Security audit

Shekel Arena

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent trading purpose, but it asks users to run persistent automated trading code with financial secrets and contains confirmed command-injection and supply-chain risks.

Review carefully before installing. Use only a dedicated low-funded trading wallet, do not print or paste the .env file, avoid enabling cron or launchd until the shell command construction is fixed, and prefer pinned commits and locked dependencies for all cloned repositories and npx tooling.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/mirror.ts:145
Finding: Shell Command Injection Through Remotely Sourced Trading Data
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:65
Finding: Unpinned Installation and Execution of Mutable Third-Party Code
Content: View full analysis
Remediation: View remediation
--depth 1 https://github.com/Virtual-Protocol/acp-cli.git ~/acp-cli cd ~/acp-cli test "$(git rev-parse HEAD)" = "" || exit 1 ``` 2. Publish expected commit hashes and cryptographic checksums through a trusted channel. 3. Prefer signed release tags and verify their signatures before installation. 4. Require committed lockfiles and use deterministic installation: ```bash npm ci ``` 5. Where compatible, initially disable lifecycle scripts: ```bash npm ci --ignore-scripts ``` Review and explicitly run only lifecycle steps proven necessary. 6. Pin `tsx` as a local dependency and invoke the reviewed local binary rather than permitting `npx` to resolve tooling dynamically. 7. Document the exact versions reviewed with this Skill and establish an update process that requires security review before changing them. 8. Run the mirror under a dedicated, unprivileged operating-system account with access only to the required project directory and trading credentials. 9. Restrict the credential file to its owner: ```bash chmod 600 ~/dgclaw-skill/.env ``` 10. Avoid commands such as `cat ~/dgclaw-skill/.env` in normal setup instructions because they expose every secret to terminal output, logs, screen sharing, and shell-session capture. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (48)

Credential Access

High

Category: Privilege Escalation
Confidence: 82% confidence
Finding: The skill instructs users to run cat ~/dgclaw-skill/.env, which prints all stored secrets to the terminal. In agent-assisted or logged environments, this can leak API keys and wallet material into chat transcripts, shell history capture, terminal logging, or observability systems.
Content: Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.
Step 9 — Configure .env

bash
cat ~/dgclaw-skill/.env

Must contain all keys:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.
md
cd ~/dgclaw-skill && npx tsx scripts/mirror.ts

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.
md
cd ~/dgclaw-skill && npx tsx scripts/mirror.ts

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · references/troubleshooting.md (reported line 16)May include surrounding context.
Mirror not detecting new trades

Cause: State file recorded trade ID before new trade fired. Fix: Reset state to previous trade ID:

bash
# Get last trade ID before the one you want mirrored echo '{"lastTradeId":"<previous-trade-id>","lastOrderIds":[],"mirroredPositions":{}}' > ~/dgclaw-skill/.mirror-state.json

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CHANGELOG.md (reported line 74)May include surrounding context.
md
const __filename = fileURLToPath(import.meta.url); const __dirname = path.dirname(__filename); // ─── Load .env ──────────────────────────────────────────────────────────────── const envPath = path.join(__dirname, "../.env"); if (fs.existsSync(envPath)) { const envContent = fs.readFileSync(envPath, "utf8");

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CHANGELOG.md (reported line 79)May include surrounding context.
md
const __filename = fileURLToPath(import.meta.url); const __dirname = path.dirname(__filename); // ─── Load .env ──────────────────────────────────────────────────────────────── const envPath = path.join(__dirname, "../.env"); if (fs.existsSync(envPath)) { const envContent = fs.readFileSync(envPath, "utf8");

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
md
const __filename = fileURLToPath(import.meta.url); const __dirname = path.dirname(__filename); // ─── Load .env ──────────────────────────────────────────────────────────────── const envPath = path.join(__dirname, "../.env"); if (fs.existsSync(envPath)) { const envContent = fs.readFileSync(envPath, "utf8");

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.
md
const __filename = fileURLToPath(import.meta.url); const __dirname = path.dirname(__filename); // ─── Load .env ──────────────────────────────────────────────────────────────── const envPath = path.join(__dirname, "../.env"); if (fs.existsSync(envPath)) { const envContent = fs.readFileSync(envPath, "utf8");

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.
md
const __filename = fileURLToPath(import.meta.url); const __dirname = path.dirname(__filename); // ─── Load .env ──────────────────────────────────────────────────────────────── const envPath = path.join(__dirname, "../.env"); if (fs.existsSync(envPath)) { const envContent = fs.readFileSync(envPath, "utf8");

