Wallet Balance Checker

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:19 AM UTC
• Version: 1.1.0

Overview

This skill is read-only and mostly purpose-aligned, but it asks for multiple financial credentials that its instructions do not actually use and handles Coinbase credentials in a way that deserves review before installation.

Install only if you are comfortable giving the skill financial account credentials. Use read-only, least-privilege API keys, avoid running it on shared machines, and consider withholding Kalshi/Polygon/Polymarket credentials until the skill actually documents and implements those checks.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:16

Finding

Unnecessary Collection of Unused Financial Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16-31
Vulnerability Type: Excessive credential requirements and violation of least privilege
Risk Level: Medium

yaml

      - id: "kalshi-api-key"
        name: "Kalshi API Key"
        description: "Read-only API key from Kalshi account settings"
        env: "KALSHI_API_KEY"
      - id: "polygon-rpc-url"
        name: "Polygon RPC URL"
        description: "Polygon JSON-RPC endpoint (Alchemy, Infura, or public)"
        env: "POLYGON_RPC_URL"
      - id: "polymarket-wallet"
        name: "Polymarket Wallet Address"
        description: "Your 0x Polygon wallet address holding USDC"
        env: "POLYMARKET_WALLET_ADDRESS"

Technical Analysis

The skill declares a Kalshi API key, Polygon RPC URL, and Polymarket wallet address as required credentials. However, the only implemented operation in the audited file is a Coinbase API request. No documented command uses these three values.

Requiring credentials that are not necessary for implemented functionality violates the principle of least privilege. In particular, a Kalshi API key and a private Polygon RPC URL may grant account access or consume a metered provider service. Making these values available as environment variables unnecessarily increases the sensitive data exposed to the agent runtime and other processes operating in the same security context.

The audited file does not directly transmit these unused values, so this finding concerns unnecessary access and increased exposure rather than confirmed credential exfiltration.

Attack Path

1. A user installs or enables the skill based on its stated multi-platform balance-checking functionality.
2. The runtime requests the credentials declared in the skill metadata.
3. The user supplies a Kalshi API key, Polygon RPC URL, and Polymarket wallet address.
4. These values become available in the runtime environment even though the implemented operation does not require them.

...[truncated 905 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the Kalshi, Polygon RPC, and Polymarket credential declarations until corresponding operations are implemented.
• Request each credential only when the user explicitly invokes the operation that requires it.
• Separate platform integrations so enabling Coinbase balance retrieval does not expose credentials for unrelated services.
• Enforce and verify read-only API scopes rather than relying solely on descriptive text.
• Warn users when an RPC URL contains an embedded provider token and store it using a protected secret mechanism.
• Ensure secrets are isolated per skill and are not broadly inherited by unrelated tools or subprocesses.
• Document precisely why each credential is needed, where it is sent, and which permissions it must possess.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:60

Finding

Coinbase Credentials Exposed Through Process Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60-66
Vulnerability Type: Sensitive values passed through command-line arguments
Risk Level: Medium

bash

CB_SIGNATURE=$(echo -n "$CB_MESSAGE" | openssl dgst -sha256 -hmac "$COINBASE_API_SECRET" | cut -d' ' -f2)

curl -s "https://api.coinbase.com/v2/accounts" \
  -H "CB-ACCESS-KEY: $COINBASE_API_KEY" \
  -H "CB-ACCESS-SIGN: $CB_SIGNATURE" \
  -H "CB-ACCESS-TIMESTAMP: $CB_TIMESTAMP" \
  -H "CB-VERSION: 2024-01-01" \
  | jq '[.data[] | select((.balance.amount | tonumber) > 0) | {
    currency: .balance.currency,
    amount: .balance.amount,
    usd_value: .native_balance.amount
  }]'

Technical Analysis

Shell variable expansion places the Coinbase API secret in the argument vector passed to openssl through the -hmac option. The Coinbase API key and generated signature are similarly placed in the curl argument vector as header values.

On systems where process metadata is visible to other local users or processes, command-line arguments may be read through process-inspection utilities or operating-system interfaces such as /proc. Although the exposure window is limited to the lifetime of each command, a process that continuously monitors command execution may capture the values.

The API key and secret together are reusable authentication material. The generated signature is timestamp- and request-specific, but its exposure is still undesirable. The documented recommendation to use a read-only key reduces potential impact but does not technically enforce the key's permissions.

Attack Path

1. The user invokes the Coinbase balance operation.
2. The shell expands COINBASE_API_SECRET into the openssl command-line arguments.
3. The shell expands COINBASE_API_KEY and the generated signature into the curl command-line arguments.
4. A concurrent local process or user with sufficient process-inspection access monitors process argument vectors.
5. The observer captures th ...[truncated 990 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the shell recipe with a small, audited implementation that avoids placing secrets in command-line arguments.
• Use a cryptographic API that accepts the HMAC key through protected in-process memory rather than an openssl -hmac argument.
• Use an HTTP client library that sets authentication headers internally rather than exposing them in a curl process argument vector.
• Run the operation in an isolated execution context with restrictive process visibility and no unrelated local workloads.
• Ensure the Coinbase key is restricted server-side to read-only account access and the minimum necessary resources.
• Rotate the Coinbase API credentials if they may already have been used through this command pattern on a shared or untrusted host.
• Prevent verbose shell tracing, command logging, and diagnostic output from recording authentication material.
• Clear sensitive in-process data when practical and avoid making credentials available to unrelated subprocesses.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

CB_MESSAGE="${CB_TIMESTAMP}GET/v2/accounts"
CB_SIGNATURE=$(echo -n "$CB_MESSAGE" | openssl dgst -sha256 -hmac "$COINBASE_API_SECRET" | cut -d' ' -f2)

curl -s "https://api.coinbase.com/v2/accounts" \
  -H "CB-ACCESS-KEY: $COINBASE_API_KEY" \
  -H "CB-ACCESS-SIGN: $CB_SIGNATURE" \
  -H "CB-ACCESS-TIMESTAMP: $CB_TIMESTAMP" \

Static analysis

No suspicious patterns detected.