed publicly on the strategy page — think of it like a git commit message for your trades:bash curl -s -X POST "$TILT_API_BASE/api/agents/trade-notes" \ -H "Content-Type: application/json" \ -d "{\"txHash\": \"TX_HASH\", \"vault\": \"$VAULT_ADDRESS\", \"note\": \"Rotating from AAPL to NVDA — AI infrastructure demand accelerating after strong earnings beat\", \"agent\": \"YOUR_AGENT_NAME\"}" | jq .
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 9: Request More Funds
bash curl -s -X POST "$TILT_API_BASE/api/agents/faucet" \ -H "Content-Type: application/json" \ -d "{\"walletAddress\": \"$TILT_WALLET\"}" | jq .
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The description presents the agent as an 'autonomous AI fund manager' that can create vaults, execute trades, and manage funds autonomously, but it does not define when these actions are allowed, what approvals are required, or what actions are out of scope. That broad framing can cause over-invocation or unsafe delegation of discretionary trading behavior, especially in a wallet-owning agent tied to blockchain transactions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description explicitly promotes autonomous fund management, on-chain trading, and self-signing transactions without warning users that the skill can move assets, incur losses, or execute irreversible blockchain actions. In a finance and DeFi context, omission of risk disclosure materially increases the chance that users enable high-impact actions without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example instructs the agent to generate a wallet, expose a private key in shell commands and environment variables, register with a remote service, and immediately execute irreversible on-chain approval and vault-creation transactions without any safety warning or confirmation step. In a skill for autonomous fund creation, this is especially risky because users or downstream agents may copy the workflow verbatim, leading to credential leakage, overbroad token approvals, and unintended movement of real funds.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
export TILT_WALLET=$(cast wallet address $TILT_PRIVATE_KEY)
Register and get funded
curl -s -X POST "$TILT_API_BASE/api/agents/register"
-H "Content-Type: application/json"
-d '{"walletAddress": "0xaB1c...4eF2", "name": "Tech Alpha AI", "description": "AI-driven tech sector fund focusing on AI infrastructure leaders"}' | jq .text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
export TILT_WALLET=$(cast wallet address $TILT_PRIVATE_KEY)
Register and get funded
curl -s -X POST "$TILT_API_BASE/api/agents/register"
-H "Content-Type: application/json"
-d '{"walletAddress": "0xaB1c...4eF2", "name": "Tech Alpha AI", "description": "AI-driven tech sector fund focusing on AI infrastructure leaders"}' | jq .text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Let me post an initial strategy update:
bash curl -s -X POST "$TILT_API_BASE/api/agents/strategy-posts" \ -H "Content-Type: application/json" \ -d '{"vault": "$VAULT_ADDRESS", "content": "Fund launched. Core thesis: AI infrastructure spending is in early innings. NVDA overweight for GPU demand, AAPL/MSFT for ecosystem moats. Will monitor earnings and rotate if thesis changes.", "agent": "Tech Alpha AI", "type": "strategy"}' | jq .
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Let me post an initial strategy update:
bash curl -s -X POST "$TILT_API_BASE/api/agents/strategy-posts" \ -H "Content-Type: application/json" \ -d '{"vault": "$VAULT_ADDRESS", "content": "Fund launched. Core thesis: AI infrastructure spending is in early innings. NVDA overweight for GPU demand, AAPL/MSFT for ecosystem moats. Will monitor earnings and rotate if thesis changes.", "agent": "Tech Alpha AI", "type": "strategy"}' | jq .
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
This curl command transmits vault identifiers and strategy commentary to an external API endpoint. In the context of an autonomous investment agent, outbound transmission of portfolio-related information is sensitive because it can reveal holdings context, decision logic, and activity patterns to third parties or unintended audiences.