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.
md
const __filename = fileURLToPath(import.meta.url); const __dirname = path.dirname(__filename); // ─── Load .env ──────────────────────────────────────────────────────────────── const envPath = path.join(__dirname, "../.env"); if (fs.existsSync(envPath)) { const envContent = fs.readFileSync(envPath, "utf8");

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.
md
const __filename = fileURLToPath(import.meta.url); const __dirname = path.dirname(__filename); // ─── Load .env ──────────────────────────────────────────────────────────────── const envPath = path.join(__dirname, "../.env"); if (fs.existsSync(envPath)) { const envContent = fs.readFileSync(envPath, "utf8");

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.
md
const __filename = fileURLToPath(import.meta.url); const __dirname = path.dirname(__filename); // ─── Load .env ──────────────────────────────────────────────────────────────── const envPath = path.join(__dirname, "../.env"); if (fs.existsSync(envPath)) { const envContent = fs.readFileSync(envPath, "utf8");

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.
md
const __filename = fileURLToPath(import.meta.url); const __dirname = path.dirname(__filename); // ─── Load .env ──────────────────────────────────────────────────────────────── const envPath = path.join(__dirname, "../.env"); if (fs.existsSync(envPath)) { const envContent = fs.readFileSync(envPath, "utf8");

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/mirror.ts (reported line 27)May include surrounding context.
ts
const __filename = fileURLToPath(import.meta.url); const __dirname = path.dirname(__filename); // ─── Load .env ──────────────────────────────────────────────────────────────── const envPath = path.join(__dirname, "../.env"); if (fs.existsSync(envPath)) { const envContent = fs.readFileSync(envPath, "utf8");

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/mirror.ts (reported line 28)May include surrounding context.
ts
const __dirname = path.dirname(__filename); // ─── Load .env ──────────────────────────────────────────────────────────────── const envPath = path.join(__dirname, "../.env"); if (fs.existsSync(envPath)) { const envContent = fs.readFileSync(envPath, "utf8"); for (const line of envContent.split("\n")) {

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/mirror.ts (reported line 41)May include surrounding context.
ts
const __dirname = path.dirname(__filename); // ─── Load .env ──────────────────────────────────────────────────────────────── const envPath = path.join(__dirname, "../.env"); if (fs.existsSync(envPath)) { const envContent = fs.readFileSync(envPath, "utf8"); for (const line of envContent.split("\n")) {

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/mirror.ts (reported line 136)May include surrounding context.
ts
const __dirname = path.dirname(__filename); // ─── Load .env ──────────────────────────────────────────────────────────────── const envPath = path.join(__dirname, "../.env"); if (fs.existsSync(envPath)) { const envContent = fs.readFileSync(envPath, "utf8"); for (const line of envContent.split("\n")) {

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill requires and handles multiple sensitive environment variables, including API keys and a trading private key, but does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, missing permission declarations increases the chance that the skill can access or encourage use of secrets without clear isolation or user consent.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · CHANGELOG.md (reported line 65)May include surrounding context.
md
- **Node.js v20+** in that terminal - **USDC on Base network** to fund Arena account (minimum $10, recommend $100+) > **macOS users**: Replace all `sudo service cron start` with `launchd`. See macOS section at the end. ---

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
- **Node.js v20+** in that terminal - **USDC on Base network** to fund Arena account (minimum $10, recommend $100+) > **macOS users**: Replace all `sudo service cron start` with `launchd`. See macOS section at the end. ---

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The skill instructs users to run npx tsx without pinning an exact package version, which can cause execution of whatever version is currently resolved from the registry. In a security-sensitive trading workflow, this creates supply-chain risk because a malicious or compromised upstream release could execute arbitrary code with access to local secrets and wallets.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: This npx tsx invocation is unpinned and may fetch or execute an unexpected package version at runtime. Because the command participates in blockchain/account setup, compromise here could expose credentials or alter wallet configuration.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: Running npx tsx without version pinning introduces avoidable supply-chain risk. The surrounding context includes account funding and job execution, so arbitrary code execution here could tamper with deposits or harvest environment-based secrets.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The activation command depends on unpinned tsx, allowing potentially different code to run over time. In this skill, that code operates near wallet activation and signing flows, which increases the security significance of supply-chain compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The mirror script is executed via unpinned npx tsx, creating a recurring supply-chain execution point in a workflow that reads trading state and can trigger mirrored trades. If the package resolution is compromised, an attacker could gain code execution in an environment containing API keys and private keys.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/mirror.ts:147

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Credential Access

Step 9 — Configure .env

Ae1

Ae1

Memory Manipulation

Mirror not detecting new trades

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Undeclared Tool Scope

Sudo/Root Execution

Sudo/Root Execution

Rp1

Rp1

Rp1

Rp1

Rp1

Static analysis

Shell command execution detected (child_process).