ClawHub
Back to skill

Security audit

Signet

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Signet ad placement, but it asks users or agents to run mutable third-party code while exposing a blockchain private key for paid onchain actions.

Review before installing or using. Use only a dedicated low-value wallet, avoid passing raw private keys on the command line, prefer a protected signer or vault, pin and verify the CLI version, and simulate plus manually confirm destination, network, token, and amount before any live post.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:14
Finding

Unpinned npm Package Is Downloaded and Executed Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-25
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code

bash
# Estimate cost for spotlight placement
npx @signet-base/cli estimate --hours 6

# List recent signatures
npx @signet-base/cli list --count 10

# Post a URL (simulate first to check cost)
npx @signet-base/cli post --url https://example.com --hours 6 --simulate

# Post for real (requires PRIVATE_KEY env or --private-key)
PRIVATE_KEY=0x... npx @signet-base/cli post --url https://example.com --hours 6

Technical Analysis

The documented commands invoke @signet-base/cli through npx without specifying an exact package version. If the package is not already available locally, npx can retrieve and immediately execute the version currently resolved by the npm registry.

There is no lockfile, integrity hash, trusted package snapshot, or publisher verification in the audited project. Consequently, the code executed at runtime can differ from the code that was previously reviewed. This is particularly sensitive because the package is invoked in a process that may have access to a blockchain private key.

This finding concerns the unsafe dependency execution mechanism; the available evidence does not establish that the current package itself is malicious.

Attack Path

  1. An attacker compromises the package publisher, npm account, registry resolution path, or a future package release.
  2. The attacker publishes a modified version of @signet-base/cli.
  3. A user or agent follows the Skill and runs an unversioned npx @signet-base/cli command.
  4. npx resolves, downloads, and executes the attacker-controlled release.
  5. The malicious package reads accessible environment variables, including PRIVATE_KEY, modifies transaction or payment parameters, or performs arbitrary actions with the invoking process's operating-system privi ...[truncated 398 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin @signet-base/cli to a reviewed, exact version rather than resolving the latest release.
  • Install it through a package manifest and committed lockfile using integrity-verifying installation procedures.
  • Verify package ownership, provenance, signatures, and registry integrity before execution.
  • Avoid granting the CLI direct access to a valuable wallet key. Use a dedicated, low-value wallet with narrowly limited funds.
  • Run the package in a sandbox with restricted filesystem, environment, and network access.
  • Establish an update-review process so package version changes are inspected before deployment.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:24
Finding

Blockchain Private Key Is Passed Through Exposed Process Interfaces

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24-25; additional related option documented at line 32
Vulnerability Type: Unsafe secret handling
Risk Level: High

Vulnerable Code

bash
# Post for real (requires PRIVATE_KEY env or --private-key)
PRIVATE_KEY=0x... npx @signet-base/cli post --url https://example.com --hours 6

The Skill additionally documents the following command option:

text
- **post** — Place a URL on the spotlight via x402 payment. Options: `--url <url>`, `--hours <0-24>`, `--private-key <key>`, `--simulate`

Technical Analysis

The recommended real-posting command makes the private key available as an environment variable to the third-party CLI and all code loaded into that process. Although inline environment assignment is generally less exposed than a command-line secret, it still places the key inside the process environment and may expose it through debugging, crash reporting, telemetry, process inspection under applicable permissions, or malicious dependency code.

The alternative --private-key option is more dangerous because command-line arguments can be retained in shell history, agent transcripts, diagnostic output, audit logs, and process listings. A blockchain private key is a bearer credential: possession of it is sufficient to create valid signatures without further authentication.

Attack Path

  1. A user supplies a real wallet private key using PRIVATE_KEY or the documented --private-key option.
  2. The secret becomes available to the CLI process and its dependencies; when supplied as an argument, it may also be recorded in shell history, logs, transcripts, or process metadata.
  3. A malicious dependency, compromised host user, monitoring component, log reader, or other party with access to one of these surfaces captures the key.
  4. The attacker imports the key into another wallet or signing program.
  5. The attacker signs unauthorized ...[truncated 459 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove --private-key from recommended workflows and never place private keys directly in command-line arguments.
  • Use a hardware wallet, operating-system keychain, isolated signing service, or wallet provider that signs without revealing raw key material to the CLI.
  • Use a dedicated wallet funded only with the minimum amount required for the intended transaction.
  • Require explicit review of the destination, network, token, amount, and transaction payload before signing.
  • Ensure secrets are redacted from agent transcripts, shell history, logs, telemetry, error reports, and crash dumps.
  • If an environment variable remains necessary, inject it only at runtime from a protected secret manager and unset it immediately afterward.
  • Rotate any key that has previously been supplied through command-line arguments or exposed in logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill instructs users to run npx @signet-base/cli without pinning an exact package version, which causes code to be fetched and executed from the registry at runtime. If the package is compromised, typosquatted, or a maintainer publishes a malicious update, an agent or user could execute attacker-controlled code, potentially exposing environment variables, wallets, or host access.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This command again uses unpinned npx, which executes the latest registry-resolved package at the time of use. In a skill that may be used by autonomous agents and can interact with payments, runtime package substitution or a malicious upstream release could lead to code execution and credential compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The simulated post flow still invokes unpinned remote code via npx, so it carries the same supply-chain execution risk even if it does not submit the final transaction. Because the flow processes payment requirements and may touch wallet-related logic, a compromised package could still exfiltrate secrets or manipulate outputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill provides real posting instructions that can spend funds and handle a raw private key, but it does not include an explicit warning about irreversible onchain effects, payment risk, or safe key handling. In an agent-oriented context, that omission increases the chance that users or automated systems execute a live transaction without understanding the cost or the danger of exposing a private key to process environments.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

This example combines unpinned npx execution with a PRIVATE_KEY environment variable for a real paid onchain action. That creates a severe supply-chain risk: if the fetched CLI is malicious or compromised, it can read the private key from the environment and drain funds or sign unintended transactions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

Estimate Cost

bash
curl "https://signet.sebayaki.com/api/x402/estimate?guaranteeHours=0"

Response:

Static analysis

No suspicious patterns detected.