Guardrail Agent Smart Account Wallets

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:58 PM UTC
• Version: 1.1.1

Overview

This skill appears purpose-built for smart-account guardrails, but users should review it because it handles financial authority and sends dashboard credentials plus planned transaction details to a configurable API service.

Install only if you trust AgentGuardrail or your self-hosted API endpoint with dashboard credentials and pre-transaction intent data. Use scoped, revocable API keys and signer tokens, start on testnet, prefer explicit allowlists and low spending limits, and avoid setting GUARDRAIL_API_URL to any endpoint you do not control or trust.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:457

Finding

Configurable API Destination Can Receive Authentication Credentials and Sensitive Transaction Intent Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 457-479
Vulnerability Type: Sensitive information exposure through a configurable network destination
Risk Level: Medium

Vulnerable Code

javascript

const apiUrl = process.env.GUARDRAIL_API_URL ?? "https://agentguardrail.xyz";

// Pre-flight check before building a UserOperation
const result = await fetch(`${apiUrl}/api/v1/validate`, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: `Bearer ${process.env.GUARDRAIL_DASHBOARD_API_KEY}`,
  },
  body: JSON.stringify({
    agent_id: "agent-uuid",
    action: {
      type: "swap",
      token: "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
      protocol: "0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D",
      amount: "500000000000000000",
      chain: 8453,
      to: "0xDef1C0ded9bec7F1a1670819833240f027b25EfF",
    },
  }),
}).then((r) => r.json());

Technical Analysis

The skill instructs the agent to send a bearer API key and detailed transaction intent to an endpoint controlled by GUARDRAIL_API_URL. The transmitted data includes the agent identifier, intended action, token, protocol, amount, chain, and recipient address.

The destination defaults to the third-party service https://agentguardrail.xyz, while the environment variable permits replacing it with an arbitrary URL. The example does not validate the destination scheme or hostname, enforce TLS, or require explicit user confirmation before transmitting the data. Consequently, a configuration error or maliciously modified environment value could direct the bearer credential and transaction metadata to an attacker-controlled server.

This behavior is not strictly necessary for the skill's core on-chain enforcement functionality. The document states that PermissionEnforcer performs authoritative validation on-chain and characterizes this API request as an optional pre-flight ...[truncated 2491 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat GUARDRAIL_API_URL as a security-sensitive setting and require explicit user or administrator approval before enabling a custom destination.
2. Validate the URL before every authenticated request:
   • Require https:.
   • Reject embedded credentials.
   • Reject unexpected ports.
   • Block loopback, link-local, private-network, and cloud-metadata destinations unless explicitly required for an approved self-hosted deployment.
   • Prefer an exact hostname allowlist or certificate-pinned service configuration.
3. Bind each API credential to its intended origin. Do not attach GUARDRAIL_DASHBOARD_API_KEY after redirects or when the resolved destination differs from the approved origin.
4. Disable automatic redirects for authenticated requests, or strip authorization headers on every cross-origin redirect.
5. Make API pre-flight validation opt-in. Default to direct on-chain validation and read-only RPC operations because these are sufficient for the declared enforcement model.
6. Prompt for confirmation before sending transaction intent to an off-chain service, clearly identifying the recipient and the fields that will be disclosed.
7. Minimize transmitted data. Use pseudonymous identifiers and omit recipient, amount, or protocol details when they are not essential to the requested validation.
8. Use narrowly scoped, short-lived API tokens with separate permissions for validation, audit access, deployment, and policy administration.
9. Update the privacy section to accurately disclose that validation requests transmit planned transaction data and may create off-chain audit records.
10. Add explicit error handling and fail closed if URL validation, TLS verification, or server authentication fails.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.