Security audit

DECK-0

Security checks for vulnerabilities and agentic risk

Overview

This DECK-0 skill is coherent, but it needs Review because it can sign live blockchain transactions and documents raw private-key fallback flows without strong per-transaction safeguards.

Install only if you intend to use DECK-0 wallet-linked features. Prefer a runtime wallet, hardware wallet, or dedicated low-value wallet, avoid DECK0_PRIVATE_KEY for real funds, and manually confirm chain, contract address, pack IDs, quantity, total value, and gas before any transaction. Expect app.deck-0.com to receive wallet addresses, signatures, collection activity, recap data, and publisher application content.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: auth.md:128
Finding: Wallet private key exposed through command-line arguments
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:7
Finding: Unpinned third-party Skill installation creates supply-chain risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: errors.md:130
Finding: Predictable shared temporary files permit symlink attacks and data exposure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
md
See [errors.md](./errors.md) for all error codes and troubleshooting.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.
md
See [errors.md](./errors.md) for all error codes and troubleshooting.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The README instructs users to install the skill via npx skills add signorcrypto/deck0-skills without pinning a specific package version or commit. This creates a supply-chain risk: a later compromised or maliciously updated package/tooling release could be fetched and executed implicitly, which is especially concerning for a skill that interfaces with wallets and on-chain transactions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill advertises pack purchases and pack opening through smart contract transactions but does not prominently warn that these actions may spend funds and be irreversible once signed and broadcast. In the context of an agent skill, missing consent and risk language increases the chance that a user authorizes unintended financial actions without understanding the consequences.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description is broad enough to match generic requests about collecting cards, managing collections, or creating card collections, which can cause the agent to invoke this transactional NFT/crypto skill when the user did not intend to access DECK-0 specifically. Because the skill supports authenticated API calls and on-chain purchase/open actions, accidental activation can expose wallet-linked data, initiate sensitive flows, or steer users into unintended crypto transactions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation provides a fallback mode that directly uses a private key from an environment variable for request signing. While common in developer examples, embedding this pattern in a skill that may run in agent environments increases the chance of unsafe key handling, accidental logging, or reuse of a hot wallet without clearly warning that the credential grants signing authority.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · auth.md (reported line 130)May include surrounding context.
md
local signature signature="$(cast wallet sign --private-key "$DECK0_PRIVATE_KEY" "$payload")" # Export for use in curl HEADER_WALLET="$WALLET" HEADER_CHAIN_ID="$DECK0_CHAIN_ID" HEADER_TIMESTAMP="$timestamp"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The pack-opening recap endpoint returns transaction-linked results, cards received, guild-related badge information, and a collector identifier, all tied to an authenticated user. The markdown description does not warn that polling and displaying this data may expose sensitive activity or identity-linked collection information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: These sections describe reading and submitting publisher application data including wallet address, collection description, motivational letter, rejection reason, and timestamps. The markdown omits any warning that this is user-submitted profile/application content that may be sensitive and should be handled carefully.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · errors.md (reported line 130)May include surrounding context.
The X-Agent-* headers in the example below should be produced via the same auth flow as in auth.md (e.g. sign_request and the authenticated request helpers).

bash
HTTP_CODE=$(curl -s -o /tmp/response.json -w "%{http_code}" "$url" \ -H "X-Agent-Wallet-Address: $HEADER_WALLET" \ -H "X-Agent-Chain-Id: $HEADER_CHAIN_ID" \ -H "X-Agent-Timestamp: $HEADER_TIMESTAMP" \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example instructs the agent or user to execute a value-bearing blockchain transaction with a private key and computed --value, but it does not explicitly warn that real funds will be spent and the action is irreversible once broadcast. In an agent-skill context, examples often become implementation templates, so omitting a spending confirmation step increases the chance of unintended financial loss or autonomous execution against a live wallet.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The pack-opening example signs and submits an on-chain transaction using a private key but does not clearly state that the action is irreversible and changes ownership state of user assets. Even though it may not transfer currency directly, it affects owned packs and can trigger unintended asset changes if copied blindly by an agent or operator.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document instructs users how to perform payable on-chain purchases and irreversible pack-opening operations, but it does not prominently warn that minting spends native tokens plus gas and that opening packs is an irreversible state-changing transaction. In an agent skill context, this omission can cause users or downstream automation to authorize transactions without fully understanding financial cost and asset consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The shell example directly relies on a raw private key in an environment variable and passes it to command-line tooling without any accompanying security guidance. In practice, this encourages unsafe key handling patterns that can lead to credential leakage through shell history, process inspection, logs, CI systems, or copied scripts, enabling full wallet compromise and unauthorized transactions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The README describes wallet-authenticated API requests and submission of publisher applications, but it does not clearly disclose what wallet-linked data, signatures, addresses, or application contents are sent to the DECK-0 service. Because the skill ties identity and activity to a blockchain wallet, inadequate privacy notice can expose users to unintended data sharing and profiling risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file documents authenticated endpoints that return a user's wallet-specific album collection and account share URL, but it does not include any warning about exposing personal account or collection data. Under the markdown criteria for SQP-2, descriptions should warn when behavior can affect user privacy or reveal user-linked data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.