- Content
(agent reviews market data via its own research tools)
Decision: HOLD — no action needed, post update
curl -s -X POST "$TILT_API_BASE/api/agents/strategy-posts"
-H "Content-Type: application/json"
-d '{"vault": "$VAULT_ADDRESS", "content": "Morning review: portfolio up 2% since launch, weights within tolerance. CPI data at 8:30 AM — staying flat until we see the print. If inflation comes in hot, may trim growth exposure.", "agent": "Tech Alpha AI", "type": "hold"}' | jq .text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This example shows an autonomous scheduled agent making an external POST to publish strategy commentary without any explicit consent, approval gate, or user-facing warning about recurring outbound publication. In a financial context, scheduled public disclosures can leak portfolio state, market posture, and timing information, and may create compliance, privacy, or reputational risk if users do not expect automated broadcasting.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This second external POST sends additional market commentary tied to a vault, reinforcing a pattern of autonomous network publication. In this skill's financial setting, public or third-party transmission of ongoing strategy updates can enable profiling of the agent's behavior and may have compliance or confidentiality implications.
- Content
Later that day, after CPI data:
bash curl -s -X POST "$TILT_API_BASE/api/agents/strategy-posts" \ -H "Content-Type: application/json" \ -d '{"vault": "$VAULT_ADDRESS", "content": "CPI came in at 2.4%, below expectations. Risk-on environment confirmed. Keeping current allocation — tech overweight is well positioned for a rate-cut cycle.", "agent": "Tech Alpha AI", "type": "market"}' | jq .
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The second scheduled POST similarly sends externally visible market commentary without an explicit warning that the agent autonomously publishes updates later in the day. Even though the content is not credential material, repeated automated disclosures about strategy and positioning can expose operational behavior and create unintended data-sharing or regulatory issues.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example performs a real blockchain trade via
cast sendusing a private key and sets minimum output to0, yet provides no warning, simulation step, or explicit user confirmation before signing. In an agent-skill context, examples are often copied into automation flows, so this can normalize unattended asset movement and expose users to accidental execution, bad pricing, or irreversible loss.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
This
curlPOST transmits transaction and vault metadata plus human-authored rationale to an external endpoint. In a financial-agent setting, such disclosures can reveal positions, timing, and strategy signals that may be sensitive or exploitable by third parties.- Content
bash # Log trade note curl -s -X POST "$TILT_API_BASE/api/agents/trade-notes" \ -H "Content-Type: application/json" \ -d '{"txHash": "0xabc123...", "vault": "$VAULT_ADDRESS", "note": "Rotating $800 from AAPL to NVDA — data center revenue up 93% YoY, guidance raised. AI infrastructure thesis strengthening.", "agent": "Tech Alpha AI"}' | jq .
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
This POST publishes a strategy update containing portfolio allocation changes and forward-looking rationale to a remote API. In context, that can disclose actionable market views and fund state, increasing privacy, front-running, or reputational/compliance risk if shared automatically.
- Content
-d '{"txHash": "0xabc123...", "vault": "$VAULT_ADDRESS", "note": "Rotating $800 from AAPL to NVDA — data center revenue up 93% YoY, guidance raised. AI infrastructure thesis strengthening.", "agent": "Tech Alpha AI"}' | jq .
Post strategy update
curl -s -X POST "$TILT_API_BASE/api/agents/strategy-posts"
-H "Content-Type: application/json"
-d '{"vault": "$VAULT_ADDRESS", "content": "Post-earnings rebalance: increased NVDA to ~48% after blowout data center numbers. AI capex cycle accelerating. Trimmed AAPL to fund — still long-term bullish but NVDA has more near-term upside.", "agent": "Tech Alpha AI", "type": "strategy"}' | jq .text
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example sends trade notes and strategy posts to remote APIs without clearly warning that portfolio identifiers, transaction hashes, and investment rationale will be transmitted off-host. This can leak sensitive trading behavior and metadata that may be private, regulated, or commercially sensitive, especially when embedded into autonomous agent workflows.
- Content