Mint Club V2

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:34 PM UTC
• Version: 1.0.0

Overview

The skill is for real blockchain wallet operations and is coherent, but it asks agents to use raw wallet keys and a mutable global CLI for irreversible financial actions without enough safeguards.

Review this carefully before installing. Use only a dedicated low-balance wallet, avoid importing a primary wallet private key, verify the npm package and version yourself, inspect every transaction and approval before signing, and revoke allowances after use. Treat all buy, sell, swap, create, and send commands as real Base mainnet actions that can permanently move or lose funds.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:8
• Finding: Unpinned Global Installation of a Privileged Third-Party CLI## Vulnerability Details **File Location**: `SKILL.md:8`; corroborated by `README.md:27` **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: High **Complete Code Snippet**: `SKILL.md:6-9` ```bash ## Setup ```bash npm install -g mint.club-cli ``` ``` `README.md:24-28` ```bash ### Manual setup 1. Install the CLI globally: ```bash npm install -g mint.club-cli ``` ``` ### Technical Analysis The Skill instructs agents to install the latest available version of `mint.club-cli` globally. No exact version, lockfile, integrity hash, trusted package provenance requirement, or source review is provided. This external package performs security-sensitive operations, including handling wallet private keys, approving ERC-20 spending, signing blockchain transactions, and transferring assets. Its implementation is not included in the audited project, so the audit cannot verify its credential handling, transaction validation, network communication, or update behavior. A global installation also grants the package installation scripts and executable access within the user's broader environment rather than a project-local sandbox. Although installing a CLI is consistent with the Skill's functionality, a mutable, globally installed dependency exceeds the minimum access necessary. A pinned and isolated installation would be sufficient. ### Attack Path 1. An attacker compromises the npm package, publisher account, release process, or one of the package's transitive dependencies. 2. The attacker publishes a malicious release under the expected package name. 3. An agent follows the documented command and installs the mutable latest release globally. 4. The user subsequently imports a wallet key or exposes it through `PRIVATE_KEY`. 5. The compromised CLI reads the credential, modifies transaction parameters, requests excessive token approvals, or transmits the key externally. 6. ...[truncated 933 chars]
• Remediation: ## Remediation Suggestions 1. Pin `mint.club-cli` to an exact, audited version rather than installing the mutable latest release. 2. Provide and verify npm integrity hashes and package provenance before installation. 3. Review or vendor the exact CLI source used by the Skill. 4. Prefer a project-local installation such as `npm install --save-exact` and invoke it through a controlled local path instead of using `-g`. 5. Run the CLI in an isolated environment with access only to the required network endpoints and wallet material. 6. Disable or review dependency lifecycle scripts where operationally possible. 7. Use a dedicated, low-value wallet with limited balances and revoke ERC-20 allowances after use. 8. Document the expected package publisher, version, checksum, and supported network endpoints so agents can reject unexpected changes.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:11
• Finding: Wallet Private Key Exposed Through Command Arguments, Environment Variables, and Plaintext File Storage## Vulnerability Details **File Location**: `SKILL.md:11-14` and `SKILL.md:65-68`; corroborated by `README.md:31-34` and `README.md:64` **Vulnerability Type**: Insecure handling and storage of wallet credentials **Risk Level**: High **Complete Code Snippet**: `SKILL.md:11-14` ```bash Set your private key: ```bash mc wallet --set-private-key 0x... # Or export PRIVATE_KEY=0x... ``` ``` `SKILL.md:65-68` ```markdown ## Environment | Variable | Description | |----------|-------------| | `PRIVATE_KEY` | Wallet private key (or use `~/.mintclub/.env`) | ``` `README.md:31-34` ```bash 2. Set up a wallet: ```bash mc wallet --generate # Generate new wallet mc wallet --set-private-key 0x... # Or import existing ``` ``` `README.md:62-67` ```markdown The CLI handles: - Wallet management (`~/.mintclub/.env`) - Auto swap routing (finds best V3/V4 path) - ERC-20 approvals (auto-approves when needed) - Transaction confirmation and error handling ``` ### Technical Analysis The documented `--set-private-key` interface places a wallet private key in a command-line argument. Depending on the shell and operating system, this can expose the key through shell history, process listings, terminal logs, session recording, command auditing, or agent execution logs. The alternative `export PRIVATE_KEY=...` makes the key available to descendant processes. Any invoked process with access to that environment may read the credential, including the globally installed external CLI and potentially its child processes. The documentation also identifies `~/.mintclub/.env` as the wallet-management location without specifying owner-only permissions, encryption, atomic creation, symlink protections, backup exclusions, redaction, or credential deletion procedures. The audited project does not contain the CLI implementation, so it is not possible to verify whether the file is securely created or protected. ...[truncated 2145 chars]
• Remediation: ## Remediation Suggestions 1. Replace command-line key entry with an interactive, no-echo prompt that reads the secret directly from a terminal. 2. Prefer hardware wallets, external signers, or operating-system credential stores so raw private keys are never exposed to the CLI. 3. Do not recommend exporting a long-lived private key as an environment variable. 4. If file-based storage is unavoidable, create the file atomically with owner-only permissions, verify that it is not a symbolic link, and reject insecure ownership or modes before reading it. 5. Encrypt stored wallet material with a user-supplied secret and avoid retaining the decryption key in the same file. 6. Exclude credential files from logs, diagnostics, backups, synchronization tools, and source-control operations. 7. Redact private keys and environment values from agent transcripts, command output, error reports, and telemetry. 8. Separate read-only commands from signer-enabled commands. Load signing credentials only immediately before an explicitly confirmed transaction and clear them from memory afterward where practical. 9. Require transaction previews showing the network, recipient, token, amount, slippage, contract address, and approval limit before signing. 10. Recommend a dedicated low-value wallet rather than importing a primary wallet key. 11. Document secure credential rotation and immediate asset migration procedures for suspected exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README promotes high-risk blockchain actions including trading, swapping, token creation, transfers, and wallet operations, but does not warn that these actions are financially risky and often irreversible once submitted on-chain. In an agent skill context, this omission is more dangerous because an AI agent may execute commands operationally without surfacing sufficient caution to the end user.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions explicitly tell users to import a private key and mention wallet storage in a local environment file without warning that the key is highly sensitive and that compromise enables full theft of funds. In an agent-operated environment, encouraging plaintext-style secret handling without security guidance materially increases the chance of credential exposure through logs, shell history, backups, or multi-tenant hosts.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Wallet management (`~/.mintclub/.env`)
- Auto swap routing (finds best V3/V4 path)
- ERC-20 approvals (auto-approves when needed)
- Transaction confirmation and error handling

## Links

• Confidence: 88% confidence
• Finding: Automatic ERC-20 approvals delegate token spending authority to smart contracts, and describing them as automatic 'when needed' indicates the agent or CLI may make asset-affecting decisions without granular user review. In this skill's financial context, excessive or unintended approvals can expose wallet funds to loss if the approved contract, routing path, or amount is unsafe or later abused.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the user to provide a raw wallet private key via CLI or environment variable, but gives no safety guidance about secure storage, shell history exposure, process/env leakage, or the consequences of key compromise. In a blockchain trading skill, a leaked private key enables immediate unauthorized transfers and irreversible loss of all wallet-controlled assets, making this materially dangerous in context.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill provides ready-to-run buy, sell, swap, create, and send commands for live on-chain activity without warning that transactions are irreversible, price-sensitive, and can result in permanent financial loss from slippage, routing, wrong token/address selection, or malicious assets. Because the skill targets real Base mainnet operations and token creation/transfers, the absence of transactional risk warnings increases the chance that users execute destructive actions without informed consent.

Static analysis

No suspicious patterns detected.